Timesketch

No entries match these filters. Clear filters

1. 20261014 Oct 14, 2026 · issue 109

   Timesketch 20261014 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. group/role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., Sec-Gemini BYOT log analysis, and an OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. index prefix config option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20261014 https://github.com/google/timesketch.git
   # already have the repo? check out this version:
   $ git checkout 20261014

   • Adds OPENSEARCH_INDEX_PREFIX config key to namespace OpenSearch indices for new Timesketch installations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Implements Sec-Gemini Bring-Your-Own-Token (BYOT) log analysis support, enabling AI-assisted timeline analysis via the SecGemini LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider.
   • Adds OIDC Group/Role-Based Access Control with membership sync, enabling identity-provider groups to drive Timesketch sketch permissions.
   • Transitions Gunicorn WSGIWSGIA Python standard (PEP 3333) defining how a web server passes HTTP requests to a Python application, letting frameworks and servers interoperate without custom glue code. workers to the threaded gthread model, improving concurrency for multi-user deployments.
   • Updates the SecGemini provider to parse attached JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. findings for richer LLM-driven analysis output.
   • Adds OPENSEARCH_INDEX_PREFIX config key to namespace OpenSearch indices for new Timesketch installations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Implements Sec-Gemini Bring-Your-Own-Token (BYOT) log analysis support, enabling AI-assisted timeline analysis via the SecGemini LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider.
   • Adds OIDC Group/Role-Based Access Control with membership sync, enabling identity-provider groups to drive Timesketch sketch permissions.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Timesketch now enforces a minimum Plaso version of 20260720; worker deployments must upgrade plaso-tools to at least 20260720 before upgrading Timesketch.
   • !.plaso files created with Plaso versions earlier than 20260720 will fail to import; export them to JSONL with a matching older psort and upload the .jsonl file instead.
   • !Plaso 20260720 renamed the computer_name field to hostname and body to message_body; custom saved views or queries targeting those fields may need updating for new timelines.
2. 20260630 Jun 30, 2026 · issue 014

   Timesketch 20260630 adds SecGemini analyzer results to report summaries and enriches OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. spans with search metadata.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20260630 https://github.com/google/timesketch.git
   # already have the repo? check out this version:
   $ git checkout 20260630

   • Adds SecGemini analyzer report output to the sketch report summary, surfacing AI-driven analysis alongside other analyzer results.
   • Updates SecGemini provider to align with the sec-gemini v3 SDK APIs, enabling compatibility with the latest SecGemini capabilities.
   • Adds search metadata attributes to OpenTelemetry spans, enabling deeper observability into search query telemetry.

   3 details in Everything

3. 20260617 Jun 17, 2026 · release notes

   Timesketch 20260617 enforces cross-sketch ownership on event fact conclusions via the API.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20260617 https://github.com/google/timesketch.git
   # already have the repo? check out this version:
   $ git checkout 20260617

   └──▷ BREAKING ON UPGRADE

   • !OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. users must upgrade to a minimum of version 3.7.0 before upgrading to this Timesketch release when running OpenSearch >= 3.x.
4. 20260617 Jun 17, 2026 · issue 014

   Timesketch 20260617 enforces cross-sketch ownership on event fact conclusions via the API.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20260617 https://github.com/google/timesketch.git
   # already have the repo? check out this version:
   $ git checkout 20260617

   └──▷ BREAKING ON UPGRADE

   • !OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. users must upgrade to at least version 3.7.0 before upgrading to this Timesketch release if running OpenSearch >= 3.x
5. 20260611 Jun 11, 2026 · release notes

   Timesketch 20260611 adds native wildcard field search, OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing, and upgrades the base image to Ubuntu 26.04.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20260611 https://github.com/google/timesketch.git
   # already have the repo? check out this version:
   $ git checkout 20260611

   • Supports mapping text fields as wildcard field types in OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions., enabling native substring searches across log data.
   • Introduces OpenTelemetry integration for tracing Timesketch web backend, SQLAlchemy, and OpenSearch interactions — enabling performance monitoring and health tracking.
   • Upgrades the base Docker image to Ubuntu 26.04 with major dependency updates.
   • Improves the SearchDropdown UI component with enhancements for usability.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The minimum compatible OpenSearch version is now 2.19.5 to support native wildcard field mappings; deployments running older OpenSearch versions must upgrade.
   • !The base Docker image has been upgraded to Ubuntu 26.04; custom container deployments must plan migration accordingly.
6. 20260311 Mar 11, 2026 · release notes

   Timesketch 20260311 adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered forensic report generation, Plaso event filters, local auth bypass for OAuth deployments, and bulk star controls.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20260311 https://github.com/google/timesketch.git
   # already have the repo? check out this version:
   $ git checkout 20260311

