Timesketch

Timesketch is an open-source tool for collaborative forensic timeline analysis.

[Timesketch @TimesketchProj]

Introducing the official account for the Timesketch project. Timesketch is a Digital Forensic Timeline Analysis platform that helps #DFIR teams collaborate to resolve complex cases. Follow us to be the first to learn about new features and updates! https://t.co/pgmQo5famN

[Timesketch @TimesketchProj]

New Timesketch release (20230721)

Highlights:
- OpenSearch queries in DFIQ
- Preserve user defined filters
- Support event list sorting
- Rework comments
- Analyzer results in the CLI
- Sketch attributes in the CLI

https://t.co/gQyTB41SV9

#DFIR

[Timesketch @TimesketchProj]

✨ New Timesketch release.

Highlights:
SSH/Windows bruteforce analyzers, DFIQ support, Updated event tags UI, Verbose analyzer output and Restyled timeline chips.

Full changelog: https://t.co/NJoOS1KseC

Thanks to everyone who contributed to this release!

[Timesketch @TimesketchProj]

We have started to automatically tag releases to our official docker images. Use the release version when pulling the image. For example:

https://t.co/PmTa8Y95ya

GitHub releases: https://t.co/qw9CgsEse9

Changelog: https://t.co/Jvpcm6hqgH

[Timesketch @TimesketchProj]

We just merged a small change to the DB schema. If you are running bleeding edge (HEAD) you need to upgrade your database schema. See instructions here: https://t.co/smmP97Xsqt

[Timesketch @TimesketchProj]

New Timesketch release (20230526)
* Important security updates
* Bug fixes
* Dependency updates

https://t.co/Jvpcm6hqgH

[Timesketch @TimesketchProj]

Curious what happened in Timesketch last month? We started publishing Changelogs https://t.co/r8fKXbT6zE let us know if that is useful. #timesketch

[Johan Berggren @jberggren]

For all command line heroes out there. The Timesketch CLI tool is out. Search your forensic timelines from the comfort of your terminal or do timeline analysis from your scripts! https://t.co/15FabScJ3u

[Timesketch @TimesketchProj]

We're looking for feedback 👍👎 on Timesketch ⏳🔍, please take 3min 🕒: https://t.co/N6Un3HZVAO

[Timesketch @TimesketchProj]

For our developing-folks, last week we fixed all the end2end, linter and unit tests, so if you develop and create PRs, check for all the boxes to be green.

[Timesketch @TimesketchProj]

OpenSearch is now the default search backend for new Timesketch installations as well as the development environment. More details here: https://t.co/F8GHET5OSV #OpenSearch #dfir

[Timesketch @TimesketchProj]

Do you remember the time when you wanted to 𝗦𝘁𝗮𝗿 𝗔𝗹𝗹 the events in Timesketch but some were already starred, so you ended up accidentally unstarring them?🧐 No more! 💪🏻

https://t.co/zJNiG7984w

[Timesketch @TimesketchProj]

How can we ingest EVTX files from @virustotal and add magic dust from @sigma_hq on top of it? @alexanderjaeger wrote it down in a blog post.

[Alex @alexanderjaeger]

👁️🕰️Happy to share a new blog post connecting a few pieces: @virustotal + @TimesketchProj + @sigma_hq and DFTimewolf. How to use a new VT feature that allows Enterprise customers to download EVTX for a sandbox execution of submitted samples in DFIR. 🕰️👁️

https://t.co/e3sEvSLspQ

[Timesketch @TimesketchProj]

Σ Timesketch Sigma compose. You can now compose and parse your @sigma_hq rules straight in the UI, copy the search query and test it with your data set. https://t.co/9aK1PvhJmK Please test it and provide feedback. Written by @alexanderjaeger Σ

[Timesketch @TimesketchProj]

Did you know that Timesketch has support for Jupyter and Colab notebooks? This significantly lowers the bar for innovation in forensic timeline research. Get started: https://t.co/EvGtTCEYd7

If you want to use it for analysis, here is an intro:
https://t.co/4IIomyhosr

#dfir

[Timesketch @TimesketchProj]

This is your chance to influence the future of Timesketch and forensic timeline analysis! Take a look at our 2021 user survey here: https://t.co/QNgqGTnU0T

#DFIR

[Alex @alexanderjaeger]

@TimesketchProj now has @sigma_hq mappings for @googlecloud : https://t.co/1F78W95jre go and test it and provide feedback.

[Whitney Champion 🍪🚀 bluesky @whit.zip @shortxstack]

spun up our @velocidex to @TimesketchProj pipeline last night from scratch to test some new timesketch and sigma magic, kicked off some triages in velociraptor

and hour later, sketches automagically appeared 🌈🤓💙

deployment instructions here:
https://t.co/PWNsujALvB

[Timesketch @TimesketchProj]

We made it easier to change the color on your timelines as well as getting back basic information such as analyzer details etc, all while staying in context (no more extra pages to configure). h/t @BartInglot for your work on this!

[Timesketch @TimesketchProj]

We are excited to present the new innovative search history in Timesketch. Implemented as a tree with support for branching, annotations and intuitive navigation means you will never get lost in your searches again! #dfir

[Timesketch @TimesketchProj]

@alexanderjaeger is leading our efforts in all things Sigma! Let him know what you think.

[Alex @alexanderjaeger]

I spend quite some time on this feature and the underlying stack, so I am eager to hear feedback from people. Hope you like it @TimesketchProj @sigma_hq