Timesketch import

timesketch_importer -u <user> -p <pw> --sketch <s> <csv>

Import a CSV timeline into Timesketch, the collaborative DFIR timeline analysis platform.

Run it when you need collaborative timeline analysis: Timesketch (from Google) centralizes case timelines — the importer uploads the CSV (from plaso, from the parsers) to the sketch, and the team analyzes with shared views, filters, aggregates, and annotations. It's the DFIR timeline analysis platform: the sketch per case, the host timelines imported, and collaborative analysis with annotated findings. In IR, Timesketch is where timelines become the incident story: the payload event, the Run key, and the logon, correlated and annotated by the team.

Don't use it without the infrastructure: Timesketch needs the server (Docker) and the configured instance — without the server, the importer fails. The analysis quality depends on the imported timeline: the plaso CSV (with the correct fields) is the source; malformed CSVs give empty or noisy timelines. And watch out: Timesketch is the analysis platform, collection and parsing are prior (plaso, the parsers) — the full flow is collection → parsing → import → analysis. Collaboration (shared sketches, annotations) is the value: the case is analyzed as a team with accumulated context.