https://cybertoolchain.io/tools/timesketch New releases and features in Timesketch, tracked by The Cyber Toolchain. en Wed, 14 Oct 2026 15:06:04 GMT https://github.com/google/timesketch/releases/tag/20261014 https://github.com/google/timesketch/releases/tag/20261014 Wed, 14 Oct 2026 15:06:04 GMT Timesketch 20261014 adds OIDC group/role-based access control, Sec-Gemini BYOT log analysis, and an OpenSearch index prefix config option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `OPENSEARCH_INDEX_PREFIX` config key to namespace OpenSearch indices for new Timesketch installations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Implements Sec-Gemini Bring-Your-Own-Token (BYOT) log analysis support, enabling AI-assisted timeline analysis via the SecGemini LLM provider. • Adds OIDC Group/Role-Based Access Control with membership sync, enabling identity-provider groups to drive Timesketch sketch permissions. • Transitions Gunicorn WSGI workers to the threaded `gthread` model, improving concurrency for multi-user deployments. • Updates the SecGemini provider to parse attached JSONL findings for richer LLM-driven analysis output. Breaking changes: • Timesketch now enforces a minimum Plaso version of `20260720`; worker deployments must upgrade `plaso-tools` to at least `20260720` before upgrading Timesketch. • `.plaso` files created with Plaso versions earlier than `20260720` will fail to import; export them to JSONL with a matching older `psort` and upload the `.jsonl` file instead. • Plaso `20260720` renamed the `computer_name` field to `hostname` and `body` to `message_body`; custom saved views or queries targeting those fields may need updating for new timelines. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20260630 https://github.com/google/timesketch/releases/tag/20260630 Tue, 30 Jun 2026 20:24:39 GMT Timesketch 20260630 adds SecGemini analyzer results to report summaries and enriches OpenTelemetry spans with search metadata. • Adds SecGemini analyzer report output to the sketch report summary, surfacing AI-driven analysis alongside other analyzer results. • Updates SecGemini provider to align with the sec-gemini v3 SDK APIs, enabling compatibility with the latest SecGemini capabilities. • Adds search metadata attributes to OpenTelemetry spans, enabling deeper observability into search query telemetry. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20260617 https://github.com/google/timesketch/releases/tag/20260617 Wed, 17 Jun 2026 14:55:32 GMT Timesketch 20260617 enforces cross-sketch ownership on event fact conclusions via the API. • Enforces cross-sketch ownership validation on event fact conclusions in the API, preventing users from applying conclusions across sketches they don't own. Breaking changes: • OpenSearch users must upgrade to a minimum of version 3.7.0 before upgrading to this Timesketch release when running OpenSearch >= 3.x. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20260617 https://github.com/google/timesketch/releases/tag/20260617 Wed, 17 Jun 2026 14:55:32 GMT Timesketch 20260617 enforces cross-sketch ownership on event fact conclusions via the API. • Enforces cross-sketch ownership validation on event fact conclusions in the API, preventing analysts from applying conclusions across sketches they do not own. Breaking changes: • OpenSearch users must upgrade to at least version 3.7.0 before upgrading to this Timesketch release if running OpenSearch >= 3.x Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20260611 https://github.com/google/timesketch/releases/tag/20260611 Thu, 11 Jun 2026 19:11:12 GMT Timesketch 20260611 adds native wildcard field search, OpenTelemetry tracing, and upgrades the base image to Ubuntu 26.04. • Supports mapping text fields as `wildcard` field types in OpenSearch, enabling native substring searches across log data. • Introduces OpenTelemetry integration for tracing Timesketch web backend, SQLAlchemy, and OpenSearch interactions — enabling performance monitoring and health tracking. • Upgrades the base Docker image to Ubuntu 26.04 with major dependency updates. • Improves the SearchDropdown UI component with enhancements for usability. Breaking changes: • The minimum compatible OpenSearch version is now 2.19.5 to support native wildcard field mappings; deployments running older OpenSearch versions must upgrade. • The base Docker image has been upgraded to Ubuntu 26.04; custom container deployments must plan migration accordingly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20260311 https://github.com/google/timesketch/releases/tag/20260311 Wed, 11 Mar 2026 14:38:44 GMT Timesketch 20260311 adds LLM-powered forensic report generation, Plaso event filters, local auth bypass for OAuth deployments, and bulk star controls. • New LLM feature converts starred events into a forensic report stored as a Story, accelerating analyst reporting workflows. • Adds support for Plaso event filters in the importer and backend, enabling more targeted ingestion of Plaso timelines. • Supports local authentication for allowlisted accounts via API even when OAuth is the default auth method, improving API automation flexibility. • Adds bulk star/unstar-all