   └──▷ HOW TO FIND IT
   When you want to automatically generate a forensic report narrative from your starred timeline events without manually writing it.
   📍In the Timesketch UI, star the relevant events in your sketch, then navigate to the LLM features panel and select Starred events to forensic report — the output is saved as a Story in the current sketch.
   • New LLM feature converts starred events into a forensic report stored as a Story, accelerating analyst reporting workflows.
   • Adds support for Plaso event filters in the importer and backend, enabling more targeted ingestion of Plaso timelines.
   • Supports local authentication for allowlisted accounts via API even when OAuth is the default auth method, improving API automation flexibility.
   • Adds bulk star/unstar-all capability in the v3 UI, allowing analysts to quickly bookmark or clear entire result sets.
   • Adds a muting feature to suppress specific events or rules from view.

   +1 more show less

   • Backend version information is now exposed via tsctl info, making it easier to audit deployed component versions.

   6 details in Everything

7. 20260209 Feb 9, 2026 · release notes

   Timesketch 20260209 adds structured JSON logging for containers and migrates AI features to the unified google-genai SDK.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20260209 https://github.com/google/timesketch.git
   # already have the repo? check out this version:
   $ git checkout 20260209

   • Adds structured JSON logging support for containerized environments, improving log ingestion in cloud-native deployments.
   • Migrates AI integration to the unified google-genai SDK, consolidating Gemini and other Google AI features under a single library.

   2 details in Everything

8. 20260119 Jan 19, 2026 · release notes

   Timesketch 20260119 adds optional pip packages in Docker, a CSV export limit dialog, and a dedicated 403 Access Denied page for sketches.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20260119 https://github.com/google/timesketch.git
   # already have the repo? check out this version:
   $ git checkout 20260119

   • Supports optional pip packages at Docker build time, enabling custom AI and third-party integrations without modifying the base image.
   • Adds a dedicated 403 Access Denied page for sketches in both frontend versions, giving users clear feedback on permission errors.
   • Adds a dialog in the Explore view that warns users when CSV exports hit the row limit, preventing silent data truncation.
   • Makes psort logging in Celery tasks configurable, giving operators control over log verbosity for timeline processing jobs.

   4 details in Everything

9. 20251219 Dec 19, 2025 · release notes

   Timesketch 20251219 adds a streaming export API, bulk group sync, AI custom prompts, and new tsctl analyzer/story management commands.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 20251219 https://github.com/google/timesketch.git
   # already have the repo? check out this version:
   $ git checkout 20251219

   └──▷ HOW TO FIND IT
   Guide an AI investigation toward a specific hypothesis by entering a custom prompt in the AI investigation panel.
   📍In the Timesketch UI, open a sketch and navigate to the AI Investigation view, then enter your custom prompt in the new prompt field before running the analysis.
   • Adds a custom prompt field to the AI investigation view, letting analysts guide LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered investigations with free-form input.
   • New high-performance streaming event export API and client support enables fast bulk event retrieval at scale.
   • New sync-groups-from-json tsctl command supports bulk user/group management from a JSON file.
   • New delete-group and help commands added to tsctl for group lifecycle management.
   • New tsctl analyzer-management command surface for managing analyzers from the CLI.

   +5 more show less

   • Adds story section support to the tsctl CLI client, enabling story operations from the command line.
   • Adds timeline tooltip and local defaults to the timeline UI for improved timeline navigation.
   • Profiling configuration is now decoupled from the debug setting, allowing independent control of performance profiling.
   • Chunked processing support added to tsctl check-opensearch-links for handling large datasets.
   • Icons added to user/group autocomplete in the Share dialog for improved usability.

   10 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The timesketch.conf configuration file must be updated with a new config value introduced alongside the werkzeug dependency bump (see issue #3644).
10. 20251114 Nov 14, 2025 · release notes

    Timesketch 20251114 adds a Sec-Gemini-powered log analysis agent for AI-assisted investigation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20251114 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20251114

    • Adds a Sec-Gemini log analysis agent for processing and analyzing log data using Sec-Gemini capabilities.

    1 detail in Everything

11. 20250929 Sep 29, 2025 · release notes

    Timesketch 20250929 adds Sec-Gemini log analysis, sketch deletion, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. custom CA certs, and new tsctl db/archive commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20250929 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20250929

    └──▷ TRY IT
    Export the Timesketch database for backup or migration before upgrading.
    copy

    $ tsctl export-db

    Identify archive records in Timesketch that are inconsistent with OpenSearch index state.
    copy

    $ tsctl find-inconsistent-archives

    • Tracks used time filters across searches so analysts can revisit previous temporal scopes.
    • Supports custom CA certificates for OpenSearch connections, enabling mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with./private-CA deployments.
    • Integrates Sec-Gemini as a log analysis agent provider via a refactored log_analyzer feature.
    • Adds sketch deletion capability through the UI and API.
    • New tsctl commands: export-db, import-db, check-opensearch-links, and find-inconsistent-archives for database and index maintenance.

