Files
nexus/sreweekly/articles/19/04-timesketch.html
2026-09-12 17:23:01 +08:00

2470 lines
36 KiB
HTML

<!doctype html>
<html lang="en" class="no-js">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<link rel="next" href="guides/getting-started/">
<link rel="icon" href="assets/images/favicon.png">
<meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.6">
<title>timesketch</title>
<link rel="stylesheet" href="assets/stylesheets/main.484c7ddc.min.css">
<link rel="stylesheet" href="assets/stylesheets/palette.ab4e12ef.min.css">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
<style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
<link rel="stylesheet" href="assets/css/extra.css">
<script>__md_scope=new URL(".",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
</head>
<body dir="ltr" data-md-color-scheme="slate" data-md-color-primary="blue" data-md-color-accent="blue">
<input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
<input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
<label class="md-overlay" for="__drawer"></label>
<div data-md-component="skip">
</div>
<div data-md-component="announce">
</div>
<header class="md-header" data-md-component="header">
<nav class="md-header__inner md-grid" aria-label="Header">
<a href="." title="timesketch" class="md-header__button md-logo" aria-label="timesketch" data-md-component="logo">
<img src="assets/images/timesketch-color.svg" alt="logo">
</a>
<label class="md-header__button md-icon" for="__drawer">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg>
</label>
<div class="md-header__title" data-md-component="header-title">
<div class="md-header__ellipsis">
<div class="md-header__topic">
<span class="md-ellipsis">
timesketch
</span>
</div>
<div class="md-header__topic" data-md-component="header-topic">
<span class="md-ellipsis">
Home
</span>
</div>
</div>
</div>
<div class="md-header__source">
<a href="https://github.com/google/timesketch" title="Go to repository" class="md-source" data-md-component="source">
<div class="md-source__icon md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!--! Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M173.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M252.8 8C114.1 8 8 113.3 8 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C436.2 457.8 504 362.9 504 252 504 113.3 391.5 8 252.8 8M105.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg>
</div>
<div class="md-source__repository">
GitHub
</div>
</a>
</div>
</nav>
</header>
<div class="md-container" data-md-component="container">
<nav class="md-tabs" aria-label="Tabs" data-md-component="tabs">
<div class="md-grid">
<ul class="md-tabs__list">
<li class="md-tabs__item md-tabs__item--active">
<a href="." class="md-tabs__link">
Home
</a>
</li>
<li class="md-tabs__item">
<a href="guides/getting-started/" class="md-tabs__link">
Quickstart
</a>
</li>
<li class="md-tabs__item">
<a href="guides/user/upload-data/" class="md-tabs__link">
User Guide
</a>
</li>
<li class="md-tabs__item">
<a href="guides/admin/install/" class="md-tabs__link">
Admin Guide
</a>
</li>
<li class="md-tabs__item">
<a href="developers/getting-started/" class="md-tabs__link">
Developers
</a>
</li>
<li class="md-tabs__item">
<a href="changelog/" class="md-tabs__link">
Changelog
</a>
</li>
<li class="md-tabs__item">
<a href="community/resources/" class="md-tabs__link">
Community
</a>
</li>
<li class="md-tabs__item">
<a href="https://osdfir.blogspot.com/search/label/timesketch" class="md-tabs__link">
Blog
</a>
</li>
</ul>
</div>
</nav>
<main class="md-main" data-md-component="main">
<div class="md-main__inner md-grid">
<div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" hidden>
<div class="md-sidebar__scrollwrap">
<div class="md-sidebar__inner">
<nav class="md-nav md-nav--primary md-nav--lifted" aria-label="Navigation" data-md-level="0">
<label class="md-nav__title" for="__drawer">
<a href="." title="timesketch" class="md-nav__button md-logo" aria-label="timesketch" data-md-component="logo">
<img src="assets/images/timesketch-color.svg" alt="logo">
</a>
timesketch
</label>
<div class="md-nav__source">
<a href="https://github.com/google/timesketch" title="Go to repository" class="md-source" data-md-component="source">
<div class="md-source__icon md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!--! Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M173.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M252.8 8C114.1 8 8 113.3 8 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C436.2 457.8 504 362.9 504 252 504 113.3 391.5 8 252.8 8M105.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg>
