Communitygithub.com

使用 Timesketch 建立事件時間線

使用 Timesketch 建立協作式鑑識事件時間線，匯入並分析多種來源的日誌與數位證據。

使用 Timesketch 建立事件時間線 是什麼？

此技能說明如何使用 Google 開發的開源協作鑑識時間線分析工具 Timesketch，建立與分析事件時間線。Timesketch 能夠從端點、伺服器和雲端服務匯入日誌與數位跡證，將其標準化為統一的可搜尋時間線，並提供內建分析器、標記、草圖註釋與故事建構等功能，支援安全團隊在事件調查中進行可視化與時間序列分析。該工具整合了 Plaso (log2timeline) 進行跡證解析，也支援 CSV/JSONL 直接匯入，適合在活躍事件中快速建立時間線。支援 Docker 快速部署，可與 OpenSearch、PostgreSQL 及 Redis 等後端元件協作。進階功能包含協作調查、API 自動化，以及與 Dissect 工具的整合，進一步加速跡證解析。此技能適用於所有需要進行鑑識時間線分析的開發者與安全分析師，涵蓋從部署設定到實際調查的完整工作流程。

相容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/building-incident-timeline-with-timesketch
查看原文→瀏覽所有技能

在你喜歡的 AI 中提問

開啟一個已預先載入此 Agent Skill 的新對話。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

說明文件

使用 Timesketch 建立事件時間線 是做什麼的？

概述

Timesketch 是 Google 開發的開源協作式鑑識時間線分析工具，讓安全團隊在事件調查期間，能對來自多個來源的時序資料進行可視化與分析。它匯入端點、伺服器與雲端服務的日誌與數位跡證，將其標準化為統一的可搜尋時間線，並提供強大的分析能力，包括內建分析器、標記、草圖註釋與故事建構。Timesketch 可與 Plaso (log2timeline) 整合進行跡證解析，也支援直接 CSV/JSONL 匯入，以便在活躍事件中快速建立時間線。

使用時機

  • 當您需要部署或設定使用 Timesketch 建立事件時間線的功能時
  • 當您需建立符合合規要求的安全控制措施時
  • 當您要建構或改善此領域的安全架構時
  • 當您執行需要此實作的安全評估時

先決條件

  • 熟悉事件應變概念與工具
  • 具備可安全執行的測試或實驗環境
  • Python 3.8+ 與所需相依套件
  • 具備執行測試活動的適當授權

架構與元件

核心元件

  • Timesketch 伺服器：提供 REST API 的網頁應用程式，用於管理時間線
  • OpenSearch/Elasticsearch：時間線事件的後端儲存與搜尋引擎
  • PostgreSQL：儲存草圖、故事與使用者資料的中繼資料庫
  • Redis：背景工作的任務佇列管理
  • Celery Workers：非同步處理時間線上傳與分析器

資料流程

證據來源 --> Plaso/log2timeline --> Plaso 儲存檔 (.plaso)
     |                                           |
     v                                           v
  CSV/JSONL --> Timesketch 匯入程式 --> OpenSearch 索引
                                           |
                                           v
                                    Timesketch 網頁介面
                                    (搜尋、分析、故事)

部署

Docker 部署 (建議)

# 複製 Timesketch 儲存庫
git clone https://github.com/google/timesketch.git
cd timesketch

# 執行部署輔助腳本
cd docker
sudo docker compose up -d

# 預設存取：https://localhost:443
# 首次執行時會產生管理員憑證

系統需求

  • 至少 8 GB RAM (大型調查建議 16+ GB)
  • 至少 4 個 CPU 核心
  • OpenSearch 索引需使用 SSD 儲存
  • 已安裝 Docker 與 Docker Compose

資料匯入方法

方法一：Plaso 整合 (全面性)

