Threat Timeline

The Threat Timeline panel (internal id threat-timeline) turns the threat-level metadata already attached to intelligence insights into a short-horizon distribution view. It helps analysts see whether the current environment is worsening, easing, or simply noisy instead of reading threat labels one item at a time.

What the panel shows

A seven-day stacked timeline grouped by the canonical threat levels: critical, high, medium, low, and info.

• Distribution chart - one stacked bar per UTC day for the last seven days, including today.
• Trend summary - critical/high counts, active high-severity days, and a simple recent-vs-earlier trend label.
• Grouped alerts - current items sorted by threat severity first, then recency, with the top items shown under each severity lane.
• Source provenance - each item keeps its source label and source-count badge when available. Fallback clustered stories can surface Keyword fallback when their threat label came from the local classifier.
• Degraded state - if timestamped threat-level data is unavailable, the panel shows a waiting/degraded message rather than inventing a trend.

Panel id is threat-timeline; canonical component is src/components/ThreatTimelinePanel.ts. The bucketing and fallback normalization live in src/components/threat-timeline-utils.ts.

How you reach it

• Cmd+K: type threat timeline, threat levels, or threat trend.
• Availability by variant: registered and enabled by default in the full/geopolitical variant only. It is not present in the tech, finance, commodity, or happy variants. Source: 'threat-timeline' in FULL_PANELS of src/config/panels.ts.

Data sources

The primary source is the existing intelligence insights snapshot read through @/services/insights-loader:

• Bootstrap key: insights from /api/bootstrap?keys=insights
• Redis source: intelligence:insights:v1
• Item fields consumed: topStories[].threatLevel, topStories[].pubDate, title, source, link, and source count

When the server insights snapshot is unavailable, the panel can fall back to the current clustered news events already held by the dashboard data loader. That fallback is degraded by design and is used only to preserve useful local context until the insights snapshot is available again.

Refresh cadence

The underlying insights seed is produced by the intelligence cron. The panel reads the cached bootstrap snapshot during dashboard data loading and refreshes alongside the existing AI Insights panel rather than adding a separate upstream pipeline.

Tier & gating

Threat Timeline is free on the web. It has no premium flag in the full-variant panel registration.

API reference

• AI intelligence - overview of threat classification and AI-assisted intelligence surfaces.
• API platform - bootstrap hydration, including key-filtered reads.