A method and apparatus including the steps of a building information model (BIM) of a security system providing a three-dimensional view of a secured area of the security system including the physical location of any sensors of the security system, an input device of the security system receiving from a user a starting time and ending time of a time interval of interest and a processor of the security system displaying the three-dimensional view of the secured area including a time scale showing the starting time on one end of the time scale and the ending time at an opposing end of the time scale and a respective popup of details for each corresponding sensor of at least some sensors of the security system activated during the time interval of interest, each respective popup graphically connected to the physical location of the corresponding sensor within the three dimensional view.