# 使用 log2timeline 處理磁碟映像檔
log2timeline.py --storage-file evidence.plaso /path/to/disk/image

# 處理 Windows 事件日誌
log2timeline.py --parsers winevtx --storage-file windows_events.plaso /path/to/evtx/

# 處理多個證據來源
log2timeline.py --parsers "winevtx,prefetch,amcache,shimcache,userassist" \
  --storage-file full_analysis.plaso /path/to/mounted/image/

# 將 Plaso 檔案匯入 Timesketch
timesketch_importer -s "Case-2025-001" -t "Endpoint-WKS01" evidence.plaso

方法二：CSV 匯入 (快速匯入)

message,datetime,timestamp_desc,source,hostname
"偵測到使用者登入","2025-01-15T08:30:00Z","事件記錄","安全性記錄","DC01"
"PowerShell 執行","2025-01-15T08:31:15Z","事件記錄","PowerShell","WKS042"

# 直接匯入 CSV
timesketch_importer -s "Case-2025-001" -t "Quick-Triage" events.csv

方法三：JSONL 匯入 (結構化資料)

{"message": "來自 10.1.2.3 的可疑登入", "datetime": "2025-01-15T08:30:00Z", "timestamp_desc": "事件記錄", "source_short": "安全性", "hostname": "DC01"}

方法四：Sigma 規則整合

# 上傳 Sigma 規則以進行自動偵測
timesketch_importer --sigma-rules /path/to/sigma/rules/

分析工作流程

步驟 1：建立調查草圖

1. 登入 Timesketch 網頁介面
2. 建立新的草圖 (調查案件)
3. 將相關時間線加入草圖
4. 設定草圖描述與標籤

步驟 2：執行內建分析器

Timesketch 包含可自動識別以下項目的分析器：

  • 瀏覽器搜尋分析器：從瀏覽器歷史記錄中擷取搜尋查詢
  • 事件鏈分析器：連結相關事件 (如下載 -> 執行)
  • 網域分析器：擷取與分類網域名稱
  • 特徵提取分析器：識別 IP、URL、雜湊值
  • 地理位置分析器：將事件對應到地理位置
  • 相似度評分器：尋找跨時間線的相似事件
  • Sigma 分析器：比對事件與 Sigma 偵測規則
  • 帳號尋找器：識別使用者帳號活動模式
  • 標籤工具：根據預先定義規則套用標籤

步驟 3：搜尋與篩選

# 以 Timesketch 查詢語言搜尋的範例

# 尋找與特定使用者相關的所有事件
source_short:Security AND message:"john.admin"

# 尋找 PowerShell 執行事件
data_type:"windows:evtx:record" AND event_identifier:4104

# 尋找橫向移動跡象
source_short:Security AND event_identifier:4624 AND xml_string:"LogonType\">3"

# 尋找特定時間範圍內的事件
datetime:[2025-01-15T00:00:00 TO 2025-01-15T23:59:59]

# 尋找檔案建立事件
data_type:"fs:stat" AND timestamp_desc:"建立時間"

# 使用標籤搜尋
tag:"可疑" OR tag:"橫向移動"

步驟 4：建立調查故事

1. 在草圖中建立新的故事
2. 加入支援每個發現的搜尋檢視
3. 在關鍵事件上加入調查人員註釋
4. 將事件連結到 MITRE ATT&CK 技術
5. 按時間順序記錄攻擊敘述
6. 匯出故事以納入事件報告

進階功能

協作調查

  • 多位分析師可以同時處理同一個草圖
  • 評論與註釋會持續保留在事件上
  • 已儲存的搜尋可在團隊間共用
  • 調查故事可在脈絡中記錄發現

API 自動化

from timesketch_api_client import config
from timesketch_api_client import client as ts_client

# 連線到 Timesketch
ts = ts_client.TimesketchApi(
    host_uri="https://timesketch.local",
    username="analyst",
    password="password"
)

# 取得草圖
sketch = ts.get_sketch(1)

# 搜尋事件
search = sketch.explore(
    query_string='event_identifier:4624 AND LogonType:3',
    return_fields='datetime,message,hostname,source_short'
)