</div>
<div class="md-source__repository">
GitHub
</div>
</a>
</div>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item md-nav__item--active">
<input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
<a href="." class="md-nav__link md-nav__link--active">
<span class="md-ellipsis">
Home
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/getting-started/" class="md-nav__link">
<span class="md-ellipsis">
Quickstart
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3" >
<label class="md-nav__link" for="__nav_3" id="__nav_3_label" tabindex="0">
<span class="md-ellipsis">
User Guide
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_3_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_3">
<span class="md-nav__icon md-icon"></span>
User Guide
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="guides/user/upload-data/" class="md-nav__link">
<span class="md-ellipsis">
Uploading timelines
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/user/basic-concepts/" class="md-nav__link">
<span class="md-ellipsis">
Basic concepts
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/user/sketch-overview/" class="md-nav__link">
<span class="md-ellipsis">
Sketch overview
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/user/search-query-guide/" class="md-nav__link">
<span class="md-ellipsis">
Search query guide
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/user/cli-client/" class="md-nav__link">
<span class="md-ellipsis">
Command line client
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/user/notebook/" class="md-nav__link">
<span class="md-ellipsis">
Interactive notebook
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/user/import-from-json-csv/" class="md-nav__link">
<span class="md-ellipsis">
Import from JSON or CSV
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/user/sigma/" class="md-nav__link">
<span class="md-ellipsis">
Use Sigma
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/user/intelligence/" class="md-nav__link">
<span class="md-ellipsis">
Intelligence
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3_10" >
<label class="md-nav__link" for="__nav_3_10" id="__nav_3_10_label" tabindex="0">
<span class="md-ellipsis">
Analyzers
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_10_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_3_10">
<span class="md-nav__icon md-icon"></span>
Analyzers
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="guides/analyzers/tagger/" class="md-nav__link">
<span class="md-ellipsis">
Tagger analyzer
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/analyzers/feature_extraction/" class="md-nav__link">
<span class="md-ellipsis">
Feature extraction analyzer
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/analyzers/sigma_analyzer/" class="md-nav__link">
<span class="md-ellipsis">
Sigma analyzer
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/analyzers/hashR_lookup/" class="md-nav__link">
<span class="md-ellipsis">
HashR analyzer
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/user/llm-features-user/" class="md-nav__link">
<span class="md-ellipsis">
LLM Features
</span>
</a>
</li>
</ul>
</nav>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4" >
<label class="md-nav__link" for="__nav_4" id="__nav_4_label" tabindex="0">
<span class="md-ellipsis">
Admin Guide
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_4">
<span class="md-nav__icon md-icon"></span>
Admin Guide
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="guides/admin/install/" class="md-nav__link">
<span class="md-ellipsis">
Install
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/admin/upgrade/" class="md-nav__link">
<span class="md-ellipsis">
Upgrade
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/admin/scaling-and-limits/" class="md-nav__link">
<span class="md-ellipsis">
Scaling and limits
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/admin/index-mappings/" class="md-nav__link">
<span class="md-ellipsis">
Index Mappings
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/admin/troubleshooting/" class="md-nav__link">
<span class="md-ellipsis">
Troubleshooting
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/admin/admin-cli/" class="md-nav__link">
<span class="md-ellipsis">
Admin CLI
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/admin/context-links/" class="md-nav__link">
<span class="md-ellipsis">
