# Resource Timeline

Source: https://docs.ops0.com/docs/discovery/timeline

The Resource Timeline shows the complete history of a specific cloud resource across all discovery sessions. Use it to track configuration changes, cost evolution, security changes, and relationship changes over time — without needing to manually compare sessions.

---

## Accessing the Timeline

Navigate to **Discovery → Timeline** from the sidebar.

### Search for a Resource

1. Enter a resource name, ID, or type in the search box
2. Results show matching resources from all sessions:

```
Results for "web-server"

  i-0abc123def456   EC2 Instance   us-east-1   First seen: Jan 15, 2024
  i-0def789abc123   EC2 Instance   us-west-2   First seen: Feb 03, 2024
```

3. Click a resource to open its timeline

---

## Timeline View

The timeline for a resource shows all changes detected across sessions, ordered from newest to oldest.

### Resource Header

At the top of the timeline:

| Field | Description |
|-------|-------------|
| **Name** | Resource name or ID |
| **Type** | Resource type (e.g. `aws_instance`) |
| **Provider** | Cloud provider and region |
| **First seen** | Date of the first discovery session that found this resource |
| **Last seen** | Most recent session |
| **Total sessions** | Number of sessions this resource appeared in |
| **Total changes** | Number of times the configuration changed |

### Event Types

| Event | Icon | Description |
|-------|------|-------------|
| **Created** | ＋ | Resource first appeared in a session |
| **Modified** | ✎ | One or more configuration fields changed |
| **Deleted** | − | Resource no longer appeared in a session |
| **Reappeared** | ↺ | Resource returned after being absent |

### Change Details

For **Modified** events, the timeline shows exactly what changed:

```
Modified — March 15, 2024 at 14:32 UTC
Session: weekly-scan-2024-03-15

Changed fields:
  instance_type:     t3.medium  →  t3.large
  tags.Environment:  staging    →  production
```

---

## Statistics Panel

The statistics panel on the right summarises change activity:

| Metric | Description |
|--------|-------------|
| **Security changes** | Number of sessions where security-related fields changed |
| **Config changes** | Number of sessions where non-security configuration changed |
| **Tag changes** | Number of sessions where tags changed |
| **Cost changes** | Number of sessions where estimated cost changed |
| **Deletions** | Number of times the resource disappeared from scans |

---

## Filtering the Timeline

| Filter | Options |
|--------|---------|
| **Event type** | Created, Modified, Deleted, Reappeared |
| **Severity** | Critical, High, Medium, Low, Info |
| **Date range** | Since / Until (ISO date or relative: `7d`, `30d`) |
| **Snapshots** | Toggle to include full resource snapshots alongside diffs |

---

## Most Changed Resources

The **Most Changed** tab lists the resources with the highest number of configuration changes across all sessions:

```
Most Changed Resources (last 30 days)

1. sg-0abc123   Security Group   us-east-1   47 changes
2. i-0def456   EC2 Instance     us-east-1   23 changes
3. rds-prod    RDS Instance     us-west-2   18 changes
```

High-change-frequency resources often indicate:
- Frequent manual changes (potential ClickOps)
- Autoscaling activity (expected for ASG-managed instances)
- Active configuration management (verify changes are intentional)

---

## Use Cases

| Use Case | How to Use |
|----------|-----------|
| **Investigate an incident** | Find the resource involved, filter timeline to the incident window, see what changed |
| **Audit a change** | Search by resource ID, find the session where the change was detected |
| **Track ClickOps** | Use Most Changed to find frequently modified resources that aren't managed by IaC |
| **Cost investigation** | Filter by cost changes to see when and why a resource's cost increased |
| **Compliance review** | Filter by security changes to audit security group or IAM modifications |

---

## Related

- [Session Comparison](https://docs.ops0.com/docs/discovery/session-comparison): Compare two full sessions to see all changes at once

- [Drift Detection](https://docs.ops0.com/docs/discovery/drift-detection): Detect infrastructure drift between scans

- [Scheduling](https://docs.ops0.com/docs/discovery/scheduling): Automate recurring scans to keep the timeline current