Timesketch Versions Save

Collaborative forensic timeline analysis

20240328

1 month ago

Note Upgrading to this Timesketch version requires a database upgrade! See https://timesketch.org/guides/admin/upgrade/ for more details.

What's Changed

DFIQ new UI and navigation by @berggren in https://github.com/google/timesketch/pull/3041
User profile and settings support by @berggren in https://github.com/google/timesketch/pull/3048
Enhancements to Yeti indicators by @tomchop in https://github.com/google/timesketch/pull/3038
More precise field selection when searching by @tomchop in https://github.com/google/timesketch/pull/3044
Use subqueryload to make loading events with comments faster by @tomchop in https://github.com/google/timesketch/pull/3049
Improvements to the sigma handling by @tomchop in https://github.com/google/timesketch/pull/3050
Update run_analyzers in the api client by @jkppr in https://github.com/google/timesketch/pull/3037
Fix a bug in the feature_extraction analyzer by @jkppr in https://github.com/google/timesketch/pull/3047

Full Changelog: https://github.com/google/timesketch/compare/20240207...20240328

20240207

3 months ago

What's Changed

Collapsable left panel by @berggren in https://github.com/google/timesketch/pull/3008
Support for Large Language Model (LLM) services by @berggren in https://github.com/google/timesketch/pull/3019
Implement user management (create, list, get) via API by @lo-chr in https://github.com/google/timesketch/pull/3024
Setup frontend unit tests with vitest by @Annoraaq in https://github.com/google/timesketch/pull/3013
Fix failing Plaso uploads after 6 months by @jkppr in https://github.com/google/timesketch/pull/3017
Fix error handling in the API client by @jkppr in https://github.com/google/timesketch/pull/3006
Add optional TLS verification by @tomchop in https://github.com/google/timesketch/pull/3016
Yeti analyzer fix: use session object by @tomchop in https://github.com/google/timesketch/pull/3020
Adjust query for Yeti indicators by @tomchop in https://github.com/google/timesketch/pull/3009
Mark events with indicator's relevant_tags (Yeti) by @tomchop in https://github.com/google/timesketch/pull/3022
Bump cryptography from 41.0.4 to 41.0.6 by @dependabot in https://github.com/google/timesketch/pull/2998
SQLalchemy upgrade - step one by @berggren in https://github.com/google/timesketch/pull/2979
Fix: get and use access token for Yeti by @tomchop in https://github.com/google/timesketch/pull/3010
Adding form validation to prevent names > 255 char. by @jkppr in https://github.com/google/timesketch/pull/3026
Update black formatting by @jkppr in https://github.com/google/timesketch/pull/3031
Timesketch API client: Adding type check to prevent error. by @jkppr in https://github.com/google/timesketch/pull/3030
Fix double escaping in sigma_util causing yaml.parser.ParserError by @lo-chr in https://github.com/google/timesketch/pull/3028
Move "old UI" button by @jkppr in https://github.com/google/timesketch/pull/3033
UI build 20240207 by @jkppr in https://github.com/google/timesketch/pull/3035

New Contributors

@lo-chr made their first contribution in https://github.com/google/timesketch/pull/3028

Full Changelog: https://github.com/google/timesketch/compare/20231206...20240207

20231206

5 months ago

What's Changed

Left panel timeline management by @Annoraaq in https://github.com/google/timesketch/pull/2999
Extract Windows event logs messages attributes by @roshanmaskey in https://github.com/google/timesketch/pull/2910
API client: Return all field for analysis sessions by @tomchop in https://github.com/google/timesketch/pull/2504
Highlight DFIQ context card by @berggren in https://github.com/google/timesketch/pull/2996
Introduce (large) CSV import in e2e tests by @jaegeral in https://github.com/google/timesketch/pull/2912
"Add to Threat Intelligence" via context links by @jkppr in https://github.com/google/timesketch/pull/2980
Graph bug and layout fix by @berggren in https://github.com/google/timesketch/pull/2994
Feature extraction config for BITS and Terminal Services by @roshanmaskey in https://github.com/google/timesketch/pull/2974
Adjust default example text for yeti endpoint by @tomchop in https://github.com/google/timesketch/pull/2963
Adding a copy action to filter chips by @JohannesLks in https://github.com/google/timesketch/pull/2990
Update to the windows deployment script by @coloradosarge in https://github.com/google/timesketch/pull/3000
Adding and updating tooltips for icons by @jkppr in https://github.com/google/timesketch/pull/2983
Fix hidden text by @jkppr in https://github.com/google/timesketch/pull/2965
bug-fix for context links by @jkppr in https://github.com/google/timesketch/pull/2962
Update for upgrade documentation by @jkppr in https://github.com/google/timesketch/pull/2967
Removing old feature extractor analyzer by @jkppr in https://github.com/google/timesketch/pull/2969
Update for the context_links documentation by @jkppr in https://github.com/google/timesketch/pull/2970
Updating the feature extraction analyzer documentation by @jkppr in https://github.com/google/timesketch/pull/2973
[tests] Add jsonl e2e tests by @jaegeral in https://github.com/google/timesketch/pull/2976
Fix vue dependency issues with "v-calendar" by @jkppr in https://github.com/google/timesketch/pull/2989
Mute noisy info logging in the feature extraction analyzer by @jkppr in https://github.com/google/timesketch/pull/2993
New empty-state and left panel bugfix by @berggren in https://github.com/google/timesketch/pull/2991
Update the analyzer timeline picker by @jkppr in https://github.com/google/timesketch/pull/3001
UI build 20231206 by @jkppr in https://github.com/google/timesketch/pull/3002

New Contributors

@JohannesLks made their first contribution in https://github.com/google/timesketch/pull/2990
@coloradosarge made their first contribution in https://github.com/google/timesketch/pull/3000

Full Changelog: https://github.com/google/timesketch/compare/20231025...20231206

20231025

6 months ago

Note Upgrading to this Timesketch version requires a database upgrade! See https://timesketch.org/guides/admin/upgrade/ for more details.

What's Changed

filter chip fixes by @jkppr in https://github.com/google/timesketch/pull/2893
Adding multi analyzer result support by @jkppr in https://github.com/google/timesketch/pull/2894
Fix CSV upload without timestamp_desc by @jkppr in https://github.com/google/timesketch/pull/2896
Bump cryptography from 41.0.3 to 41.0.4 by @dependabot in https://github.com/google/timesketch/pull/2904
Deprecate Sigma status CSV usage from code by @jaegeral in https://github.com/google/timesketch/pull/2913
Add intelligence command to the CLI client by @jaegeral in https://github.com/google/timesketch/pull/2864
UI build 2023-10-05 by @jkppr in https://github.com/google/timesketch/pull/2926
Fix missing plaso_formatters by @jkppr in https://github.com/google/timesketch/pull/2933
Refactor base layout by @berggren in https://github.com/google/timesketch/pull/2929
ui build 20231010 by @jkppr in https://github.com/google/timesketch/pull/2934
Fix #2908 tagger bug by @jkppr in https://github.com/google/timesketch/pull/2935
Update yeti analyzer by @tomchop in https://github.com/google/timesketch/pull/2930
Adjusting regular expressions for features extraction by @tomchop in https://github.com/google/timesketch/pull/2932
[Documentation] timesketch_client.TimesketchApi in api client documentation by @jaegeral in https://github.com/google/timesketch/pull/2938
Improvements to the Yeti analyzer by @tomchop in https://github.com/google/timesketch/pull/2942
Truncate timeline names in analyzer results by @jkppr in https://github.com/google/timesketch/pull/2945
API client method to delete Sigma rule by @jaegeral in https://github.com/google/timesketch/pull/2924
Fix missing sketchId in Search.vue by @jkppr in https://github.com/google/timesketch/pull/2955
Unfurl integration by @jkppr in https://github.com/google/timesketch/pull/2897
Copy saved search ID by @jkppr in https://github.com/google/timesketch/pull/2956
Support emojis in new UI by @NightAcrobat777 in https://github.com/google/timesketch/pull/2951
SSL/TLS support and authentication for SMTP by @fazledyn-or in https://github.com/google/timesketch/pull/2940
Instantiate side panel only once by @berggren in https://github.com/google/timesketch/pull/2949
Unit test to ensure invalid timestamp conversions do not occur by @bwhelan212 in https://github.com/google/timesketch/pull/2954
Add DFIQ context to SearchHistory by @berggren in https://github.com/google/timesketch/pull/2957
Sanitise HTML from Unfurl by @berggren in https://github.com/google/timesketch/pull/2959
Context link backwards compatibility & sanitation by @jkppr in https://github.com/google/timesketch/pull/2958
UI build 2023-10-25 by @jkppr in https://github.com/google/timesketch/pull/2960

New Contributors

@NightAcrobat777 made their first contribution in https://github.com/google/timesketch/pull/2951
@fazledyn-or made their first contribution in https://github.com/google/timesketch/pull/2940
@bwhelan212 made their first contribution in https://github.com/google/timesketch/pull/2954

Full Changelog: https://github.com/google/timesketch/compare/20230913...20231025

20230913

7 months ago

What's Changed

[Analyzers] Spelling errors by @jaegeral in https://github.com/google/timesketch/pull/2860
correct paramters in cli attributes method by @jaegeral in https://github.com/google/timesketch/pull/2863
Update troubleshooting.md by @jaegeral in https://github.com/google/timesketch/pull/2866
adding timeline info to the tsctl by @jaegeral in https://github.com/google/timesketch/pull/2870
Feature extraction for TI data in "Windows-Bits-Client" events by @jkppr in https://github.com/google/timesketch/pull/2873
Update Date chip to support milliseconds by @sydp in https://github.com/google/timesketch/pull/2867
Allow API port to listen on localhost by @tomchop in https://github.com/google/timesketch/pull/2875
Loading indicator active analyzers by @Annoraaq in https://github.com/google/timesketch/pull/2855
OpenSearch 2.x support by @berggren in https://github.com/google/timesketch/pull/2876
ui build 20230831 by @jkppr in https://github.com/google/timesketch/pull/2878
Bump cryptography from 41.0.2 to 41.0.3 by @dependabot in https://github.com/google/timesketch/pull/2858
Add TTY check for providing missing config values by @ramo-j in https://github.com/google/timesketch/pull/2850
Don't exit with error if user chooses not to start timesketch by @pemontto in https://github.com/google/timesketch/pull/2857
Export query result to CSV by @berggren in https://github.com/google/timesketch/pull/2882
Run analyzers only once per timeline by @jkppr in https://github.com/google/timesketch/pull/2883
Support overriding/extending Plaso formatter definitions by @berggren in https://github.com/google/timesketch/pull/2881
New UI build (automated) by @berggren in https://github.com/google/timesketch/pull/2884
Tag list refactor & bug fixes by @jkppr in https://github.com/google/timesketch/pull/2886
Event attribute include / exclude filters by @jkppr in https://github.com/google/timesketch/pull/2888
refactor verbose analyzer output by @jkppr in https://github.com/google/timesketch/pull/2885
Analyzer Output UI update by @jkppr in https://github.com/google/timesketch/pull/2887
Adding tag filter chips to sigma rules by @jkppr in https://github.com/google/timesketch/pull/2890
Search History graph cleanup by @berggren in https://github.com/google/timesketch/pull/2891
UI build 20230913 by @jkppr in https://github.com/google/timesketch/pull/2892

Full Changelog: https://github.com/google/timesketch/compare/20230721...20230913

20230721

9 months ago

What's Changed

fixes #2809 UI bug by @jkppr in https://github.com/google/timesketch/pull/2810
Timeline and Scenarios fixes + small UI fixes by @berggren in https://github.com/google/timesketch/pull/2808
Show selected event in context view by @berggren in https://github.com/google/timesketch/pull/2811
Consitent forms and cleaned up XML viewer by @berggren in https://github.com/google/timesketch/pull/2812
Remove ports from e2e-tests by @berggren in https://github.com/google/timesketch/pull/2816
Update Account Finder Analyzer by @jkppr in https://github.com/google/timesketch/pull/2803
Delete sketch and list archived sketches by @berggren in https://github.com/google/timesketch/pull/2817
Add json and tab output to CLI client by @jaegeral in https://github.com/google/timesketch/pull/2818
[CLI] Add output-format as cli wide argument by @jaegeral in https://github.com/google/timesketch/pull/2819
Update hashR analyzer by @jkppr in https://github.com/google/timesketch/pull/2820
[CLI] refactor to use central output-format by @jaegeral in https://github.com/google/timesketch/pull/2821
Support OpenSearch queries in DFIQ by @berggren in https://github.com/google/timesketch/pull/2822
Add Windows Lateral Movement DFIQ scenario by @berggren in https://github.com/google/timesketch/pull/2823
Adding hashR user documentation by @jkppr in https://github.com/google/timesketch/pull/2824
New UI build by @berggren in https://github.com/google/timesketch/pull/2828
Update tsdev.sh to add creation of api client and cli client by @jaegeral in https://github.com/google/timesketch/pull/2830
fix mkdocs warnings by @jkppr in https://github.com/google/timesketch/pull/2832
fix docs formatting by @jkppr in https://github.com/google/timesketch/pull/2833
Add a test case for conditions with multiple words in a Sigma rule by @jaegeral in https://github.com/google/timesketch/pull/2835
Always set active timelines by @berggren in https://github.com/google/timesketch/pull/2838
Preserve user defined filters by @berggren in https://github.com/google/timesketch/pull/2840
Support event list sorting (asc/desc) by @berggren in https://github.com/google/timesketch/pull/2843
Rework comments by @jkppr in https://github.com/google/timesketch/pull/2845
Upgrade to PyYAML 6.0.1 and NodeJS 18 by @berggren in https://github.com/google/timesketch/pull/2853
Bump cryptography from 41.0.0 to 41.0.2 by @dependabot in https://github.com/google/timesketch/pull/2844
Documentation updates for analyzers by @jkppr in https://github.com/google/timesketch/pull/2851
Add timesketch analyze results to the CLI client by @jaegeral in https://github.com/google/timesketch/pull/2846
Manage sketch attributes in the CLI client by @jaegeral in https://github.com/google/timesketch/pull/2841
New UI build and update version numbers by @berggren in https://github.com/google/timesketch/pull/2854

Full Changelog: https://github.com/google/timesketch/compare/20230628...20230721

20230628

10 months ago

What's Changed

Update changelog by @berggren in https://github.com/google/timesketch/pull/2768
Scenarios model refactor by @berggren in https://github.com/google/timesketch/pull/2672
Ssh bruteforce analyzer by @roshanmaskey in https://github.com/google/timesketch/pull/2769
Add missing dependency for e2e container by @berggren in https://github.com/google/timesketch/pull/2783
🐛 Handle None response from ip2geo by @pemontto in https://github.com/google/timesketch/pull/2770
Fix #2784 - pandas.read_csv arguments by @jkppr in https://github.com/google/timesketch/pull/2785
Add tzdata to all container builds by @berggren in https://github.com/google/timesketch/pull/2788
Fix for #2738 - Analyzer not in AnalyzerList by @jkppr in https://github.com/google/timesketch/pull/2786
Fixing #2393 - analysis of broken timelines by @jkppr in https://github.com/google/timesketch/pull/2787
Helm k8s by @wajihyassine in https://github.com/google/timesketch/pull/2661
Enable settings from environment (needs Flask 2.1+) by @bpereto in https://github.com/google/timesketch/pull/2417
Add 🐀 emoji for remote access tools by @pemontto in https://github.com/google/timesketch/pull/2779
Switch to Compose V2 by @koromodako in https://github.com/google/timesketch/pull/2654
Return user defined aggregation name when using the API client by @sydp in https://github.com/google/timesketch/pull/2507
Bump cryptography from 39.0.1 to 41.0.0 by @dependabot in https://github.com/google/timesketch/pull/2778
Bump pyjwt from 1.7.1 to 2.4.0 by @dependabot in https://github.com/google/timesketch/pull/2192
Update Helm README to refer to OSDFIR Infrastructure by @wajihyassine in https://github.com/google/timesketch/pull/2790
DFIQ support by @berggren in https://github.com/google/timesketch/pull/2782
Fix for importing small JSONL files by @berggren in https://github.com/google/timesketch/pull/2793
Restyle timeline chips by @Annoraaq in https://github.com/google/timesketch/pull/2777
Windows bruteforce analyzer by @roshanmaskey in https://github.com/google/timesketch/pull/2792
Automate verbose analyzer output metadata collection by @jkppr in https://github.com/google/timesketch/pull/2798
Update the event tags UI by @jkppr in https://github.com/google/timesketch/pull/2805
UI support for verbose analyzer output by @jkppr in https://github.com/google/timesketch/pull/2797
New UI build (automated) by @berggren in https://github.com/google/timesketch/pull/2806

New Contributors

@bpereto made their first contribution in https://github.com/google/timesketch/pull/2417
@koromodako made their first contribution in https://github.com/google/timesketch/pull/2654

Full Changelog: https://github.com/google/timesketch/compare/20230526...20230628

20230526

11 months ago

Version 20230526

What's Changed

Minor fixes/updates for AggregateDialog by @sydp in https://github.com/google/timesketch/pull/2726
Implicit String Fix by @LX5321 in https://github.com/google/timesketch/pull/2650
🐛 Fix invalid sigma YAML by @pemontto in https://github.com/google/timesketch/pull/2757
Ensure that upload path is valid by @berggren in https://github.com/google/timesketch/pull/2763
Update to Flask 2.3.x and dependencies by @berggren in https://github.com/google/timesketch/pull/2764
New UI build (auto generated) by @berggren in https://github.com/google/timesketch/pull/2767

New Contributors

@LX5321 made their first contribution in https://github.com/google/timesketch/pull/2650

Full Changelog: https://github.com/google/timesketch/compare/20230518...20230526

20230518

11 months ago

20210224

3 years ago

Release 20210224

What's Changed

Various updates to the API Client by @kiddinn in https://github.com/google/timesketch/pull/1542
Update SearchQueryGuide views by @jaegeral in https://github.com/google/timesketch/pull/1550
Fix remove_timeline_label() permission check by @rgayon in https://github.com/google/timesketch/pull/1544
Changes to dpkg configuration for release by @joachimmetz in https://github.com/google/timesketch/pull/1546
Adding additional sleep to e2e tests. by @kiddinn in https://github.com/google/timesketch/pull/1551
Move stories to metadata by @berggren in https://github.com/google/timesketch/pull/1552
Bugfix: Handle system generated stories by @berggren in https://github.com/google/timesketch/pull/1553
Update Axios package by @berggren in https://github.com/google/timesketch/pull/1554
Misc UI fixes by @berggren in https://github.com/google/timesketch/pull/1555
Timesketch summit 2021 by @jaegeral in https://github.com/google/timesketch/pull/1557
Changes to API and API client by @kiddinn in https://github.com/google/timesketch/pull/1562
Added new IP address related feature extractors by @itsmvd in https://github.com/google/timesketch/pull/1563
Minor API client changes by @kiddinn in https://github.com/google/timesketch/pull/1566
First phase of new way of storing data in TS. by @kiddinn in https://github.com/google/timesketch/pull/1565
corrects README doc link to Sigma by @ghchinoy in https://github.com/google/timesketch/pull/1571
hyphen error in readme by @neilgoyal in https://github.com/google/timesketch/pull/1572
New storage - UI fix [phase one] by @berggren in https://github.com/google/timesketch/pull/1573
Adding datetime limits on the aggregation bucket. by @kiddinn in https://github.com/google/timesketch/pull/1568
Changing __timeline_id to __ts_timeline_id and fixing build_query by @kiddinn in https://github.com/google/timesketch/pull/1574
Adding the ability to check whether a given index has __timeline_id in it. by @kiddinn in https://github.com/google/timesketch/pull/1569
New build and DSL bugfix by @berggren in https://github.com/google/timesketch/pull/1575
New storage - UI fix for counting documents by @berggren in https://github.com/google/timesketch/pull/1576
UI: Dedicated analysis tab by @berggren in https://github.com/google/timesketch/pull/1577
Simplified regex for IPv4 features by @itsmvd in https://github.com/google/timesketch/pull/1581
Small bugfix in SSH features regex by @itsmvd in https://github.com/google/timesketch/pull/1582
UI: Timeline tab and removing ability to add old indices to sketches by @berggren in https://github.com/google/timesketch/pull/1583
UI: Move aggregations to its own tab by @berggren in https://github.com/google/timesketch/pull/1584
Bugfix: Wrong query count for new style timelines by @berggren in https://github.com/google/timesketch/pull/1585
Index Change: Changed plaso file ingestion, added query_dsl support and analyzer support by @kiddinn in https://github.com/google/timesketch/pull/1578
UI: Set status on timeline by @berggren in https://github.com/google/timesketch/pull/1587
UI: Add loading spinner while searching by @berggren in https://github.com/google/timesketch/pull/1589
Adding timeline supports into aggregations. by @kiddinn in https://github.com/google/timesketch/pull/1588
Updated e2e tests after plaso change and the run_plaso task to match and added timeline_id support to graphs by @kiddinn in https://github.com/google/timesketch/pull/1590
UI: Support index and time range filters in aggregations by @berggren in https://github.com/google/timesketch/pull/1592
Moved docker configs to the dev GIFT PPA by @kiddinn in https://github.com/google/timesketch/pull/1595
Deprecated the option to import timelines in tsctl. by @kiddinn in https://github.com/google/timesketch/pull/1594
Fixed a minor issue with Docker files by @kiddinn in https://github.com/google/timesketch/pull/1599
UI: Shifted filter buttons & added button titles by @binglot in https://github.com/google/timesketch/pull/1597
Fixed #1600 by adding mappings to deployment script. by @kiddinn in https://github.com/google/timesketch/pull/1601
Bump cryptography from 3.3.1 to 3.3.2 by @dependabot in https://github.com/google/timesketch/pull/1604
Extract IP address from RdpCoreTS event logs by @itsmvd in https://github.com/google/timesketch/pull/1605
Upgraded the importer version by @kiddinn in https://github.com/google/timesketch/pull/1606
Add .venv to .gitignore by @jaegeral in https://github.com/google/timesketch/pull/1608
Set correct timeline for analysis pipeline by @berggren in https://github.com/google/timesketch/pull/1613
UI: Fix missing timeline color by @berggren in https://github.com/google/timesketch/pull/1612
UI: Cleanup formatting by @berggren in https://github.com/google/timesketch/pull/1614
Fixed few issues: large text file imports, aggregations failing and upgrading PPA in docker files by @kiddinn in https://github.com/google/timesketch/pull/1610
Add ESLint GH action by @berggren in https://github.com/google/timesketch/pull/1616
Fixed issues with running analyzers in API client. by @kiddinn in https://github.com/google/timesketch/pull/1623
Minor bug fixes. by @kiddinn in https://github.com/google/timesketch/pull/1625
UI: Fix wrong timeline id in aggregations by @berggren in https://github.com/google/timesketch/pull/1624
Issue when removing timeline with a shared index by @kiddinn in https://github.com/google/timesketch/pull/1626
Added more error handling into the API, as well as retry to flushing events queue. by @kiddinn in https://github.com/google/timesketch/pull/1627
adding concepts and API dev guide by @jaegeral in https://github.com/google/timesketch/pull/1618
Increased timeout value for bulk inserts by default, also made it configurable. by @kiddinn in https://github.com/google/timesketch/pull/1628
Update docker-compose.yml by @berggren in https://github.com/google/timesketch/pull/1631
Update ES version for release docker by @berggren in https://github.com/google/timesketch/pull/1632
Update pylint by @berggren in https://github.com/google/timesketch/pull/1635
Pinned pylint version by @kiddinn in https://github.com/google/timesketch/pull/1636
Pinned astroid to version 2.4.0 in linter action by @kiddinn in https://github.com/google/timesketch/pull/1637
Spelling in some files comments by @jaegeral in https://github.com/google/timesketch/pull/1634
Release 20210224 by @berggren in https://github.com/google/timesketch/pull/1638

New Contributors

@ghchinoy made their first contribution in https://github.com/google/timesketch/pull/1571
@neilgoyal made their first contribution in https://github.com/google/timesketch/pull/1572

Full Changelog: https://github.com/google/timesketch/compare/20201229...20210224