From log export to a traceable timeline.

Use the event explorer when you have exported records and need to inspect their order or follow one entity without uploading them.

Start with the exported records.

Microsoft's investigation workflow includes chronological event review, filters and correlation. Its hunting results support export and entity drilldown. CaseNote offers a small offline view of records you already have; it does not reproduce Defender's telemetry or detection engine. Device investigation; hunting query results.

1. Export a narrow query window from your approved source. Keep the original export and query elsewhere.
2. Choose CSV with unique headers, a JSON array of objects, or JSONL with one object per line. Limit the file to 2 MiB and 10,000 events.
3. Select the timestamp column and an account, host or other entity column. Inspect an original record to verify the mapping.
4. Select an exact entity value or use literal search. Apply UTC boundaries if needed. Pin the records relevant to your question.
5. Review the unredacted records, then export the filtered view or pinned selection as JSON.

Choose event time deliberately.

Azure Monitor distinguishes TimeGenerated, when the source created the record, from _TimeReceived, when ingestion received it. CaseNote does not infer which represents the event you are investigating. Microsoft standard columns.

Supported timestamps include 2026-10-31T09:00:00Z and 2026-10-31T10:00:00.123+01:00. Seconds are required; fractions allow one to three digits. Numeric epochs, microseconds, local times without a timezone and impossible dates stay in the unknown-time group. No rounding, timezone guessing or clock correction occurs. Time filters exclude unknown times. Equal timestamps preserve source-row order.

Keep source references intact.

The displayed row number is the 1-based data record, excluding CSV headers. A quoted multiline CSV field is one record, even when it spans physical lines. Quoted commas, escaped quotes and embedded newlines follow the format documented in RFC 4180. Empty records are ignored.

JSON exports include the original parsed records, filename, SHA-256 of the UTF-8 text as read by the browser, timestamp mapping and filters. This is a text digest, not a forensic hash of original file bytes. JSON numeric identifiers beyond the safe integer range must be quoted. Duplicate keys and nesting deeper than 40 levels are rejected.

What the view cannot tell you.

Matching accounts or nearby times do not establish causation. Missing events may reflect retention, query filters, collection gaps or clock problems. Pins are a selection, not a detection. No IP reputation lookup, command execution, AI inference or upload occurs. Exported JSON can contain sensitive data; no CSV is generated or spreadsheet formula executed.

Need an escalation narrative after reviewing records? Open the handoff worksheet and use source-row references in your observations.