    +5 more show less

    • Introduces an all scope to the sketchlist API endpoint, allowing retrieval of all sketches beyond personal/shared views.
    • Enhances Scenario and Question API client functionality for richer programmatic investigation workflows.
    • Adds SQLAlchemy engine options support for fine-grained database connection tuning.
    • Refactored DFIQv2 and Yeti analyzer for improved threat-indicator correlation.
    • Improves tsctl archive operations with additional archive management capabilities.

    10 details in Everything

12. 20250807 Aug 7, 2025 · release notes

    Timesketch 20250807 introduces an Investigation View with AI capabilities and a more robust CSV timestamp parser.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20250807 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20250807

    • Adds Investigation View, a new UI workspace for organizing and driving forensic investigations.
    • Integrates AI capabilities into the Investigation View to assist analysts during investigations.
    • Enhances the CSV parser to handle a broader range of timestamp formats robustly.
    • Adds tsctl display of the latest Timesketch commit running on the system for version tracking.

    4 details in Everything

13. 20250708 Jul 8, 2025 · release notes

    Timesketch 20250708 adds batch tag editing, DFIQ event linking, a search guide card, and new tsctl admin commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20250708 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20250708

    └──▷ TRY IT
    Find orphaned objects in the database that may be consuming resources or causing inconsistencies.
    copy

    $ tsctl check-orphaned-objects

    Use the SearchGuideCard to orient a new analyst on a sketch — navigate to the Explore view and interact with the guide surfaced at the top of an empty search.
    📍In the Timesketch UI, open a sketch and go to the Explore view; the SearchGuideCard appears when no search has been run yet, offering suggested queries and starting points.
    • Adds batch editing of tags across multiple events in the UI, enabling faster bulk triage.
    • Links timeline events directly to DFIQ conclusions, connecting artifacts to structured investigative findings.
    • Introduces a unified SearchGuideCard to help analysts start exploring a sketch with contextual query guidance.
    • Adds a bloom prefix to tags emitted by the bloom analyzer for clearer tag provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build..
    • Introduces read-only access grant to a sketch via tsctl.

    +3 more show less

    • Introduces tsctl check-orphaned-objects command to identify orphaned database objects.
    • Updates Admin CLI tsctl to reflect revised User and Group command structure.
    • Enables the Vue 3 UI as a supported frontend option.

    8 details in Everything

14. 20250521 May 21, 2025 · release notes

    Timesketch 20250521 adds bulk OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. export with PIT/slicing, new tsctl/CLI commands, Yeti bloom analyzer, and investigative questions in Stories.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20250521 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20250521

    └──▷ TRY IT
    Review the active Timesketch server configuration without opening config files manually.
    copy

    $ tsctl list-config

    • Adds efficient bulk export via OpenSearch using Point-in-Time (PIT) and slicing for faster, scalable sketch data extraction.
    • New tsctl export-sketch command enables full sketch data archival from the command line.
    • New tsctl list-config command surfaces current Timesketch configuration directly via tsctl.
    • New CLI client generate-dummy-csv command for generating test/dummy timeline data.
    • New CLI client sketch export-only-with-annotations command to export only annotated events from a sketch.

    +2 more show less

    • Adds Yeti bloom check analyzer for enriching timelines with Yeti threat intelligence bloom filter lookups.
    • Enables adding and using Investigative Questions inside Stories for structured incident documentation.

    7 details in Everything

15. 20250408 Apr 8, 2025 · release notes

    Timesketch 20250408 adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered NL-to-query and summarization, Ollama support, Celery task management in tsctl, and expanded client API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20250408 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20250408

    └──▷ TRY IT
    Check the health of a Timesketch instance directly from the server CLI without opening the UI.
    copy

    $ tsctl timesketch-status

    • Adds natural-language-to-query (nl2q) and llm_summarize LLM features, letting analysts generate search queries and summarize events using configured LLM providers.
    • Introduces a new LLM features manager and interface, plus an LLMResource API endpoint accessible from both backend and frontend.
    • Adds Ollama as a supported LLM provider with response schema support, alongside a new LLM provider directory structure.
    • Adds LLM configuration handling and a settings UI for managing LLM provider options.
    • Supports LLM provider fallback to a default configuration when a specific provider is unavailable.