# 為事件加入標籤
for event in search.get('objects', []):
    sketch.tag_event(event['_id'], ['lateral_movement'])

與 Dissect 整合

# 使用 Dissect 加速跡證解析 (Plaso 的替代方案)
target-query -f timesketch://timesketch.local/case-001 \
  targets/hostname/ -q "windows.evtx" --limit 0

建立時間線的主要資料來源

來源解析器證據價值
Windows 事件日誌 (.evtx)winevtx驗證、程序執行、服務
Prefetch 檔案prefetch程式執行記錄
MFT ($MFT)mft檔案系統活動
登錄檔winreg系統設定、持續性
瀏覽器歷史記錄chrome/firefox網頁活動、下載
SyslogsyslogLinux/網路設備事件
CloudTrail 日誌jsonlAWS API 活動
Azure 活動日誌jsonlAzure 資源操作
防火牆日誌csv/jsonl網路連線
Proxy 日誌csv/jsonlHTTP/HTTPS 流量

MITRE ATT&CK 對應

技術時間線指標
初始存取 (TA0001)首次惡意事件、收到釣魚郵件
執行 (T1059)PowerShell/CMD 事件、程序建立
持續性 (TA0003)登錄檔修改、排程工作、服務
橫向移動 (TA0008)遠端登入、SMB 連線、RDP 工作階段
資料外洩 (TA0010)大量資料傳輸、雲端儲存上傳

參考資料

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target

achieving-cmmc-level-2-compliance

>-

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

analyzing-active-directory-acl-abuse

Detect dangerous ACL misconfigurations in Active Directory using ldap3

analyzing-android-malware-with-apktool

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.

analyzing-api-gateway-access-logs

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

analyzing-apt-group-with-mitre-navigator

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups

analyzing-azure-activity-logs-for-threats

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

analyzing-bootkit-and-rootkit-samples

Analyzes bootkit and advanced rootkit malware infecting the Master

analyzing-browser-forensics-with-hindsight

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user

analyzing-campaign-attribution-evidence

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

analyzing-certificate-transparency-for-phishing

Monitor Certificate Transparency logs using crt.sh and Certstream to

analyzing-cloud-storage-access-patterns

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

analyzing-cobalt-strike-beacon-configuration

Extract and analyze Cobalt Strike beacon configuration from PE files

analyzing-cobaltstrike-malleable-c2-profiles

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.

analyzing-command-and-control-communication

Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom

analyzing-cyber-kill-chain

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

analyzing-disk-image-with-autopsy

Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.

analyzing-dns-logs-for-exfiltration

Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

相關技能

steipete/video-frames

Extract frames or short clips from videos using ffmpeg.

community

steipete/summarize

Summarize or transcribe URLs, YouTube/videos, podcasts, articles, transcripts, PDFs, and local files.

community

openclaw/openclaw

Use when testing, fixing, or extending the OpenClaw Control UI GUI with Vitest + Playwright end-to-end checks, mocked Gateway WebSocket flows, mocked dashboard runs, screenshots/videos, or agent-verifiable browser proof.

community

obra/superpowers

Obra superpowers agent skills.

community

affaan-m/ECC

See, Understand, Act on video and audio. See- ingest from local files, URLs, RTSP/live feeds, or live record desktop; return realtime context and playable stream links. Understand- extract frames, build visual/semantic/temporal indexes, and search moments with timestamps and auto-clips. Act- transcode and normalize (codec, fps, resolution, aspect ratio), perform timeline edits (subtitles, text/image overlays, branding, audio overlays, dubbing, translation), generate media assets (image, audio...

community

affaan-m/everything-claude-code

End-to-end marketing campaign planning and execution. Covers audience research, positioning, campaign angle definition, landing page copy, email sequences, social posts, ad copy, short-form video scripts, and content calendars. Use as the orchestration layer for multi-channel product launches. Use when planning or executing a multi-channel product launch, or producing landing page, email, social, or ad copy.

community