diff --git a/monkey/monkey_island/cc/models/zero_trust/aggregate_finding.py b/monkey/monkey_island/cc/models/zero_trust/aggregate_finding.py
index 613b9a4a2..c3ed52649 100644
--- a/monkey/monkey_island/cc/models/zero_trust/aggregate_finding.py
+++ b/monkey/monkey_island/cc/models/zero_trust/aggregate_finding.py
@@ -1,3 +1,4 @@
+from common.data.zero_trust_consts import TEST_MALICIOUS_ACTIVITY_TIMELINE, STATUS_VERIFY
 from monkey_island.cc.models.zero_trust.finding import Finding
 
 
@@ -21,3 +22,11 @@ class AggregateFinding(Finding):
             orig_finding = existing_findings[0]
             orig_finding.add_events(events)
             orig_finding.save()
+
+
+def add_malicious_activity_to_timeline(events):
+    AggregateFinding.create_or_add_to_existing(
+        test=TEST_MALICIOUS_ACTIVITY_TIMELINE,
+        status=STATUS_VERIFY,
+        events=events
+    )
diff --git a/monkey/monkey_island/cc/models/zero_trust/test_aggregate_finding.py b/monkey/monkey_island/cc/models/zero_trust/test_aggregate_finding.py
index 4a67a21b7..c1a94166f 100644
--- a/monkey/monkey_island/cc/models/zero_trust/test_aggregate_finding.py
+++ b/monkey/monkey_island/cc/models/zero_trust/test_aggregate_finding.py
@@ -12,7 +12,7 @@ class TestAggregateFinding(IslandTestCase):
 
         test = TEST_MALICIOUS_ACTIVITY_TIMELINE
         status = STATUS_VERIFY
-        events = [Event.create_event("t", "t", EVENT_TYPE_ISLAND)]
+        events = [Event.create_event("t", "t", EVENT_TYPE_MONKEY_NETWORK)]
         self.assertEquals(len(Finding.objects(test=test, status=status)), 0)
 
         AggregateFinding.create_or_add_to_existing(test, status, events)
@@ -31,7 +31,7 @@ class TestAggregateFinding(IslandTestCase):
 
         test = TEST_MALICIOUS_ACTIVITY_TIMELINE
         status = STATUS_VERIFY
-        event = Event.create_event("t", "t", EVENT_TYPE_ISLAND)
+        event = Event.create_event("t", "t", EVENT_TYPE_MONKEY_NETWORK)
         events = [event]
         self.assertEquals(len(Finding.objects(test=test, status=status)), 0)
 
diff --git a/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/data_endpoints.py b/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/data_endpoints.py
index 7b45b1dee..68a7f713d 100644
--- a/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/data_endpoints.py
+++ b/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/data_endpoints.py
@@ -3,7 +3,7 @@ import json
 from common.data.network_consts import ES_SERVICE
 from common.data.zero_trust_consts import *
 from monkey_island.cc.models import Monkey
-from monkey_island.cc.models.zero_trust.aggregate_finding import AggregateFinding
+from monkey_island.cc.models.zero_trust.aggregate_finding import AggregateFinding, add_malicious_activity_to_timeline
 from monkey_island.cc.models.zero_trust.event import Event
 
 HTTP_SERVERS_SERVICES_NAMES = ['tcp-80']
@@ -67,8 +67,4 @@ def test_open_data_endpoints(telemetry_json):
         events=events
     )
 
-    AggregateFinding.create_or_add_to_existing(
-        test=TEST_MALICIOUS_ACTIVITY_TIMELINE,
-        status=STATUS_VERIFY,
-        events=events
-    )
+    add_malicious_activity_to_timeline(events)
diff --git a/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/machine_exploited.py b/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/machine_exploited.py
index 8198b5a3e..454f3a7fe 100644
--- a/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/machine_exploited.py
+++ b/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/machine_exploited.py
@@ -1,6 +1,6 @@
 from common.data.zero_trust_consts import *
 from monkey_island.cc.models import Monkey
-from monkey_island.cc.models.zero_trust.aggregate_finding import AggregateFinding
+from monkey_island.cc.models.zero_trust.aggregate_finding import AggregateFinding, add_malicious_activity_to_timeline
 from monkey_island.cc.models.zero_trust.event import Event
 
 
@@ -36,8 +36,4 @@ def test_machine_exploited(current_monkey, exploit_successful, exploiter, target
         events=events
     )
 
-    AggregateFinding.create_or_add_to_existing(
-        test=TEST_MALICIOUS_ACTIVITY_TIMELINE,
-        status=STATUS_VERIFY,
-        events=events
-    )
+    add_malicious_activity_to_timeline(events)
diff --git a/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/tunneling.py b/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/tunneling.py
index ba55fc575..ce34c2bb4 100644
--- a/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/tunneling.py
+++ b/monkey/monkey_island/cc/services/telemetry/zero_trust_tests/tunneling.py
@@ -1,7 +1,6 @@
-from common.data.zero_trust_consts import TEST_TUNNELING, STATUS_FAILED, EVENT_TYPE_MONKEY_NETWORK, STATUS_VERIFY, \
-    TEST_MALICIOUS_ACTIVITY_TIMELINE
+from common.data.zero_trust_consts import TEST_TUNNELING, STATUS_FAILED, EVENT_TYPE_MONKEY_NETWORK
 from monkey_island.cc.models import Monkey
-from monkey_island.cc.models.zero_trust.aggregate_finding import AggregateFinding
+from monkey_island.cc.models.zero_trust.aggregate_finding import AggregateFinding, add_malicious_activity_to_timeline
 from monkey_island.cc.models.zero_trust.event import Event
 from monkey_island.cc.services.telemetry.processing.utils import get_tunnel_host_ip_from_proxy_field
 
@@ -18,14 +17,11 @@ def test_tunneling_violation(tunnel_telemetry_json):
             event_type=EVENT_TYPE_MONKEY_NETWORK,
             timestamp=tunnel_telemetry_json['timestamp']
         )]
+
         AggregateFinding.create_or_add_to_existing(
             test=TEST_TUNNELING,
             status=STATUS_FAILED,
             events=tunneling_events
         )
 
-        AggregateFinding.create_or_add_to_existing(
-            test=TEST_MALICIOUS_ACTIVITY_TIMELINE,
-            status=STATUS_VERIFY,
-            events=tunneling_events
-        )
+        add_malicious_activity_to_timeline(tunneling_events)