    +7 more show less

    • Adds support for searching and displaying processing (in-flight) timelines via SEARCH_PROCESSING_TIMELINES.
    • Expands the client API to support Timeline, SearchIndex, and Datasource creation programmatically.
    • Adds timesketch-status subcommand to tsctl for checking instance health.
    • Adds searchindex set and get status subcommands to tsctl for managing search index state.
    • Adds Celery task management to tsctl, enabling listing and cancellation of background tasks.
    • Enhances tsctl sketch-info and searchindex-info subcommands with richer detail.
    • Makes suggested queries the active default tab in the Questions/Queries UI panel.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !sketch.upload() is removed from the API client (was long deprecated); callers must migrate to the replacement upload path.
16. 20250112 Feb 12, 2025 · release notes

    Timesketch 20250112 adds AI event summarization, Google AIStudio LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. support, CLI label/user management, and threat intel view improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20250112 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20250112

    └──▷ HOW TO FIND IT
    Delete a Story you no longer need directly from the sketch UI instead of via the API.
    📍In the Timesketch UI, open a sketch, navigate to Stories, select the story you want to remove, and click the Delete button.
    • Adds Google AIStudio as a supported LLM provider alongside existing options.
    • New LLM-powered event summarization feature lets analysts summarize timeline events using configured AI providers.
    • LLM providers can now be configured per feature, giving finer control over which model backs each AI capability.
    • Adds response_schema support and a location parameter to the VertexAI LLM interface.
    • CLI gains sketch label management commands for adding, removing, and listing labels on sketches.

    +8 more show less

    • CLI index information now includes field count per Timesketch index.
    • Enhances tsctl with user status and group membership queries.
    • OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. field mapping limit is now increased dynamically during CSV/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. ingestion, removing a common import ceiling.
    • Star and Comment label counts in the left panel now update dynamically without a page reload.
    • Adds a User Settings menu to the home page.
    • Adds context menu and sketch creation directly from the homepage.
    • Adds the ability to delete a Story from the UI.
    • Improvements to the threat intelligence view.

    13 details in Everything

17. 20241129 Nov 29, 2024 · release notes

    Timesketch 20241129 adds AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. tagger rules, a new Sigma mapping, actionable search error messages, and a next-gen frontend scaffold.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20241129 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20241129

    • Adds AWS CloudTrail configuration for the Tagger Analyzer, enabling automated tagging of CloudTrail events.
    • Adds Sigma mapping for certificateservicesclient-lifecycle-system events, expanding Windows detection coverage.
    • Adds document/page title for sketches, improving browser tab identification and bookmarking.
    • Adds actionable error messages for complex search queries, surfacing guidance when queries fail.
    • Scaffolds the next-generation Frontend v3, laying groundwork for an updated UI.

    +2 more show less

    • Adds a warning snackbar notification component for surfacing non-fatal alerts in the UI.
    • Updates getTimelineFields to return the union of all timeline fields across a sketch.

    7 details in Everything

18. 20241009 Oct 9, 2024 · release notes

    Timesketch 20241009 adds DFIQ analyzer support, query-string filtering in Visualizations, and CLI sketch archive/export commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20241009 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20241009

    └──▷ HOW TO FIND IT
    Scope a Visualization to a specific subset of events without leaving the Visualizations panel.
    📍In the Timesketch UI, open a sketch, navigate to Visualizations, and enter a query string in the filter box to restrict the visualized events to matching results.
    • Adds DFIQ (Digital Forensics Investigative Questions) analyzer integration for structured investigation workflows.
    • Adds query-string filtering to Visualizations, enabling scoped visual analysis directly within a sketch.
    • New CLI commands to export, archive, and unarchive a sketch for offline storage or transfer.
    • Adds --skip-create-user option to the deployment tooling for non-interactive/automated deployments.
    • Enables passing auto-run analyzers parameter when uploading via the importer library.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrading to this version requires a database migration — run the upgrade procedure at https://timesketch.org/guides/admin/upgrade/ before starting the new instance.
19. 20240828 Aug 28, 2024 · release notes

    Timesketch 20240828 adds DFIQ v1.1 support, visualizations in stories, and new CLI timeline management commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20240828 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20240828

    └──▷ HOW TO FIND IT
    Enable or disable DFIQ Scenarios for your instance from the admin system settings.
    📍In the Timesketch admin console, go to System Settings and toggle the Scenarios enable/disable option.
    • Redesigned DFIQ card UI with AI query integration for investigative workflows.
    • Adds visualizations directly into stories, enabling richer narrative reporting.
    • Enables or disables DFIQ Scenarios via system settings.
    • Supports DFIQ v1.1 schema across the UI, API client, and backend.
    • API client now handles investigative questions and updated scenario listing/adding for DFIQ v1.1.

