Building Incident Timeline With Timesketch

Building Incident Timeline with Timesketch

Overview

Timesketch is an open-source collaborative forensic timeline analysis tool developed by Google that enables security teams to visualize and analyze chronological data from multiple sources during incident investigations. It ingests logs and artifacts from endpoints, servers, and cloud services, normalizes them into a unified searchable timeline, and provides powerful analysis capabilities including built-in analyzers, tagging, sketch annotations, and story building. Timesketch integrates with Plaso (log2timeline) for artifact parsing and supports direct CSV/JSONL ingestion for rapid timeline construction during active incidents.

When to Use

Trigger phrases:

• "building incident timeline with timesketch"

• "Build collaborative forensic incident timelines using Timesketch to ingest, norm"

• When deploying or configuring building incident timeline with timesketch capabilities in your environment

• When establishing security controls aligned to compliance requirements

• When building or improving security architecture for this domain

• When conducting security assessments that require this implementation

Prerequisites

• Familiarity with incident response concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Architecture and Components

This section covers architecture and components for building incident timeline with timesketch.

• Ensure all prerequisites are met before proceeding
• Follow the documented workflow steps in sequence
• Record results and any anomalies encountered during this phase

Core Components

• Timesketch Server: Web application with REST API for timeline management
• OpenSearch/Elasticsearch: Backend storage and search engine for timeline events
• PostgreSQL: Metadata storage for sketches, stories, and user data
• Redis: Task queue management for background processing
• Celery Workers: Asynchronous processing of timeline uploads and analyzers

Data Flow

Evidence Sources --> Plaso/log2timeline --> Plaso storage file (.plaso)
     |                                           |
     v                                           v
  CSV/JSONL --> Timesketch Importer --> OpenSearch Index
                                           |
                                           v
                                    Timesketch Web UI
                                    (Search, Analyze, Story)

Deployment

This section covers deployment for building incident timeline with timesketch.

• Ensure all prerequisites are met before proceeding
• Follow the documented workflow steps in sequence
• Record results and any anomalies encountered during this phase

Docker Deployment (Recommended)

# Clone Timesketch repository
git clone https://github.com/google/timesketch.git
cd timesketch

# Run deployment helper script
cd docker
sudo docker compose up -d

# Default access: https://localhost:443
# Admin credentials generated during first run

System Requirements

• Minimum 8 GB RAM (16+ GB recommended for large investigations)
• 4 CPU cores minimum
• SSD storage for OpenSearch indices
• Docker and Docker Compose installed

Data Ingestion Methods

This section covers data ingestion methods for building incident timeline with timesketch.

• Ensure all prerequisites are met before proceeding
• Follow the documented workflow steps in sequence
• Record results and any anomalies encountered during this phase

Method 1: Plaso Integration (Comprehensive)

# Process disk image with log2timeline
log2timeline.py --storage-file evidence.plaso /path/to/disk/image

# Process Windows event logs
log2timeline.py --parsers winevtx --storage-file windows_events.plaso /path/to/evtx/

# Process multiple evidence sources
log2timeline.py --parsers "winevtx,prefetch,amcache,shimcache,userassist" \
  --storage-file full_analysis.plaso /path/to/mounted/image/

# Import Plaso file into Timesketch
timesketch_importer -s "Case-2025-001" -t "Endpoint-WKS01" evidence.plaso

Method 2: CSV Import (Quick Ingestion)

message,datetime,timestamp_desc,source,hostname
"User login detected","2025-01-15T08:30:00Z","Event Recorded","Security Log","DC01"
"PowerShell execution","2025-01-15T08:31:15Z","Event Recorded","PowerShell","WKS042"

# Import CSV directly
timesketch_importer -s "Case-2025-001" -t "Quick-Triage" events.csv

Method 3: JSONL Import (Structured Data)

{"message": "Suspicious logon from 10.1.2.3", "datetime": "2025-01-15T08:30:00Z", "timestamp_desc": "Event Recorded", "source_short": "Security", "hostname": "DC01"}

Method 4: Sigma Rule Integration

# Upload Sigma rules for automated detection
timesketch_importer --sigma-rules /path/to/sigma/rules/

Analysis Workflow

1. Prepare the environment — ensure write-blocker is connected and test workstation is ready
2. Document the source — record device serial, model, and pre-acquisition hash
3. Acquire the image — use the appropriate tool with hash verification enabled
4. Verify integrity — compare source and image hashes; document any discrepancies
5. Analyze and report — perform the analysis and document findings with chain of custody

Step 1: Create Investigation Sketch

1. Log into Timesketch web interface
2. Create new sketch (investigation case)
3. Add relevant timelines to the sketch
4. Set sketch description and tags

Step 2: Run Built-in Analyzers

Timesketch includes analyzers that automatically identify:

• Browser Search Analyzer: Extracts search queries from browser history
• Chain of Events Analyzer: Links related events (download -> execute)
• Domain Analyzer: Extracts and categorizes domain names
• Feature Extraction Analyzer: Identifies IPs, URLs, hashes
• Geo Location Analyzer: Maps events to geographic locations
• Similarity Scorer: Finds similar events across timelines
• Sigma Analyzer: Matches events against Sigma detection rules
• Account Finder: Identifies user account activity patterns
• Tagger: Applies labels based on predefined rules

Step 3: Search and Filter

# Search examples in Timesketch query language

# Find all events related to specific user
source_short:Security AND message:"john.admin"

# Find PowerShell execution events
data_type:"windows:evtx:record" AND event_identifier:4104

# Find lateral movement indicators
source_short:Security AND event_identifier:4624 AND xml_string:"LogonType\">3"

# Find events within specific time range
datetime:[2025-01-15T00:00:00 TO 2025-01-15T23:59:59]

# Find file creation events
data_type:"fs:stat" AND timestamp_desc:"Creation Time"

# Search with tags
tag:"suspicious" OR tag:"lateral_movement"

Step 4: Build Investigation Story

1. Create new story within the sketch
2. Add search views that support each finding
3. Annotate key events with investigator notes
4. Link events to MITRE ATT&CK techniques
5. Document the attack narrative chronologically
6. Export story for inclusion in incident report

Advanced Features

This section covers advanced features for building incident timeline with timesketch.

• Ensure all prerequisites are met before proceeding
• Follow the documented workflow steps in sequence
• Record results and any anomalies encountered during this phase

Collaborative Investigation

• Multiple analysts work on the same sketch simultaneously
• Comments and annotations persist on events
• Saved searches shared across the team
• Investigation stories document findings in context

API Automation

from timesketch_api_client import config
from timesketch_api_client import client as ts_client

# Connect to Timesketch
ts = ts_client.TimesketchApi(
    host_uri="https://timesketch.local",
    username="analyst",
    password="password"
)

# Get sketch
sketch = ts.get_sketch(1)

# Search events
search = sketch.explore(
    query_string='event_identifier:4624 AND LogonType:3',
    return_fields='datetime,message,hostname,source_short'
)

# Add tags to events
for event in search.get('objects', []):
    sketch.tag_event(event['_id'], ['lateral_movement'])

Integration with Dissect

# Use Dissect for faster artifact parsing (alternative to Plaso)
target-query -f timesketch://timesketch.local/case-001 \
  targets/hostname/ -q "windows.evtx" --limit 0

Key Data Sources for Timeline Building

MITRE ATT&CK Mapping

When NOT to Use

• You need to test what you built (use performing-* skills)
• Task is about configuring existing systems (use configuring-* skills)
• You need to analyze the output (use analyzing-* skills)
• Task is about implementing vendor solutions (use implementing-* skills)
• You don't have infrastructure access
• Task requires compliance validation (use auditing-* skills)

Red Flags

• Performing actions without explicit written authorization from the asset owner
• Testing against production systems without a defined scope and rules of engagement
• Failing to use write-blockers when acquiring forensic evidence
• Not verifying hash integrity before and after imaging
• Modifying original evidence during analysis

Verification

• All steps executed successfully against a test environment before production use
• Output documented with screenshots or logs demonstrating expected behavior
• Hash values computed and verified match between source and image
• Chain of custody log complete with timestamps and examiner names
• Analysis tools and versions documented for reproducibility

References

• Timesketch Official Documentation
• Timesketch GitHub Repository
• CISA Timesketch Resource
• Hunt and Hackett: Scalable Forensics with Dissect and Timesketch
• Plaso (log2timeline) Documentation

Process

1. Analyze the task requirements
2. Apply domain expertise
3. Verify output quality

Anti-Rationalization Table