Timesketch
Timesketch is an open-source collaborative timeline analysis platform built at Google. It ingests Plaso .plaso files or CSV/JSON logs, provides a searchable Elasticsearch-backed timeline, supports tagging and annotations, and enables multiple analysts to work the same investigation simultaneously.
Your Plaso processing of four compromised hosts produced a combined timeline with 1.4 million events. Analyzing this in a spreadsheet is impossible. In Timesketch, you search for the C2 IP, find 847 beacon events, tag them all "C2_beacon" in one action, then search for file system events in the same hour window, tag those "staging", and progressively build the full attack narrative across all four hosts simultaneously. A second analyst reviews your tagged events and adds annotations. The final annotated timeline becomes the backbone of your incident report.
Before Timesketch, large-incident timeline analysis was a single-analyst spreadsheet problem — one person filtered a CSV export and everyone else waited for their findings. With Timesketch, every analyst on the team works the same timeline simultaneously. One analyst tags all the C2 beacon events; another tags the file staging activity; a third works the credential-theft timeline. Tags and annotations are visible to everyone in real time. The "Add to story" feature lets you build the investigation narrative inside the same tool where you're doing analysis — the story IS the timeline, with supporting evidence attached. For a multi-host incident spanning millions of events, this collaborative workflow cuts investigation time from days to hours.
Timesketch Setup and Data Import
# Install Timesketch via Docker (recommended for single-host lab)
curl -s https://raw.githubusercontent.com/google/timesketch/master/docker/release/docker-compose.yml \
-o docker-compose.yml
docker-compose up -d
# Create a sketch (investigation project) and upload timeline
# Via CLI (tsctl):
tsctl add_user --username analyst1 --password changeme
# Import Plaso file to Timesketch
# Via Python CLI:
pip install timesketch-import-client
timesketch_importer \
--host http://localhost \
--username analyst1 \
--password changeme \
--sketch_id 1 \
--timeline_name "FINANCE-SRV01-Sep17" \
/cases/CASE-2026-009/plaso/FINANCE-SRV01.plaso
# Import CSV timeline (from psort or manual collection)
timesketch_importer \
--host http://localhost \
--username analyst1 \
--password changeme \
--sketch_id 1 \
--timeline_name "FINANCE-SRV01-netflow" \
/cases/CASE-2026-009/netflow/flows-export.csv
# CSV must have: message, datetime, timestamp_desc columnsSearch and Filter Workflow
Timesketch Investigation Workflow
═══════════════════════════════════════════════════════════════════
Search syntax (Elasticsearch/Kibana-style):
Simple keyword:
185.220.101.47 → all events mentioning this IP
"IEX" OR "Invoke-Expression" → PowerShell execution indicators
"mimikatz" OR "sekurlsa" → credential tool indicators
Field-specific:
source_long: "Microsoft-Windows-Security-Auditing"
parser: "winevtx" AND message: "4624"
timestamp_desc: "Creation Time"
Time range (in addition to the timeline graph selector):
date > "2026-09-17T02:00" AND date < "2026-09-17T06:00"
Workflow for large timelines:
1. Start with keyword search for known IOCs (C2 IP, domain, tool name)
2. Use time range selector to zoom into event clusters
3. Tag matching events (assign label like "C2_activity")
4. Search for artifact types in same time window
5. Progressive refinement: each tagged cluster reveals next pivot
6. Use "Add to story" to build investigation narrative in-tool
Pro tip: Save searches as "Saved searches" for reuse across cases.
Timesketch ML features: clustering, UEBA anomaly detection (v3+)
Timesketch's three core operations — search, tag, and story — are meant to be used in a deliberate progression, not interchangeably. Search finds candidate events: you're generating hypotheses. Tag confirms and marks those events: you're building evidentiary anchors. Story links tagged events into a causal narrative: you're making the case. The mistake is trying to write the story before finishing the tagging, or tagging everything before forming any hypothesis. Work in passes: first search for IOCs and tag them, then search the time windows around tagged events for adjacent artifacts, tag those, and only then write the story connecting the tags. Your story entries should reference specific tagged events, not vague time ranges — that's what makes Timesketch output court-quality rather than just analyst notes.
Running Sigma Rules in Timesketch
# Timesketch supports running Sigma rules against uploaded timelines
# Convert Sigma rules to Timesketch queries using sigma-cli
pip install sigma-cli
pip install pySigma-backend-opensearch
# Convert a Sigma rule to Timesketch/Elasticsearch query
sigma convert -t opensearch \
/sigma/rules/windows/process_creation/proc_creation_win_susp_powershell_encoded_cmd.yml
# The output is an ES query you can paste directly into Timesketch search
# Or automate via Timesketch API:
python3 << 'EOF'
from timesketch_api_client import client as ts_client
ts = ts_client.TimesketchApi('http://localhost', 'analyst1', 'changeme')
sketch = ts.get_sketch(1)
# Run a query and get results
results = sketch.explore(
query_string='message: "-enc " AND parser: "winevtx"',
return_fields='datetime,message,source_long'
)
for event in results.get('objects', []):
print(f"{event['_source']['datetime']} {event['_source']['message'][:100]}")
EOFQ & A
Q: Timesketch has 1.4 million events. Where do you start to find attacker activity without knowing any IOCs in advance?
Start with statistical anomalies rather than keyword searches: (1) Timeline density view: the histogram at the top of Timesketch shows event density over time. Spikes (far above baseline) during off-hours (e.g., 02:00–06:00 UTC on a weekday) are your first pivot point. Click the spike to zoom in. (2) Filter to high-signal artifact types first: search for parser: "winevtx" AND source_long: "Microsoft-Windows-PowerShell-Operational" — Script Block and Module log events are almost always attacker-relevant. (3) Executable file creation: search for timestamp_desc: "Creation Time" AND message: ".exe" during the anomalous time window — new executables at 03:00 UTC are suspicious. (4) Outbound network metadata: if NetFlow CSV is uploaded, filter to large transfers. (5) Event ID 4648 (Explicit Credential Use): almost always attacker-related when it appears from a workstation to other systems. These five starting points — off-hours spike → PowerShell logs → new executables → large transfers → explicit credential use — usually reveal the initial foothold and attack chain within 30-60 minutes of analysis.