Timesketch import

timesketch_importer -u <u> -p <p> --sketch <s> <csv>

Imports a timeline into Timesketch, the collaborative DFIR timeline analysis platform.

Run it when you want collaborative timeline analysis: timesketch_importer uploads the CSV (the timeline from plaso or parsers) to the Timesketch sketch — Google's timeline platform (the same as 178): views, filters, aggregates, and team annotations. In DFIR, Timesketch is where timelines are analyzed: the imported host timeline and the incident history reconstructed with the team.

Don't use it without the platform: Timesketch requires the server (Docker) — infrastructure is a prerequisite. The quality of the analysis depends on the imported timeline (the plaso CSV with the correct fields). And note: Timesketch is the analysis — collection and parsing (plaso) come before; the full flow is collection → parsing → import → collaborative analysis. Collaboration (sketches, annotations) is the value of the case.