WiFi Timelines

WiFi timelines provide an easy to parse overview of how parameters of an access point (BSSID) or network (SSID) changed over time.

The timeline feature is designed for investigation and threat hunting. The network monitoring functionality is a much better fit for monitoring and alerting.

The timeline of a BSSID or SSID always considers data from all taps of a tenant.

How Timeline Events are calculated

Every five minutes, a background task is analyzing the current settings of every known BSSID and SSID and computes Timeline Events from any changes compared to the previous period. The Timeline page is reading and displaying these generated events.

Note that tap names are always the names that were configured during event calculation and do not change or update when you edit a tap name. This is a design choice made to make sure that no confusion is introduced when moving or re-purposing an existing tap and giving it a new name.