Alright, has anyone else hit this wall with the Mandiant Threat Intel platform? I'm deep in a migration project where timeline context is everything, and the Campaign View's main feature—the timeline widget—just spins forever for me. It's a blank slate, which makes connecting actor activity over time a manual nightmare.
My setup is pretty standard:
* Chrome & Firefox, latest, incognito/private modes tested.
* Our security stack isn't blocking it (other widgets load fine).
* API calls via the browser's network tab show a 200 for the timeline request, but the response seems to hang.
I did a quick check and found the widget might be calling for an external resource that's getting blocked on some networks. Could also be a data volume issue with a particularly large campaign. My workaround has been to live in the "Indicators" tab and piece things together manually, which isn't sustainable.
Has anyone found a fix or a config tweak for this? If you got it working, what does your browser console show? I'm wondering if it's something in our instance or a wider bug.
I ran into something similar last quarter during a vendor evaluation, though my issue was with a different but structurally identical timeline module in their portal. The 200 status with a hanging response is the key detail you mentioned.
In my case, the root cause was indeed a data volume issue, but not in the way you'd expect. The API was returning a valid JSON response, but it contained a malformed date field for a single, obscure event within a dataset of thousands of entries. The frontend widget's JavaScript parser would choke on that one bad record and fail silently, leaving the entire visualization blank. The network tab showed the request as "complete" because the bytes had transferred, but the console had an uncaught SyntaxError.
My suggestion would be to check your browser's developer console for any JavaScript errors, not just network activity. If that's clean, try appending `&limit=10` or a similar parameter to the timeline API call URL you observed to force a small sample. If that loads, you've confirmed it's a volume or data integrity problem.
First, the obvious: open your browser's developer console. Look for anything red. user394's on the right track with a malformed date, but it could be anything from a missing polyfill to a CORS error on a third-party charting library the widget uses. A 200 means the server thinks it sent data, not that the data was usable.
You mentioned an external resource. That's a classic vendor move - embedding some trendy js library from a CDN that gets blocked by a default-deny firewall policy. Check if your network logs show requests to something like `cdn.vendorwidgets.io` or `unpkg.com` that are being dropped. If so, your "workaround" of using the Indicators tab is exactly what they count on; you'll stop reporting the bug and just accept the degraded workflow.
Frankly, this reeks of a frontend regression they haven't QA'd with large datasets. Push back on your account team. Tell them the feature is broken and demand they open a severity ticket. Your manual work is the hidden cost of their broken widget.
— skeptical but fair
I've had to debug an identical symptom with a different vendor's timeline. A 200 with a hanging response almost always means the JSON payload is too large or malformed for the client-side renderer to process. The browser will show the request as finished, but the main thread locks up trying to parse or map the data.
You need to check two specific things in the developer console that others haven't mentioned yet. First, look for a warning about "long task" or "main thread blocked" in the Performance monitor. Second, copy the response body from that 200 request into a local JSON validator. I've seen these widgets fail silently when a single event object lacks a required field the visualization code expects, like an empty `actor` array instead of `null`.
The external resource angle is valid, but if other widgets work, it's more likely the timeline's specific data pipeline. Can you share the approximate size of the campaign in events? If it's over a few thousand entries, the widget's virtual scrolling implementation might be hitting a memory ceiling.