    +4 more show less

    • CLI tool gains timeline rename functionality.
    • CLI tool gains timeline delete command.
    • CLI tool gains timeline color-change command.
    • Visualization editor now supports timeline selection.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrading to this version requires a database upgrade (see https://timesketch.org/guides/admin/upgrade/).
20. 20240717 Jul 18, 2024 · release notes

    Timesketch 20240717 adds ApexChart visualizations, a Natural Language to Query API, and CSV export for analyzer stats.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20240717 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20240717

    • New ApexChart-based visualizations available in the UI for richer, interactive timeline charts.
    • New NL2Q API (Natural Language to Query) lets users query timelines using plain-language prompts, with an improved v2 prompt engine.
    • MISP analyzer updated with new detection capabilities.
    • Adds CSV export option to tsctl analyzer-stats for easier offline reporting.
    • Analyzer output now includes only tags created by the running analyzer, reducing noise.

    +1 more show less

    • Yeti Indicators analyzer updated with more precise SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. indicator queries and support for merging multiple intelligence attributes.

    6 details in Everything

21. 20240508 May 8, 2024 · release notes

    Adds support for observables in Yeti analyzers and allows saving empty search results

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20240508 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20240508

    └──▷ TRY IT
    Triggering a Yeti analysis on an observable found in a timeline through the API.
    copy

    $ POST /api/v1/search/yeti/analyze
    {
      "sketch_id": 1,
      "event_ids": ["obs_12345"]
    }

    Saving a query with no hits for later review.
    📍Steps: In the UI, run your search query. If it returns no results, click Save Search just as you would for a successful query; previously this was blocked.
    • Adds Observables support to the Yeti analyzer integration, enabling automatic analysis of discovered artifacts via the Yeti platform.
    • Allows saving searches that return zero results to the user's saved searches list.

    2 details in Everything

22. 20240328 Mar 28, 2024 · release notes

    Timesketch 20240328 adds a user profile/settings UI, DFIQ navigation overhaul, and precise field selection for searches

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20240328 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20240328

    • run_analyzers in the api client has been updated to allow triggering analyzers programmatically.
    • The profile tab in the web UI now supports user settings such as theme preferences.
    • DFIQ (Digital Forensics Intelligence Question) model gains a new dedicated navigation section.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The database schema is modified and requires an upgrade before starting the service.
23. 20240207 Feb 7, 2024 · release notes

    New user management API endpoints, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. service integration, collapsable left panel, and optional TLS verification for the API client.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20240207 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20240207

    • New API endpoints GET /api/v1/users, POST /api/v1/users, and GET /api/v1/users/<user_id> for user management
    • Adds collapsable left panel in the UI to reclaim workspace space

    2 details in Everything

24. 20231206 Dec 6, 2023 · release notes

    Timesketch 20231206 adds Add to Threat Intelligence context links, DFIQ context card highlighting, and CSV/e2e test infrastructure.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20231206 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20231206

    • Add to Threat Intelligence action via context links allows analysts to tag indicators directly from event cards without navigating away.
    • Highlighting of the DFIQ context card improves visibility of framework-aligned metadata in timeline events.
    • API client now returns all fields for analysis sessions, enabling full state inspection in automation scripts.
    • Feature extraction config expanded to support BITS and Terminal Services logs, allowing structured data extraction from these Windows sources.

    4 details in Everything

25. 20231025 Oct 25, 2023 · release notes

    Timesketch adds intelligence CLI command, Unfurl integration, and SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20231025 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20231025

    • Adds intelligence command to the CLI client
    • New Unfurl integration for link previews
    • Adds SSL/TLS support and authentication for SMTP notifications

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrading requires a database upgrade; follow the admin guide at https://timesketch.org/guides/admin/upgrade/.
26. 20230913 Sep 13, 2023 · release notes

    Adds event attribute filters, CSV export, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. 2.x support, and Plaso formatter overrides to Timesketch

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20230913 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20230913

    └──▷ HOW TO FIND IT
    Filter analyzer output to include only specific attributes.
    📍{ filter: { attributes: { include: [hostname, ip] } } }
    • tsctl now includes timeline information in its output
    • Event attribute include / exclude filters for filtering analyzer results
    • OpenSearch 2.x support added as a backend option
    • Support overriding/extending Plaso formatter definitions

    4 details in Everything

27. 20230721 Jul 21, 2023 · release notes

    Timesketch adds --output-format CLI flag, JSON/tab output, analyze results in CLI, and sketch attribute management via CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20230721 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20230721

    • Adds --output-format as a global CLI argument for specifying the output format (JSON or tab).
    • Adds support for JSON and tabular output formats in the CLI client.
    • Enables retrieving timesketch analyze results directly through the CLI client.
    • Adds commands to manage sketch attributes via the CLI client.

    4 details in Everything

28. 20230628 Jun 28, 2023 · release notes

    Timesketch 20230628 adds SSH/Windows bruteforce analyzers, DFIQ support, env-based settings, verbose analyzer output UI/API, and user-defined aggregation names

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20230628 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20230628

    └──▷ TRY IT
    Configure Timesketch using environment variables.
    copy

    $ export TS_CONFIG_DB_URI=postgresql://localhost/timesketch
    export TS_SECRET_KEY=mysecretkey
    timesketch run

    • Adds SSH bruteforce analyzer to detect brute-force login attempts in timeline data.
    • Adds Windows bruteforce analyzer to detect brute-force login attempts on Windows systems.
    • Adds DFIQ (DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. Investigation Query) support for standardized investigation queries.
    • Enables configuration via environment variables instead of only file-based settings (requires Flask 2.1+).
    • Supports verbose analyzer output in the UI and API, allowing richer metadata collection from analyzers.

    +1 more show less

    • Returns user-defined aggregation names when using the API client for aggregations.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Environment variable-based configuration now available, but requires Flask 2.1+; if not met, settings may fail to load correctly.
29. 20230518 May 18, 2023 · release notes

    Timesketch adds Sigma API conversion, Prometheus metrics, search history, sketch attributes, and CLI client enhancements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20230518 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20230518

    • text --> sigma rule API endpoint converts free-text queries into Sigma rules via the API.
    • Prometheus metric collection enabled for monitoring Timesketch service health.
    • CLI importer tool now accepts provider and context arguments to tag import sources.
    • Added searchtemplate.py module and API endpoints to manage search templates programmatically.
    • Data source DB model supports file size limits and generic CSV/JSON mappings for ingestion.

    +9 more show less

    • Timesketch CLI client adds support for saved searches, making them accessible via the command line.
    • Sketch attributes can now be viewed in a dynamic table component in the UI and managed via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
    • Search history feature tracks previous search actions with metrics for analysis.
    • Interactive histogram available in the UI for temporal data exploration.
    • Search autocomplete and dropdown provided in the UI to aid query construction.
    • Clipboard copy functionality added to EventListRow and EventListRowDetail for rapid event export.
    • Support for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination.-only Elasticsearch connections (without username/password) is now available.
    • OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication can now use external providers by configuring timesketch.conf.
    • tsctl.py CLI script extended with commands to add users to a sketch.

    14 details in Everything

30. 20210224 Feb 24, 2021 · release notes

    Timesketch adds IP address extractors for RdpCoreTS logs, new storage backend, and dedicated UI tabs for analysis and aggregations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20210224 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20210224

    • Adds the __ts_timeline_id field to timeline documents and supports query_dsl and analyzers in the new data store (replacing __timeline_id).
    • Introduces a dedicated Analysis tab and a separate Aggregations tab with support for index and time range filters.
    • Adds IP address feature extractors for RdpCoreTS event logs.

    3 details in Everything

31. 20201229 Dec 29, 2020 · release notes

    Timesketch 20201229 adds Dark Mode, Sigma rule support, sketch archiving/export APIs, HTML story export, and event tagging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20201229 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20201229

    └──▷ USE IT
    Export a sketch's data programmatically using the new API client method
    python copy

    from timesketch_api.client import TimesketchClient
    ts = TimesketchClient(host='https://timesketch.example.com')
    sketch = ts.get_sketch(123)
    export_data = sketch.export()
    print(export_data)

    Generate an HTML file from a story for sharing findings offline
    📍In the UI, navigate to the desired story and click Export -> HTML to download the standalone document.
    Tag an event programmatically via the API client
    python copy

    event = sketch.get_event('some_index', 'some_doc_id')
    event.add_tags(['malicious', 'indicator'])
    event.save()

    • Adds Dark Mode UI theme for reduced eye strain
    • Adds support for analyzing data using Sigma rules via a new analyzer integration
    • Adds Archive sketch functionality to permanently remove a sketch from active use
    • Adds Export sketches capability via the API client library
    • Adds HTML export feature for stories to generate standalone documentation

    +3 more show less

    • Adds the ability to add tags to events through the API
    • Enables creation of views through the API client
    • Adds granular ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. granting capabilities for access control

    8 details in Everything

32. 20201120 Nov 20, 2020 · release notes

    Timesketch adds sketch archiving, export capabilities, Sigma rule support, and a new EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. Gap analyzer in this release.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20201120 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20201120

    • Enables archiving and unarchiving of sketches for storage management.
    • Adds Sigma rules analysis capability to the tool's analyzers.
    • Introduces an EVTX Gap analyzer to detect missing log events in Windows event logs.
    • Allows exporting all sketch events with all columns included via API and UI.
    • Provides a new tabbed view for organizing multiple sketches in the UI list.

