Timesketch

The code lives in the google organisation on GitHub under the Apache 2.0 licence, and its README says it is not an official Google product, just code that Google owns. The install guide names Docker as the preferred and only tested method, on Ubuntu 22.04 in its example, and starts a stack of the Timesketch web and API server, an importer and analysis worker, OpenSearch for the index, PostgreSQL for the database, Redis for the workers and an Nginx front. A Kubernetes path exists through the OSDFIR Infrastructure project. The unit of work is a sketch, which holds one or more timelines imported from Plaso storage files, CSV or JSON lines. Events are searched with a query language, saved as views, starred, tagged and commented. Analyzers run over a timeline to add tags automatically and Sigma rules can be applied. An interactive notebook is available for deeper work.

The pairing with Plaso is the common path. log2timeline makes the storage file, the examiner uploads it through the web interface or the importer command and can filter events at import. On a large incident each analyst takes a host while the sketch keeps the shared view, and the comments and tags become the record of who concluded what and when. Timesketch extracts nothing itself. It holds what Plaso or another tool gave it, so a weak timeline makes a weak sketch. Because the server holds evidence, it belongs inside a controlled laboratory network with access control, backups and a retention rule, the same as any evidence store.