Getting Started
Working with Data
Tools & Analysis
Keyboard Shortcuts
Canonical Timeline is designed to be operated entirely from the keyboard. Every common action has a shortcut. This page is your complete reference.
Discovering Shortcuts
Command Palette
Press Cmd+K (Mac) or Ctrl+K (Windows/Linux) to open the command palette. Search for any page or action by name:
- Type a page name (e.g., "Timelines") to navigate there.
- Type an action (e.g., "New Event") to trigger it.
- Navigate results with ↓ / ↑.
- Select with Enter.
- Close with Escape.
Cheat Sheet
Press Cmd+Shift+K (or Ctrl+Shift+K) to show a modal overlay of all active shortcuts for the current page, grouped by category.
Shortcut Scopes
Shortcuts operate in three scopes. When the same key is bound at multiple scopes, the more specific scope wins:
- Global — Always active when you're logged in (unless typing in a form field)
- Page — Active only when you're on a specific page
- Component — Active only when a specific component has focus (e.g., a dialog)
Global Shortcuts
Available from anywhere in the application.
| Shortcut | Action |
|---|---|
| Cmd+K | Open command palette |
| Cmd+Shift+K | Show keyboard shortcut cheat sheet |
| / | Focus search input (when no form field is focused) |
| Escape | Close any open panel, dialog, or popover; clear focus from active element |
| Cmd+[ | Navigate back (browser back) |
| Cmd+] | Navigate forward |
| G then T | Go to Timelines |
| G then E | Go to Entities |
| G then S | Go to Sources |
| G then I | Go to Investigation |
| G then W | Go to Workspace |
| G then / | Go to Search |
Timeline Detail Page Shortcuts
| Shortcut | Action |
|---|---|
| J or ↓ | Select next event |
| K or ↑ | Select previous event |
| Enter | Expand/collapse selected event |
| [ | Jump to earliest event |
| ] | Jump to latest event |
| N | Create new event |
| Escape | Deselect event / close detail panel |
Investigation Page Shortcuts
All Tabs
| Shortcut | Action |
|---|---|
| 1 | Switch to Timeline Comparison |
| 2 | Switch to Timeline Comparison Map |
Timeline Comparison
| Shortcut | Action |
|---|---|
| J / K | Next/previous event in focused column |
| H / L | Move focus between columns (left/right) |
| Shift+H / L | Reorder focused column (move left/right) |
| Enter | Expand focused event |
Timeline Map
| Shortcut | Action |
|---|---|
| + / - | Zoom in/out |
| Arrow keys | Pan map |
| F | Fit all markers in bounds |
| Tab / Shift+Tab | Cycle between event markers |
| Enter | Open marker's event in detail panel |
Workspace Page Shortcuts
| Shortcut | Action |
|---|---|
| 1 | Switch to Review Queue |
| 2 | Switch to Reconciliation |
| 3 | Switch to Activity Feed |
Dialog and Component Shortcuts
| Shortcut | Context | Action |
|---|---|---|
| Escape | Any dialog, popover, or panel | Close |
| Cmd+Enter | Dialog with a submit button | Submit/confirm |
| ↓ / ↑ | Command palette, select menus, dropdowns | Navigate items |
| Enter | Command palette, select menus, dropdowns | Select item |
| Tab | Form fields | Move to next field |
| Shift+Tab | Form fields | Move to previous field |
Focus Management
Roving Tabindex
Lists that contain interactive items (event cards, queue items, search results, sidebar navigation, entity list) use a roving tabindex. This means:
- Only one item in each list has
tabindex="0"at any time — it receives keyboard focus. - All other items have
tabindex="-1"— they receive focus only via arrow-key navigation. - Tab moves focus between list containers, not between individual items.
- ↓ and ↑ (or J and K) move focus between items within the focused list.
Focus Restoration
- Closing a dialog, panel, or popover returns focus to the element that triggered it.
- Navigating between pages places focus on the main content landmark.
- A "Skip to main content" link is the first focusable element on every page (visible on Tab).
Focus Indicators
A visible focus ring appears on every interactive element when focused via keyboard. No focus styles are suppressed without a replacement visual indicator.
Shortcut Precedence
When shortcuts conflict, the more specific scope wins:
- Component shortcuts override page shortcuts (e.g., Escape inside a dialog closes the dialog first, before any page-level behavior)
- Page shortcuts override global shortcuts (e.g., J on the timeline page navigates events, overriding any global J binding)
- Global shortcuts are the fallback
When Shortcuts Are Suppressed
Shortcuts are ignored when:
- Focus is in a text input, textarea, or contenteditable element
- The command palette (Cmd+K) is open
This prevents shortcuts from interfering with normal typing.
Progressive Disclosure
Shortcuts are surfaced through three channels in escalating order:
- Passive — Tooltips on buttons show the shortcut in parentheses (e.g., "New Event (N)"). Dropdown menu items show shortcuts right-aligned.
- Active — After several keyboard interactions in a session, a subtle toast appears: "Tip: Press Cmd+Shift+K to see all keyboard shortcuts."
- On-demand — The cheat sheet overlay (Cmd+Shift+K) shows all available shortcuts.
Limitations
The following interactions remain pointer-first and do not have keyboard shortcuts:
- Drag-and-drop column reorder in timeline comparison (keyboard alternatives via Shift+H/L are provided, but actual drag remains mouse-only)
- Node position dragging in entity graph (pan/zoom/select are keyboard-accessible; arbitrary repositioning remains mouse-only)
- File uploads (drag-and-drop remains mouse-only; the file input's native keyboard trigger works)