    +1 more show less

    • Adds an export button directly on search results for quick data extraction.

    6 details in Everything

33. 20200507 May 7, 2020 · release notes

    Adds label-based filtering in aggregations and supports config files for the importer

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20200507 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20200507

    └──▷ USE IT
    Configure importer behavior using an external file instead of inline parameters.
    shell copy

    importer --config /path/to/config.yaml

    • Adds ability to filter aggregations based on labels.
    • Adds support for config files in the importer.
    • Moves the importer into a separate directory and library.

    3 details in Everything

34. 20200422 Apr 22, 2020 · release notes

    Adds aggregation groups, table rendering from aggregations, and UI support for group aggregations in stories.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20200422 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20200422

    • Save aggregations and add to Stories allows saving aggregation results directly into timeline stories for later reference
    • Support non-text fields in aggregations extends the aggregation engine to handle numerical and date types alongside text fields
    • Add ability to render table from an aggregation enables displaying aggregation output as a structured table view instead of just charts
    • Sort analyzer list and add button to overview page adds UI controls on the overview screen to sort the available analyzers and initiate analysis
    • More Chart support - added linechart and href introduces a new line chart visualization type and links in chart elements

    +4 more show less

    • Add listing of groups and users exposes an API or view to list defined user groups and individual users within a sketch
    • Adding aggregation groups allows organizing multiple aggregations into logical groups for bulk management
    • UI: Support group aggregations in stories enables embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. aggregated data groups directly into story narratives via the UI
    • Added ability to modify aggregations and aggregation groups provides functionality to edit existing aggregation definitions and their groupings

    9 details in Everything

35. 20200319 Mar 19, 2020 · release notes

    Adds API support for sketch ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. (users/groups), stories export, aggregation queries, and new analyzers for crash artefacts and event tagging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20200319 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20200319

    • Expose aggregation query support in the backend API for sketch data analysis
    • New config-driven tag/emoji assignment analyzer available as an analyzer option

    2 details in Everything

36. 20200226 Feb 26, 2020 · release notes

    Adds Psexec/EVFX/SSH analyzer sessionizers, GCS importer, ES 7.x support, and tsctl index flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20200226 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20200226

    └──▷ USE IT
    Specify a target Elasticsearch index for new data using tsctl
    shell copy

    tsctl import --index my_sketch_index -i input.jsonl

    • New psexec_sessionizer adds parsing logic for PsExec sessions (new detection capability)
    • New evtx_sessionizer adds parsing logic for Windows Event Log files (new detection capability)
    • New ssh_bruteforce_session_analyzer adds SSH brute-force pattern analysis (new detection capability)
    • Google Cloud Storage importer enables ingestion from GCS buckets
    • Added --index flag to tsctl to specify the Elasticsearch index during data upload

    +2 more show less

    • Elasticsearch 7.x support allows use of ES 7.x as the backend store
    • Upload API now supports chunked uploads and direct entries for large dataset import

    7 details in Everything

37. 20200131 Jan 31, 2020 · release notes

    Timesketch adds Sigma rule support and a dev-only analyzer runner; removes Python 2.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20200131 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20200131

    • Adds Initial Sigma support to enable Sigma rule-based analysis within Timesketch sketches.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removes Python 2 support, requiring a Python 3 environment to run.
38. 20191220 Dec 20, 2019 · release notes

    New UI, API client auth, dynamic analyizers/aggregators, tsctl list_sketches, sessionizers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20191220 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20191220

    └──▷ USE IT
    List all sketches in the instance without loading the UI.
    shell copy

    tsctl list_sketches

    • tsctl CLI gains the list_sketches subcommand to list available sketches.
    • API client adds OAUTH authentication support via a new method.
    • Analyzers can now be defined dynamically at runtime instead of requiring static registration.
    • Aggregation framework is rewritten to support dynamic aggregators and SQL models, with corresponding API endpoints and client methods exposed.
    • New UI components include timeline picker, time filters, result limit/sort controls, pagination, sharing controls, upload progress bar, and empty states.

