×
×
×
×

Device Timeline — Visual Endpoint Performance & User Activity View

Last Updated On 04 Dec 2025 |
7 minutes read |

Overview

The Device Timeline provides a chronological, visual view of system performance and user activity on an endpoint. It continuously collects key metrics and displays them on the device’s detail page as an interactive, time-based timeline.

This helps IT administrators quickly understand how a device behaves throughout the day and identify changes, trends, or anomalies without switching between multiple tools.

Why This Feature Matters

Device Timeline helps IT teams:

  • Monitor device health proactively through regularly updated performance data.
  • Identify performance spikes in CPU, memory, disk, GPU, or network usage.
  • Correlate user activity with system behavior to accelerate root-cause analysis.
  • Visualize trends over time instead of relying on isolated point-in-time data.
  • Detect anomalies automatically with Zia insights that highlight abnormal events.
  • Reduce troubleshooting time by consolidating behavioral data into a single view.

How the Device Timeline Works

  1. Endpoint metrics are continuously collected in the background. Every 10 minutes, the system calculates the average values for each metric from that 10-minute window and posts the summarized data to the timeline. This ensures that the timeline reflects consistent, interval-based insights rather than moment-by-moment fluctuations.
  2. Each metric category (for example, Performance, Network, and User Interactions) appears as a separate horizontal timeline.
  3. Shaded blocks on a timeline represent activity or utilization within each collection interval.
  4. Hovering over a block displays usage details for that specific time slice.
  5. Clicking a block opens a detailed insights panel with specifications, usage breakdowns, and any related anomaly information.
  6. The timeline updates automatically after each data sync, so you always see the latest collected information.

Step-by-Step Instructions

1. Accessing the Device Timeline

To open the Device Timeline for a device:

  1. Navigate to the Devices view in the console.
  2. Select the device you want to investigate.
  3. Open the Device Timeline tab in the device details page.
accessing the device timeline

On the Device Timeline tab, you will see:

  • The last data sync time.
  • Expandable metric groups (Performance, Network, User Interactions).
  • Timeline charts for each available metric.


      • 2. Reviewing Timeline Metrics

      Under the Performance, Network, and User Interactions sections, the timeline can display metrics such as:

      • CPU
      • System drive space
      • Memory
      • Disk performance
      • GPU
      • Ethernet
      • User activity patterns

      Each metric appears as a track that displays activity across time, helping you spot spikes, dips, or unusual usage patterns at a glance.

      3. Viewing Metric Details

      Hover over any activity block to see a quick summary, including:

      • The time range for that block.
      • Metric values (for example, CPU usage, interrupts).
      • Use this on-hover data for a quick, lightweight review without opening the full details pane.

      Click a block to open a detailed pane that shows:

      • Hardware or subsystem specifications.
      • Usage details for the selected time period.
      • Any relevant anomaly alerts associated with that time slice.

      Use the horizontal scrollbar below the charts to move to earlier or later time periods.

      Scroll vertically to switch between different metric categories and tracks.

      Use the Refresh button to manually request the latest available data from the endpoint.

      Zia Anomaly Detection

      Zia Anomaly Detection helps identify unusual system behavior by continuously analyzing CPU, GPU, and memory activity for each device. These metrics are fed into a machine learning model that learns the normal performance baseline over time.

      When the model detects a significant deviation from this established baseline, it generates an anomaly insight. These insights highlight unexpected spikes, drops, or performance irregularities and are surfaced directly to administrators for faster troubleshooting and root-cause identification.

      In the example below, Zia highlights:

      • CPU usage significantly higher than the expected range.
      • The normal operating range for comparison.
      • An automatically generated insight explaining the deviation.

      These insights are extremely helpful when diagnosing performance abnormalities or understanding sudden changes in device behavior.

      FAQs

      1. How frequently is data updated on the timeline?
      By default, data is updated approximately every 10 minutes, based on the configured endpoint data collection interval.
      2. What information appears in the User Interactions row?
      The User Interactions row displays indicators such as user session activity, presence, and idle/active patterns to help you understand whether usage changes are user-driven.
      3. What does red or highlighted shading indicate?
      Red or highlighted shading marks elevated or unusual activity based on system thresholds or anomaly detection rules.
      Was this document helpful?
      Yes
      No