Communitygithub.com

使用 Timesketch 构建入侵事件时间线

通过 Timesketch 构建协作式入侵取证时间线，用于数据摄取与分析。

使用 Timesketch 构建入侵事件时间线 是什么？

该技能指导用户使用 Google 的开源协作式取证时间线分析工具 Timesketch 构建入侵事件时间线。它详细介绍了 Timesketch 如何从端点、服务器和云服务中摄取日志和工件，并通过 Plaso（log2timeline）或直接 CSV/JSONL 导入，将数据归一化为统一的、可搜索的时间线，支持多种数据格式。技能涵盖了从 Docker 部署、数据摄取方法（Plaso、CSV、JSONL、Sigma 规则）到事件分析工作流（创建草图、运行分析器、搜索过滤、构建故事）的完整流程。此外，还重点说明了 API 自动化、多分析员协作以及与 Dissect 的集成等高级功能，并提供了关键数据源、MITRE ATT&CK 映射等实用参考，适用于安全团队进行全面的取证调查。

兼容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/building-incident-timeline-with-timesketch
查看原文→浏览所有技能

在你喜欢的 AI 中提问

打开一个已预加载此 Agent Skill 的新对话。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

文档

使用 Timesketch 构建入侵事件时间线 是做什么的？

概述

Timesketch 是 Google 开发的一款开源协作式取证时间线分析工具，使安全团队能够在事件调查过程中对来自多个来源的时序数据进行可视化和分析。它摄取来自端点、服务器和云服务的日志和工件，将其归一化为统一的、可搜索的时间线，并提供强大的分析能力，包括内置分析器、标记、草图注释和故事构建等功能。Timesketch 可与 Plaso (log2timeline) 集成进行工件解析，并支持直接 CSV/JSONL 导入，以便在活跃事件期间快速构建时间线。

何时使用

  • 需要在您的环境中部署或配置使用 Timesketch 构建入侵事件时间线的功能时
  • 需要建立与合规要求一致的安全控制时
  • 需要构建或改进此领域的安全架构时
  • 需要进行需要此实现的安全评估时

前提条件

  • 熟悉事件响应概念和工具
  • 能够访问测试或实验环境以安全执行
  • 已安装 Python 3.8+ 及所需的依赖项
  • 对任何测试活动具有适当的授权

架构与组件

核心组件

  • Timesketch 服务器：提供 REST API 的 Web 应用程序，用于时间线管理
  • OpenSearch/Elasticsearch：时间线事件的后端存储和搜索引擎
  • PostgreSQL：草图、故事和用户数据的元数据存储
  • Redis：后台处理的任务队列管理
  • Celery 工作进程：时间线上传和分析器的异步处理

数据流

证据来源 --> Plaso/log2timeline --> Plaso 存储文件 (.plaso)
     |                                           |
     v                                           v
  CSV/JSONL --> Timesketch 导入器 --> OpenSearch 索引
                                           |
                                           v
                                    Timesketch Web 界面
                                    (搜索、分析、故事)

部署

Docker 部署（推荐）

# 克隆 Timesketch 仓库
git clone https://github.com/google/timesketch.git
cd timesketch

# 运行部署辅助脚本
cd docker
sudo docker compose up -d

# 默认访问地址：https://localhost:443
# 管理员凭证在首次运行时生成

系统要求

  • 最低 8 GB 内存（大型调查建议 16+ GB）
  • 最少 4 个 CPU 核心
  • 为 OpenSearch 索引提供 SSD 存储
  • 已安装 Docker 和 Docker Compose

数据摄取方法

方法 1：Plaso 集成（全面）

# 使用 log2timeline 处理磁盘镜像
log2timeline.py --storage-file evidence.plaso /path/to/disk/image

# 处理 Windows 事件日志
log2timeline.py --parsers winevtx --storage-file windows_events.plaso /path/to/evtx/

# 处理多个证据来源
log2timeline.py --parsers "winevtx,prefetch,amcache,shimcache,userassist" \
  --storage-file full_analysis.plaso /path/to/mounted/image/

# 将 Plaso 文件导入 Timesketch
timesketch_importer -s "Case-2025-001" -t "Endpoint-WKS01" evidence.plaso

方法 2：CSV 导入（快速摄取）

message,datetime,timestamp_desc,source,hostname
"用户登录检测到","2025-01-15T08:30:00Z","事件记录","安全日志","DC01"
"PowerShell 执行","2025-01-15T08:31:15Z","事件记录","PowerShell","WKS042"

# 直接导入 CSV
timesketch_importer -s "Case-2025-001" -t "Quick-Triage" events.csv

方法 3：JSONL 导入（结构化数据）

{"message": "来自 10.1.2.3 的可疑登录", "datetime": "2025-01-15T08:30:00Z", "timestamp_desc": "事件记录", "source_short": "Security", "hostname": "DC01"}

方法 4：Sigma 规则集成

# 上传 Sigma 规则以自动检测
timesketch_importer --sigma-rules /path/to/sigma/rules/

分析工作流

步骤 1：创建调查草图

1. 登录 Timesketch Web 界面
2. 创建新草图（调查案例）
3. 向草图添加相关时间线
4. 设置草图描述和标签

步骤 2：运行内置分析器

Timesketch 包含能够自动识别以下内容的分析器：

  • 浏览器搜索分析器：从浏览器历史记录中提取搜索查询
  • 事件链分析器：关联相关事件（下载 -> 执行）
  • 域名分析器：提取并分类域名
  • 特征提取分析器：识别 IP、URL、哈希值
  • 地理位置分析器：将事件映射到地理位置
  • 相似性评分器：跨时间线查找相似事件
  • Sigma 分析器：将事件与 Sigma 检测规则匹配
  • 账户查找器：识别用户账户活动模式
  • 标记器：根据预定义规则应用标签