    +7 more show less

    • Events can now be starred and unstarred directly from the new UI.
    • Sketches can be deleted via a new API endpoint and UI control (requires user permission).
    • Timelines are managed via a new Timeline management subsystem accessible through the new UI/API.
    • Markdown stories support allows writing narrative reports within sketches.
    • Editable sketch summaries allow updating the sketch description post-creation.
    • New analyzers added: Linkedin account extraction, Yeti indicator analyzer, GCP servicekey (stackdriver logs), SSH sessionizing analyzer, and chain analyzer.
    • Sessionizer plugins (basic and expert) plus sequence sessionizer enable grouping events into user sessions.

    12 details in Everything

39. 20190207 Feb 7, 2019 · release notes

    Timesketch 20190207 adds new analyzers (login, feature extraction), tsctl importer, API return fields, and emoji support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20190207 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20190207

    └──▷ USE IT
    Configure the feature_extraction analyzer to run after browser_timeframe by setting dependencies in the analyzer definition.
    json copy

    {"name": "feature_extraction", "dependencies": ["browser_timeframe"]}

    • tsctl includes a new importer command
    • API calls can now request specific return_fields to limit response payload
    • UI supports emoji annotations in sketches
    • New analyzers: login, feature_extraction, browser_timeframe, and simple_domain
    • Analyzers are executed in a chain using declared dependencies

    5 details in Everything

40. 20181116 Nov 16, 2018 · release notes

    Adds Redline import via tsctl, Google OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth, Elasticsearch 6.x support, and automatic analysis tasks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20181116 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20181116

    • tsctl gains a redline subcommand to import Redline archives directly into Timesketch
    • Google OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication backend is now available for user login
    • Timesketch service supports Elasticsearch 6.x data stores
    • Analyzers can now run automatically after events are indexed, without manual trigger
    • CSV export includes the _index field for each event

    +2 more show less

    • Similarity analysis UI element is enabled in the interface
    • CSV import preserves delimiter characters specified by the user

    7 details in Everything

41. 20180612 Jun 12, 2018 · release notes

    Timesketch 20180612 adds graph visualization, JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory./CSV parsing improvements, event annotation/search APIs, and Google IAP/OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20180612 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20180612

    └──▷ HOW TO FIND IT
    Link related forensic events using the graph view UI.
    📍In the Sketch view, select multiple events and use Graph entities and registry to visualize connections.
    Import CSV data with custom delimiters (e.g., semicolon) directly into a sketch timeline.
    📍Upload file.csv via the Ingestion UI; Timesketch now supports CSV files using non-standard delimiters.
    Annotate and search events programmatically using the Python API client with basic auth.
    python copy

    client = timesketch.TimesketchClient(host, username, password)
    timeline = client.get_timeline(1)
    annotations = timeline.search(query='*', index=timeline.index_name)
    for event in annotations:
        event.add_label('suspicious')

    Export a search template to share with teammates.
    📍In the Search view, select your saved query and use 'Enable file import/export support for search templates' to export.
    Add a custom label to a search template for better organization.
    📍Edit a saved search template and use 'add label support to search templates' to attach tags.
    • Add Graph entities and registry to link related events
    • Enable CSV files using non-standard delimiters for ingestion
    • Support new Plaso (20170930 aka Heimdall) format for data ingestion
    • Add support for HTTP basic authentication to the API client
    • Add Python API functions for annotating events and searching a timeline by annotation

    +4 more show less

    • Enable file import/export support for search templates
    • add label support to search templates
    • Add Google IAP/OIDC authentication support
    • Add direct link to specific event

    9 details in Everything

42. 20170721 Jul 21, 2017 · release notes

    Timesketch adds CSV/Sketch upload, Python API client, Elasticsearch 5.x and Neo4j support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20170721 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 20170721

    └──▷ USE IT
    Use the new Python API client to interact with Timesketch programmatically.
    python copy

    from timesketch_api.client import TimesketchClient
    client = TimesketchClient('http://localhost:8080')
    sketch = client.get_or_create_sketch(name='My Sketch')

    Deploy Timesketch using the new Docker support.
    copy

    $ docker-compose up -d

    • CSV upload enables importing data via CSV files.
    • Sketch upload allows uploading entire sketches for portability.
    • Python API client library provides a programmatic interface to Timesketch.
    • Elasticsearch 5.x support updates the backend compatibility.
    • Neo4j graph backend support enables graph analysis capabilities.

    +3 more show less

    • Add Docker Support via docker-compose v3.
    • Streaming query results for faster large dataset handling.
    • Dynamic timefilter allows flexible temporal filtering.

    8 details in Everything

43. 2016.7 Jul 22, 2016 · release notes

    Timesketch 2016.7 adds ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. system and Group support for permission management

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2016.7 https://github.com/google/timesketch.git
    # already have the repo? check out this version:
    $ git checkout 2016.7

    • Extended ACL system and Group support to control access at the group level

    1 detail in Everything