capability in the v3 UI, allowing analysts to quickly bookmark or clear entire result sets. • Adds a muting feature to suppress specific events or rules from view. • Backend version information is now exposed via `tsctl info`, making it easier to audit deployed component versions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20260209 https://github.com/google/timesketch/releases/tag/20260209 Mon, 09 Feb 2026 20:25:22 GMT Timesketch 20260209 adds structured JSON logging for containers and migrates AI features to the unified google-genai SDK. • Adds structured JSON logging support for containerized environments, improving log ingestion in cloud-native deployments. • Migrates AI integration to the unified google-genai SDK, consolidating Gemini and other Google AI features under a single library. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20260119 https://github.com/google/timesketch/releases/tag/20260119 Mon, 19 Jan 2026 14:58:06 GMT Timesketch 20260119 adds optional pip packages in Docker, a CSV export limit dialog, and a dedicated 403 Access Denied page for sketches. • Supports optional pip packages at Docker build time, enabling custom AI and third-party integrations without modifying the base image. • Adds a dedicated 403 Access Denied page for sketches in both frontend versions, giving users clear feedback on permission errors. • Adds a dialog in the Explore view that warns users when CSV exports hit the row limit, preventing silent data truncation. • Makes psort logging in Celery tasks configurable, giving operators control over log verbosity for timeline processing jobs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20251219 https://github.com/google/timesketch/releases/tag/20251219 Fri, 19 Dec 2025 11:27:52 GMT Timesketch 20251219 adds a streaming export API, bulk group sync, AI custom prompts, and new tsctl analyzer/story management commands. • Adds a custom prompt field to the AI investigation view, letting analysts guide LLM-powered investigations with free-form input. • New high-performance streaming event export API and client support enables fast bulk event retrieval at scale. • New `sync-groups-from-json` tsctl command supports bulk user/group management from a JSON file. • New `delete-group` and `help` commands added to tsctl for group lifecycle management. • New tsctl `analyzer-management` command surface for managing analyzers from the CLI. • Adds story section support to the tsctl CLI client, enabling story operations from the command line. • Adds timeline tooltip and local defaults to the timeline UI for improved timeline navigation. • Profiling configuration is now decoupled from the debug setting, allowing independent control of performance profiling. • Chunked processing support added to tsctl `check-opensearch-links` for handling large datasets. • Icons added to user/group autocomplete in the Share dialog for improved usability. Breaking changes: • The `timesketch.conf` configuration file must be updated with a new config value introduced alongside the werkzeug dependency bump (see issue #3644). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20251114 https://github.com/google/timesketch/releases/tag/20251114 Fri, 14 Nov 2025 09:02:52 GMT Timesketch 20251114 adds a Sec-Gemini-powered log analysis agent for AI-assisted investigation. • Adds a Sec-Gemini log analysis agent for processing and analyzing log data using Sec-Gemini capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20250929 https://github.com/google/timesketch/releases/tag/20250929 Mon, 29 Sep 2025 20:07:27 GMT Timesketch 20250929 adds Sec-Gemini log analysis, sketch deletion, OpenSearch custom CA certs, and new tsctl db/archive commands. • Tracks used time filters across searches so analysts can revisit previous temporal scopes. • Supports custom CA certificates for OpenSearch connections, enabling mTLS/private-CA deployments. • Integrates Sec-Gemini as a log analysis agent provider via a refactored log_analyzer feature. • Adds sketch deletion capability through the UI and API. • New `tsctl` commands: `export-db`, `import-db`, `check-opensearch-links`, and `find-inconsistent-archives` for database and index maintenance. • Introduces an `all` scope to the `sketchlist` API endpoint, allowing retrieval of all sketches beyond personal/shared views. • Enhances Scenario and Question API client functionality for richer programmatic investigation workflows. • Adds SQLAlchemy engine options support for fine-grained database connection tuning. • Refactored DFIQv2 and Yeti analyzer for improved threat-indicator correlation. • Improves `tsctl` archive operations with additional archive management capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20250807 https://github.com/google/timesketch/releases/tag/20250807 Thu, 07 Aug 2025 08:31:53 GMT Timesketch 20250807 introduces an Investigation View with AI capabilities and a more robust CSV timestamp parser. • Adds Investigation View, a new UI workspace for organizing and driving forensic investigations. • Integrates AI capabilities into the Investigation View to assist analysts during investigations. • Enhances the CSV parser to handle a broader range of timestamp formats robustly. • Adds `tsctl` display of the latest Timesketch commit running on the system for version tracking. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20250708 https://github.com/google/timesketch/releases/tag/20250708 Tue, 08 Jul 2025 11:52:32 GMT Timesketch 20250708 adds batch tag editing, DFIQ event linking, a search guide card, and new tsctl admin commands. • Adds batch editing of tags across multiple events in the UI, enabling faster bulk triage. • Links timeline events directly to DFIQ conclusions, connecting artifacts to structured investigative findings. • Introduces a unified SearchGuideCard to help analysts start exploring a sketch with contextual query guidance. • Adds a `bloom` prefix to tags emitted by the bloom analyzer for clearer tag provenance. • Introduces read-only access grant to a sketch via `tsctl`. • Introduces `tsctl check-orphaned-objects` command to identify orphaned database objects. • Updates Admin CLI `tsctl` to reflect revised User and Group command structure. • Enables the Vue 3 UI as a supported frontend option. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20250521 https://github.com/google/timesketch/releases/tag/20250521 Wed, 21 May 2025 08:56:10 GMT Timesketch 20250521 adds bulk OpenSearch export with PIT/slicing, new tsctl/CLI commands, Yeti bloom analyzer, and investigative questions in Stories. • Adds efficient bulk export via OpenSearch using Point-in-Time (PIT) and slicing for faster, scalable sketch data extraction. • New `tsctl export-sketch` command enables full sketch data archival from the command line. • New `tsctl list-config` command surfaces current Timesketch configuration directly via tsctl. • New CLI client `generate-dummy-csv` command for generating test/dummy timeline data. • New CLI client `sketch export-only-with-annotations` command to export only annotated events from a sketch. • Adds Yeti bloom check analyzer for enriching timelines with Yeti threat intelligence bloom filter lookups. • Enables adding and using Investigative Questions inside Stories for structured incident documentation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20250408 https://github.com/google/timesketch/releases/tag/20250408 Tue, 08 Apr 2025 16:35:27 GMT Timesketch 20250408 adds LLM-powered NL-to-query and summarization, Ollama support, Celery task management in tsctl, and expanded client API. • Adds natural-language-to-query (`nl2q`) and `llm_summarize` LLM features, letting analysts generate search queries and summarize events using configured LLM providers. • Introduces a new LLM features manager and interface, plus an `LLMResource` API endpoint accessible from both backend and frontend. • Adds Ollama as a supported LLM provider with response schema support, alongside a new LLM provider directory structure. • Adds LLM configuration handling and a settings UI for managing LLM provider options. • Supports LLM provider fallback to a default configuration when a specific provider is unavailable. • Adds support for searching and displaying processing (in-flight) timelines via `SEARCH_PROCESSING_TIMELINES`. • Expands the client API to support Timeline, SearchIndex, and Datasource creation programmatically. • Adds `timesketch-status` subcommand to `tsctl` for checking instance health. • Adds `searchindex set` and `get status` subcommands to `tsctl` for managing search index state. • Adds Celery task management to `tsctl`, enabling listing and cancellation of background tasks. • Enhances `tsctl sketch-info` and `searchindex-info` subcommands with richer detail. • Makes suggested queries the active default tab in the Questions/Queries UI panel. Breaking changes: • sketch.upload() is removed from the API client (was long deprecated); callers must migrate to the replacement upload path. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20250112 https://github.com/google/timesketch/releases/tag/20250112 Wed, 12 Feb 2025 13:09:44 GMT Timesketch 20250112 adds AI event summarization, Google AIStudio LLM support, CLI label/user management, and threat intel view improvements. • Adds Google AIStudio as a supported LLM provider alongside existing options. • New LLM-powered event summarization feature lets analysts summarize timeline events using configured AI providers. • LLM providers can now be configured per feature, giving finer control over which model backs each AI capability. • Adds `response_schema` support and a `location` parameter to the VertexAI LLM interface. • CLI gains sketch label management commands for adding, removing, and listing labels on sketches. • CLI index information now includes field count per Timesketch index. • Enhances `tsctl` with user status and group membership queries. • OpenSearch field mapping limit is now increased dynamically during CSV/JSONL ingestion, removing a common import ceiling. • Star and Comment label counts in the left panel now update dynamically without a page reload. • Adds a User Settings menu to the home page. • Adds context menu and sketch creation directly from the homepage. • Adds the ability to delete a Story from the UI. • Improvements to the threat intelligence view. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20241129 https://github.com/google/timesketch/releases/tag/20241129 Fri, 29 Nov 2024 12:04:21 GMT Timesketch 20241129 adds AWS CloudTrail tagger rules, a new Sigma mapping, actionable search error messages, and a next-gen frontend scaffold. • Adds AWS CloudTrail configuration for the Tagger Analyzer, enabling automated tagging of CloudTrail events. • Adds Sigma mapping for `certificateservicesclient-lifecycle-system` events, expanding Windows detection coverage. • Adds document/page title for sketches, improving browser tab identification and bookmarking. • Adds actionable error messages for complex search queries, surfacing guidance when queries fail. • Scaffolds the next-generation Frontend v3, laying groundwork for an updated UI. • Adds a warning snackbar notification component for surfacing non-fatal alerts in the UI. • Updates `getTimelineFields` to return the union of all timeline fields across a sketch. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20241009 https://github.com/google/timesketch/releases/tag/20241009 Wed, 09 Oct 2024 16:17:02 GMT Timesketch 20241009 adds DFIQ analyzer support, query-string filtering in Visualizations, and CLI sketch archive/export commands. • Adds DFIQ (Digital Forensics Investigative Questions) analyzer integration for structured investigation workflows. • Adds query-string filtering to Visualizations, enabling scoped visual analysis directly within a sketch. • New CLI commands to export, archive, and unarchive a sketch for offline storage or transfer. • Adds `--skip-create-user` option to the deployment tooling for non-interactive/automated deployments. • Enables passing auto-run analyzers parameter when uploading via the importer library. Breaking changes: • Upgrading to this version requires a database migration — run the upgrade procedure at https://timesketch.org/guides/admin/upgrade/ before starting the new instance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20240828 https://github.com/google/timesketch/releases/tag/20240828 Wed, 28 Aug 2024 15:58:07 GMT Timesketch 20240828 adds DFIQ v1.1 support, visualizations in stories, and new CLI timeline management commands. • Redesigned DFIQ card UI with AI query integration for investigative workflows. • Adds visualizations directly into stories, enabling richer narrative reporting. • Enables or disables DFIQ Scenarios via system settings. • Supports DFIQ v1.1 schema across the UI, API client, and backend. • API client now handles investigative questions and updated scenario listing/adding for DFIQ v1.1. • CLI tool gains timeline rename functionality. • CLI tool gains timeline delete command. • CLI tool gains timeline color-change command. • Visualization editor now supports timeline selection. Breaking changes: • Upgrading to this version requires a database upgrade (see https://timesketch.org/guides/admin/upgrade/). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20240717 https://github.com/google/timesketch/releases/tag/20240717 Thu, 18 Jul 2024 08:15:17 GMT Timesketch 20240717 adds ApexChart visualizations, a Natural Language to Query API, and CSV export for analyzer stats. • New ApexChart-based visualizations available in the UI for richer, interactive timeline charts. • New NL2Q API (Natural Language to Query) lets users query timelines using plain-language prompts, with an improved v2 prompt engine. • MISP analyzer updated with new detection capabilities. • Adds CSV export option to `tsctl analyzer-stats` for easier offline reporting. • Analyzer output now includes only tags created by the running analyzer, reducing noise. • Yeti Indicators analyzer updated with more precise SHA256 indicator queries and support for merging multiple intelligence attributes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20240508 https://github.com/google/timesketch/releases/tag/20240508 Wed, 08 May 2024 14:27:34 GMT Adds support for observables in Yeti analyzers and allows saving empty search results • Adds `Observables` support to the Yeti analyzer integration, enabling automatic analysis of discovered artifacts via the Yeti platform. • Allows saving searches that return zero results to the user's saved searches list. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20240328 https://github.com/google/timesketch/releases/tag/20240328 Thu, 28 Mar 2024 16:47:15 GMT Timesketch 20240328 adds a user profile/settings UI, DFIQ navigation overhaul, and precise field selection for searches • `run_analyzers` in the api client has been updated to allow triggering analyzers programmatically. • The `profile` tab in the web UI now supports user settings such as theme preferences. • DFIQ (Digital Forensics Intelligence Question) model gains a new dedicated navigation section. Breaking changes: • The database schema is modified and requires an upgrade before starting the service. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20240207 https://github.com/google/timesketch/releases/tag/20240207 Wed, 07 Feb 2024 16:35:34 GMT New user management API endpoints, LLM service integration, collapsable left panel, and optional TLS verification for the API client. • New API endpoints `GET /api/v1/users`, `POST /api/v1/users`, and `GET /api/v1/users/<user_id>` for user management • Adds collapsable left panel in the UI to reclaim workspace space Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20231206 https://github.com/google/timesketch/releases/tag/20231206 Wed, 06 Dec 2023 14:12:10 GMT Timesketch 20231206 adds 'Add to Threat Intelligence' context links, DFIQ context card highlighting, and CSV/e2e test infrastructure. • `Add to Threat Intelligence` action via context links allows analysts to tag indicators directly from event cards without navigating away. • Highlighting of the `DFIQ` context card improves visibility of framework-aligned metadata in timeline events. • API client now returns all fields for analysis sessions, enabling full state inspection in automation scripts. • Feature extraction config expanded to support `BITS` and `Terminal Services` logs, allowing structured data extraction from these Windows sources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20231025 https://github.com/google/timesketch/releases/tag/20231025 Wed, 25 Oct 2023 14:49:30 GMT Timesketch adds intelligence CLI command, Unfurl integration, and SMTP SSL/TLS support. • Adds `intelligence` command to the CLI client • New `Unfurl` integration for link previews • Adds SSL/TLS support and authentication for SMTP notifications Breaking changes: • Upgrading requires a database upgrade; follow the admin guide at https://timesketch.org/guides/admin/upgrade/. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20230913 https://github.com/google/timesketch/releases/tag/20230913 Wed, 13 Sep 2023 12:06:14 GMT Adds event attribute filters, CSV export, OpenSearch 2.x support, and Plaso formatter overrides to Timesketch • `tsctl` now includes timeline information in its output • Event attribute include / exclude filters for filtering analyzer results • OpenSearch 2.x support added as a backend option • Support overriding/extending Plaso formatter definitions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20230721 https://github.com/google/timesketch/releases/tag/20230721 Fri, 21 Jul 2023 11:57:16 GMT Timesketch adds `--output-format` CLI flag, JSON/tab output, analyze results in CLI, and sketch attribute management via CLI • Adds `--output-format` as a global CLI argument for specifying the output format (JSON or tab). • Adds support for JSON and tabular output formats in the CLI client. • Enables retrieving timesketch analyze results directly through the CLI client. • Adds commands to manage sketch attributes via the CLI client. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20230628 https://github.com/google/timesketch/releases/tag/20230628 Wed, 28 Jun 2023 13:08:01 GMT Timesketch 20230628 adds SSH/Windows bruteforce analyzers, DFIQ support, env-based settings, verbose analyzer output UI/API, and user-defined aggregation names • Adds SSH bruteforce analyzer to detect brute-force login attempts in timeline data. • Adds Windows bruteforce analyzer to detect brute-force login attempts on Windows systems. • Adds DFIQ (DFIR Investigation Query) support for standardized investigation queries. • Enables configuration via environment variables instead of only file-based settings (requires Flask 2.1+). • Supports verbose analyzer output in the UI and API, allowing richer metadata collection from analyzers. • Returns user-defined aggregation names when using the API client for aggregations. Breaking changes: • Environment variable-based configuration now available, but requires Flask 2.1+; if not met, settings may fail to load correctly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch https://github.com/google/timesketch/releases/tag/20230518 https://github.com/google/timesketch/releases/tag/20230518 Thu, 18 May 2023 11:58:15 GMT Timesketch adds Sigma API conversion, Prometheus metrics, search history, sketch attributes, and CLI client enhancements • `text --> sigma rule` API endpoint converts free-text queries into Sigma rules via the API. • Prometheus metric collection enabled for monitoring Timesketch service health. • CLI importer tool now accepts `provider` and `context` arguments to tag import sources. • Added `searchtemplate.py` module and API endpoints to manage search templates programmatically. • Data source DB model supports file size limits and generic CSV/JSON mappings for ingestion. • Timesketch CLI client adds support for saved searches, making them accessible via the command line. • Sketch attributes can now be viewed in a dynamic table component in the UI and managed via REST API. • Search history feature tracks previous search actions with metrics for analysis. • Interactive histogram available in the UI for temporal data exploration. • Search autocomplete and dropdown provided in the UI to aid query construction. • Clipboard copy functionality added to EventListRow and EventListRowDetail for rapid event export. • Support for SSL-only Elasticsearch connections (without username/password) is now available. • OIDC authentication can now use external providers by configuring `timesketch.conf`. • `tsctl.py` CLI script extended with commands to add users to a sketch. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/timesketch