Timesketch
Timesketch project (code owned by Google) · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An open-source web application for collaborative timeline analysis, built around the idea of a sketch that several analysts annotate, tag, and search at once. It ingests Plaso storage files, CSV, and JSONL. The project states plainly that it is code owned by Google rather than an official Google product.
Who it is for, and when
Timesketch is the answer to the practical problem that a Plaso timeline is too large to work through in a spreadsheet and impossible to share as one. It gives you saved searches, stories that pin an argument to specific events, tagging, and per-analyst attribution of annotations — all of which matter when two examiners on the same matter need to see each other's reasoning. It also supports comparing timelines across multiple hosts in one view.
What it does not cover
Timesketch is a review and collaboration layer only — it parses nothing itself, so the quality of what you see is entirely the quality of the Plaso run or CSV you fed it. It requires a server deployment (Docker or equivalent) rather than running as a desktop application, and it produces no forensic report or exhibit format of its own.
Go to the source
Open at timesketch.org (opens in a new tab)https://timesketch.org/
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Publisher
- Timesketch project (code owned by Google)
- Year
- 2026
- Topics
- timeline, log-analysis, incident-response, reporting, open-source, threat-hunting
- Checked at source
Related entries
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of hits. Hayabusa comes from Yamato Security; Chainsaw is published by WithSecure (the repository now lives under WithSecureOpenSource). Both are actively released.
Sigma
FreeAn open, structured YAML format for describing detections in log data, plus a community rule repository and the pySigma/sigma-cli tooling that converts a rule into the query language of a particular SIEM or log platform. The rule repository is actively released by SigmaHQ.
Two complementary open-source network monitoring engines, both actively released. Zeek (formerly Bro) turns traffic into structured, protocol-aware logs — connections, HTTP requests, DNS queries, TLS handshakes, files seen — using its own scripting language. Suricata, from OISF, is a signature and rule-driven IDS/IPS that also produces rich EVE JSON records and can extract files.
Forensics placed inside the incident response lifecycle: building a response capability, response frameworks, evidence acquisition, volatile memory, disk and network evidence, threat intelligence, malware analysis, threat hunting, and reporting — with this edition reframed around ransomware.
The incident response process as a discipline: preparation, detection and initial response, live collection from Windows and Unix, forensic duplication, network evidence, evidence handling, then analysis of hosts, traffic, attacker tools and routers, and report writing.