步骤 3：搜索和筛选

# Timesketch 查询语言中的搜索示例

# 查找与特定用户相关的所有事件
source_short:Security AND message:"john.admin"

# 查找 PowerShell 执行事件
data_type:"windows:evtx:record" AND event_identifier:4104

# 查找横向移动指标
source_short:Security AND event_identifier:4624 AND xml_string:"LogonType\">3"

# 查找特定时间范围内的事件
datetime:[2025-01-15T00:00:00 TO 2025-01-15T23:59:59]

# 查找文件创建事件
data_type:"fs:stat" AND timestamp_desc:"创建时间"

# 使用标签搜索
tag:"可疑" OR tag:"横向移动"

步骤 4：构建调查故事

1. 在草图中创建新故事
2. 添加支持每个发现的搜索视图
3. 使用调查员注释来注释关键事件
4. 将事件关联到 MITRE ATT&CK 技术
5. 按时间顺序记录攻击叙述
6. 导出故事以包含在事件报告中

高级功能

协作调查

  • 多名分析员可同时处理同一草图
  • 注释和注解持续存在于事件上
  • 保存的搜索可跨团队共享
  • 调查故事在上下文中记录发现

API 自动化

from timesketch_api_client import config
from timesketch_api_client import client as ts_client

# 连接到 Timesketch
ts = ts_client.TimesketchApi(
    host_uri="https://timesketch.local",
    username="analyst",
    password="password"
)

# 获取草图
sketch = ts.get_sketch(1)

# 搜索事件
search = sketch.explore(
    query_string='event_identifier:4624 AND LogonType:3',
    return_fields='datetime,message,hostname,source_short'
)

# 为事件添加标签
for event in search.get('objects', []):
    sketch.tag_event(event['_id'], ['lateral_movement'])

与 Dissect 集成

# 使用 Dissect 实现更快的工件解析（Plaso 的替代方案）
target-query -f timesketch://timesketch.local/case-001 \
  targets/hostname/ -q "windows.evtx" --limit 0

用于时间线构建的关键数据源

来源解析器证据价值
Windows 事件日志 (.evtx)winevtx身份验证、进程执行、服务
Prefetch 文件prefetch程序执行历史
MFT ($MFT)mft文件系统活动
注册表配置单元winreg系统配置、持久性
浏览器历史记录chrome/firefoxWeb 活动、下载
SyslogsyslogLinux/网络设备事件
CloudTrail 日志jsonlAWS API 活动
Azure 活动日志jsonlAzure 资源操作
防火墙日志csv/jsonl网络连接
代理日志csv/jsonlHTTP/HTTPS 流量

MITRE ATT&CK 映射

技术时间线指标
初始访问 (TA0001)首次恶意事件、收到钓鱼邮件
执行 (T1059)PowerShell/CMD 事件、进程创建
持久化 (TA0003)注册表修改、计划任务、服务
横向移动 (TA0008)远程登录、SMB 连接、RDP 会话
数据外泄 (TA0010)大量数据传输、云存储上传

参考

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target

achieving-cmmc-level-2-compliance

>-

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

analyzing-active-directory-acl-abuse

Detect dangerous ACL misconfigurations in Active Directory using ldap3

analyzing-android-malware-with-apktool

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.

analyzing-api-gateway-access-logs

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

analyzing-apt-group-with-mitre-navigator

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups

analyzing-azure-activity-logs-for-threats

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

analyzing-bootkit-and-rootkit-samples

Analyzes bootkit and advanced rootkit malware infecting the Master

analyzing-browser-forensics-with-hindsight

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user

analyzing-campaign-attribution-evidence

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

analyzing-certificate-transparency-for-phishing

Monitor Certificate Transparency logs using crt.sh and Certstream to

analyzing-cloud-storage-access-patterns

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

analyzing-cobalt-strike-beacon-configuration

Extract and analyze Cobalt Strike beacon configuration from PE files

analyzing-cobaltstrike-malleable-c2-profiles

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.

analyzing-command-and-control-communication

Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom

analyzing-cyber-kill-chain

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

analyzing-disk-image-with-autopsy

Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.

analyzing-dns-logs-for-exfiltration

Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

相关技能

steipete/video-frames

Extract frames or short clips from videos using ffmpeg.

community

steipete/summarize

Summarize or transcribe URLs, YouTube/videos, podcasts, articles, transcripts, PDFs, and local files.

community

openclaw/openclaw

Use when testing, fixing, or extending the OpenClaw Control UI GUI with Vitest + Playwright end-to-end checks, mocked Gateway WebSocket flows, mocked dashboard runs, screenshots/videos, or agent-verifiable browser proof.

community

obra/superpowers

Obra superpowers agent skills.

community

affaan-m/ECC

See, Understand, Act on video and audio. See- ingest from local files, URLs, RTSP/live feeds, or live record desktop; return realtime context and playable stream links. Understand- extract frames, build visual/semantic/temporal indexes, and search moments with timestamps and auto-clips. Act- transcode and normalize (codec, fps, resolution, aspect ratio), perform timeline edits (subtitles, text/image overlays, branding, audio overlays, dubbing, translation), generate media assets (image, audio...

community

affaan-m/everything-claude-code

End-to-end marketing campaign planning and execution. Covers audience research, positioning, campaign angle definition, landing page copy, email sequences, social posts, ad copy, short-form video scripts, and content calendars. Use as the orchestration layer for multi-channel product launches. Use when planning or executing a multi-channel product launch, or producing landing page, email, social, or ad copy.

community