Getting Started
Working with Data
Tools & Analysis
Keyboard Shortcuts
Canonical Timeline is designed to be operated entirely from the keyboard. Every common action has a shortcut.
Discovering Shortcuts
Command Palette
Press Cmd+K (Mac) or Ctrl+K (Windows/Linux) to open the command palette. Search for any page or action by name:
- Type a page name (e.g., "Investigations") to navigate there.
- Type an action (e.g., "New Event") to trigger it.
- Navigate results with ↓ / ↑.
- Select with Enter.
- Close with Escape.
Cheat Sheet
Press Cmd+Shift+K (or Ctrl+Shift+K) to show a modal overlay of all active shortcuts for the current page.
Shortcut Scopes
Shortcuts operate in three scopes. When the same key is bound at multiple scopes, the more specific scope wins:
- Global — Always active when you're logged in (unless typing in a form field)
- Page — Active only when you're on a specific page
- Component — Active only when a specific component has focus (e.g., a dialog)
Global Shortcuts
Available from anywhere in the application.
| Shortcut | Action |
|---|---|
| Cmd+K | Open command palette |
| Cmd+Shift+K | Show keyboard shortcut cheat sheet |
| / | Focus search input (when no form field is focused) |
| Escape | Close any open panel, dialog, or popover; clear focus from active element |
| Cmd+[ | Navigate back (browser back) |
| Cmd+] | Navigate forward |
| G then T | Go to Workspace (investigation index) |
| G then W | Go to Workspace (investigation index) |
| G then E | Go to Entities |
| G then S | Go to Sources |
| G then I | Go to Investigation (legacy) |
| G then / | Go to Search |
Investigation Lens Shortcuts
Timeline Lens
| Shortcut | Action |
|---|---|
| J or ↓ | Select next event |
| K or ↑ | Select previous event |
| Enter | Expand/collapse selected event |
| [ | Jump to earliest event |
| ] | Jump to latest event |
| N | Create new event |
| Escape | Deselect event / close detail panel |
Workspace Page Shortcuts
| Shortcut | Action |
|---|---|
| N | Open New Investigation dialog (from the investigation index) |
Dialog and Component Shortcuts
| Shortcut | Context | Action |
|---|---|---|
| Escape | Any dialog, popover, or panel | Close |
| Cmd+Enter | Dialog with a submit button | Submit/confirm |
| ↓ / ↑ | Command palette, select menus, dropdowns | Navigate items |
| Enter | Command palette, select menus, dropdowns | Select item |
| Tab | Form fields | Move to next field |
| Shift+Tab | Form fields | Move to previous field |
Focus Management
Roving Tabindex
Lists that contain interactive items (event cards, queue items, search results, sidebar navigation, entity list, investigation list) use a roving tabindex:
- Only one item in each list has
tabindex="0"— it receives keyboard focus. - All other items have
tabindex="-1"— focused only via arrow-key navigation. - Tab moves focus between list containers, not individual items.
- ↓ and ↑ (or J and K) move focus within the focused list.
Focus Restoration
- Closing a dialog, panel, or popover returns focus to the element that triggered it.
- Navigating between pages places focus on the main content landmark.
- A "Skip to main content" link is the first focusable element on every page.
Focus Indicators
A visible focus ring appears on every interactive element when focused via keyboard.
Shortcut Precedence
When shortcuts conflict:
- Component shortcuts override page shortcuts
- Page shortcuts override global shortcuts
- Global shortcuts are the fallback
When Shortcuts Are Suppressed
Shortcuts are ignored when:
- Focus is in a text input, textarea, or contenteditable element
- The command palette (Cmd+K) is open
Progressive Disclosure
Shortcuts are surfaced through three channels:
- Passive — Tooltips on buttons show the shortcut (e.g., "New Event (N)"). Dropdown items show shortcuts right-aligned.
- Active — After several keyboard interactions, a subtle toast appears: "Tip: Press Cmd+Shift+K to see all keyboard shortcuts."
- On-demand — The cheat sheet overlay shows all available shortcuts.
Limitations
The following interactions remain pointer-first:
- Node position dragging in entity graph (pan/zoom/select are keyboard-accessible; arbitrary repositioning uses drag-and-drop)
- Map panning in the Geography lens (zoom controls and marker cycling have keyboard support; free panning is mouse-only)
- File uploads (drag-and-drop is mouse-only; the file input's native keyboard trigger works)