Context Links
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/admin/llm-features/" class="md-nav__link">
<span class="md-ellipsis">
LLM Features
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/admin/investigation-view-setup/" class="md-nav__link">
<span class="md-ellipsis">
Investigation View
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/admin/load-dfiq/" class="md-nav__link">
<span class="md-ellipsis">
DFIQ Templates
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/admin/performance_monitoring/" class="md-nav__link">
<span class="md-ellipsis">
Performance Monitoring
</span>
</a>
</li>
<li class="md-nav__item">
<a href="guides/admin/OpenTelemetry/" class="md-nav__link">
<span class="md-ellipsis">
OpenTelemetry
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" >
<label class="md-nav__link" for="__nav_5" id="__nav_5_label" tabindex="0">
<span class="md-ellipsis">
Developers
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_5">
<span class="md-nav__icon md-icon"></span>
Developers
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="developers/getting-started/" class="md-nav__link">
<span class="md-ellipsis">
Getting started
</span>
</a>
</li>
<li class="md-nav__item">
<a href="developers/frontend-development/" class="md-nav__link">
<span class="md-ellipsis">
Frontend development
</span>
</a>
</li>
<li class="md-nav__item">
<a href="developers/testing/" class="md-nav__link">
<span class="md-ellipsis">
Writing and running tests
</span>
</a>
</li>
<li class="md-nav__item">
<a href="developers/tilt-development/" class="md-nav__link">
<span class="md-ellipsis">
Development with Tilt
</span>
</a>
</li>
<li class="md-nav__item">
<a href="developers/local_github_actions_with_act/" class="md-nav__link">
<span class="md-ellipsis">
Local GitHub Actions (act)
</span>
</a>
</li>
<li class="md-nav__item">
<a href="developers/notebook/" class="md-nav__link">
<span class="md-ellipsis">
Interactive notebook
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5_7" >
<label class="md-nav__link" for="__nav_5_7" id="__nav_5_7_label" tabindex="0">
<span class="md-ellipsis">
API client
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_5_7_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_5_7">
<span class="md-nav__icon md-icon"></span>
API client
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="developers/api-client/" class="md-nav__link">
<span class="md-ellipsis">
Introduction
</span>
</a>
</li>
<li class="md-nav__item">
<a href="developers/api-upload-data/" class="md-nav__link">
<span class="md-ellipsis">
Upload data via API
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="developers/cli-client/" class="md-nav__link">
<span class="md-ellipsis">
CLI client
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5_9" >
<label class="md-nav__link" for="__nav_5_9" id="__nav_5_9_label" tabindex="0">
<span class="md-ellipsis">
Analyzers
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_5_9_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_5_9">
<span class="md-nav__icon md-icon"></span>
Analyzers
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="developers/analyzer-development/" class="md-nav__link">
<span class="md-ellipsis">
Create an analyzer
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="developers/log-analyzer-agent/" class="md-nav__link">
<span class="md-ellipsis">
AI Log Analyzer Deep Dive
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" >
<label class="md-nav__link" for="__nav_6" id="__nav_6_label" tabindex="0">
<span class="md-ellipsis">
Changelog
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_6">
<span class="md-nav__icon md-icon"></span>
Changelog
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="changelog/" class="md-nav__link">
<span class="md-ellipsis">
Changelog
</span>
</a>
</li>
<li class="md-nav__item">
<a href="changelog/202305-202403/" class="md-nav__link">
<span class="md-ellipsis">
202305 202403
</span>
</a>
</li>
<li class="md-nav__item">
<a href="changelog/2023-05/" class="md-nav__link">
<span class="md-ellipsis">
2023-05
</span>
</a>
</li>
<li class="md-nav__item">
<a href="changelog/2023-03/" class="md-nav__link">
<span class="md-ellipsis">
2023-03
</span>
</a>
</li>
<li class="md-nav__item">
<a href="changelog/2023-02/" class="md-nav__link">
<span class="md-ellipsis">
2023-02
</span>
</a>
</li>
<li class="md-nav__item">
<a href="changelog/2023-01/" class="md-nav__link">
<span class="md-ellipsis">
2023-01
</span>
</a>
</li>
<li class="md-nav__item">
<a href="changelog/2022-12/" class="md-nav__link">
<span class="md-ellipsis">
2022-12
</span>
</a>
</li>
<li class="md-nav__item">
<a href="changelog/2022-10/" class="md-nav__link">
<span class="md-ellipsis">
2022-10
</span>
</a>
</li>
<li class="md-nav__item">
<a href="changelog/2022-09/" class="md-nav__link">
<span class="md-ellipsis">
2022-09
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" >
<label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0">
<span class="md-ellipsis">
Community
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_7">
<span class="md-nav__icon md-icon"></span>
Community
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="community/resources/" class="md-nav__link">
<span class="md-ellipsis">
Resources
</span>
</a>
</li>
<li class="md-nav__item">
<a href="community/roadmap/" class="md-nav__link">
<span class="md-ellipsis">
Roadmap
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7_3" >
<label class="md-nav__link" for="__nav_7_3" id="__nav_7_3_label" tabindex="0">
<span class="md-ellipsis">
Events
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_7_3_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_7_3">
<span class="md-nav__icon md-icon"></span>
Events
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="community/2025-blackhat/" class="md-nav__link">
<span class="md-ellipsis">
Black Hat & defcon 2025
</span>
</a>
</li>
<li class="md-nav__item">
<a href="community/2021-timesketch-summit/" class="md-nav__link">
<span class="md-ellipsis">
2021 Summit
</span>
</a>
</li>
</ul>
</nav>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="https://osdfir.blogspot.com/search/label/timesketch" class="md-nav__link">
<span class="md-ellipsis">
Blog
</span>
</a>
</li>
</ul>
</nav>
</div>
</div>
</div>
<div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" hidden>
<div class="md-sidebar__scrollwrap">
<div class="md-sidebar__inner">
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
</nav>
</div>
</div>
</div>
<div class="md-content" data-md-component="content">
<article class="md-content__inner md-typeset">
<p><center></p>
<h1 style="color:#fff; font-size:3em;font-weight:bold;margin-bottom:-5px;margin-top:50px;">Collaborative timeline analysis</h1>
<h2 style="max-width:70%;margin-bottom:30px;">Timesketch is an open-source tool for collaborative forensic timeline analysis. Using sketches you and your collaborators can organize and work together.</h2>
<p><a class="md-button md-button--primary" href="/guides/getting-started/">Get Started</a></p>
<p><br>
<img style="border-radius:12px;border:1px solid #555" width="1000" alt="Timesketch screenshot" src="https://user-images.githubusercontent.com/316362/207431107-0f5321fa-6170-47bd-9325-7d93d95dd857.png"></p>
<p><a href="https://pypi.python.org/pypi/timesketch"><img alt="Version" src="https://img.shields.io/pypi/v/timesketch?label=timesketch&amp;style=plastic" /></a>
<a href="https://pypi.python.org/pypi/timesketch_api_client"><img alt="Version API" src="https://img.shields.io/pypi/v/timesketch_api_client?label=api_client&amp;style=plastic" /></a>
<a href="https://pypi.python.org/pypi/timesketch_import_client"><img alt="Version Import" src="https://img.shields.io/pypi/v/timesketch_import_client?label=import_client&amp;style=plastic" /></a></p>
<p><img alt="" src="https://github.com/google/timesketch/workflows/e2e-tests/badge.svg" />
<img alt="" src="https://github.com/google/timesketch/workflows/unit-tests/badge.svg" /></p>
<p><small>
<strong>Obligatory Fine Print</strong>: This is not an official Google product (experimental or otherwise), it is just code that happens to be owned by Google.
</small></p>
<p></center></p>
</article>
</div>
<script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script>
</div>
</main>
<footer class="md-footer">
<div class="md-footer-meta md-typeset">
<div class="md-footer-meta__inner md-grid">
<div class="md-copyright">
Made with
<a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
Material for MkDocs
</a>
</div>
</div>
</div>
</footer>
</div>
<div class="md-dialog" data-md-component="dialog">
<div class="md-dialog__inner md-typeset"></div>
</div>
<script id="__config" type="application/json">{"annotate": null, "base": ".", "features": ["navigation.tabs", "header.autohide"], "search": "assets/javascripts/workers/search.2c215733.min.js", "tags": null, "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}, "version": null}</script>
<script src="assets/javascripts/bundle.79ae519e.min.js"></script>
</body>
</html>