A system includes a client instance hosted by a datacenter, wherein the client instance is generated for one or more client networks. The system performs operations comprising generating a graphical user interface, receiving, via the graphical user interface, an input adjusting the selected time period, and updating the graphical user interface in real time in response to the received input. The graphical user interface includes a timeline that spans an entirety of an incident dataset, a selected time period, wherein the selected time period is a portion of the timeline, a plot of incident data from the incident dataset over the selected time period, and a plurality of calculated metrics based on the incident data during the selected time period.