时序图谱
原名：building-incident-timeline-with-timesketch
使用 Timesketch 构建协作式取证事件时间线，以进行数据摄入和分析。
- 分类
- 数据分析
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 0
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-22
- TRACE 评分
- 3.2 / 5
内容概览
Timesketch is an open-source collaborative forensic timeline analysis tool developed by Google that enables security teams to visualize and analyze chronological data from multiple sources during incident investigations. It ingests logs and artifacts from endpoints, servers, and cloud services, normalizes them into a unified searchable timeline, and provides powerful analysis capabilities including built-in analyzers, tagging, sketch annotations, and story building. Timesketch integrates with Plaso (log2timeline) for artifact parsing and supports direct CSV/JSONL ingestion for rapid timeline construction during active incidents. - When deploying or configuring building incident timeline with timesketch capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducti…