plaso psort

psort.py -o l2tcsv plaso.dump > timeline.csv

Filter and format the plaso store with psort, generating the incident window CSV timeline.

Run it on plaso.dump (111) when you need the readable timeline: psort filters by time (the incident window), by event type or path, and formats the output (l2tcsv, or analysis formats like JSON timeline). The result is the CSV with each event, its timestamp, source and detail — the case timeline that is filtered, sorted and reviewed. In IR, psort is where the analyst works: filtering by the attack window reduces 1.2M events to the relevant hundreds, and the resulting timeline is the backbone of the report.

Do not use it without having generated the store: psort processes plaso.dump, not raw evidence — the extraction step (log2timeline) comes first. Poorly defined filters (wrong window, wrong type) produce empty or flooded timelines: the window is defined by the known incident timeline. And watch out for volume: unfiltered output is huge (one line per event) — time filtering is mandatory before exporting. Output formats have their fields: l2tcsv is the exchange standard, but for SIEM analysis, JSON output or direct integration are alternatives.