### Example Multi-Node Timesketch Setup

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/scaling-and-limits.md

This outlines a potential three-node setup for a Timesketch installation, distributing OpenSearch, Timesketch Web, and Timesketch Worker components across dedicated machines for improved reliability and potential speed gains. Ensure all nodes have network connectivity.

```yaml
timesketch-1:
OpenSearch
Redis
PostgreSQL 11.x
Docker: Timesketch Web
Docker: Timesketch Worker

timesketch-2:
OpenSearch
Docker: Timesketch Worker

timesketch-3:
OpenSearch
Docker: Timesketch Worker
```

--------------------------------

### Timesketch Analyzer Setup

Source: https://github.com/google/timesketch/blob/master/docs/developers/analyzer-development.md

Commands to set up a virtual environment and install Timesketch dependencies for development.

```shell
sudo apt-get install pylint python3.9-venv
```

```shell
python3 -m venv timesketch_dev
source timesketch_dev/bin/activate
cd ~/
timesketch
pip install -r requirements.txt
pip install -r test_requirements.txt
```

```shell
~/timesketch/run_tests.py
```

--------------------------------

### Install Project Dependencies

Source: https://github.com/google/timesketch/blob/master/timesketch/frontend-ng/README.md

Run this command to install all necessary project dependencies before development or building.

```bash
yarn install
```

--------------------------------

### Install Redis Server

Source: https://github.com/google/timesketch/wiki/UserGuidePlasoUpload

Install the Redis server package on your system.

```bash
sudo apt-get install redis-server
```

--------------------------------

### Install act CLI

Source: https://github.com/google/timesketch/blob/master/docs/developers/local_github_actions_with_act.md

Installs the `act` command-line tool using the official installation script. This command requires sudo privileges to install the binary to `/usr/local/bin/`.

```bash
curl -s https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash
```

--------------------------------

### Install Timesketch API and Import Clients

Source: https://github.com/google/timesketch/blob/master/notebooks/Sigma_test_Notebook.ipynb

Installs the necessary Timesketch client libraries. Use this at the beginning of your session.

```python
!pip install -q timesketch_api_client
!pip install -q timesketch_import_client
```

--------------------------------

### Enable and Start Elasticsearch Service

Source: https://github.com/google/timesketch/wiki/Installation

Reload the systemd daemon, enable the Elasticsearch service to start on boot, and then start the service immediately.

```bash
sudo /bin/systemctl daemon-reload &&
    sudo /bin/systemctl enable elasticsearch.service &&
    sudo /bin/systemctl start elasticsearch.service
```

--------------------------------

### Clone Timesketch and Start Docker

Source: https://github.com/google/timesketch/blob/master/docs/developers/getting-started.md

Clone the Timesketch repository and start the development environment using Docker Compose. Wait for the installation script to complete.

```bash
$ git clone timesketch
$ cd timesketch/docker/dev
$ docker compose up
```

--------------------------------

### Install l2t scaffolder

Source: https://github.com/google/timesketch/blob/master/docs/developers/analyzer-development.md

Instructions for installing the l2t scaffolder from source in a virtual environment.

```shell
$ cd ~/timesketch/
$ l2t_scaffolder.py
```

--------------------------------

### Install Timesketch API Client

Source: https://github.com/google/timesketch/blob/master/notebooks/add_a_single_event_to_a_sketch.ipynb

Installs the Timesketch API client library. Only run if dependencies are not already installed or if using a cloud runtime.

```python
# @title Install dependencies
# @markdown Only execute if not already installed and running a cloud runtime
!pip install -q timesketch_api_client

```

--------------------------------

### Install Timesketch API Client from Source

Source: https://github.com/google/timesketch/blob/master/notebooks/SigmaPortFileToDatabase.ipynb

Builds and installs the Timesketch API client from its source directory. This method is used when the library is not available via pip or needs to be installed from a local path.

```bash
!python3 /usr/local/google/home/jaegeral/dev/timesketch/api_client/python/setup.py build && python3 /usr/local/google/home/jaegeral/dev/timesketch/api_client/python/setup.py install --user
```

--------------------------------

### Install and Serve MkDocs Locally

Source: https://github.com/google/timesketch/blob/master/docs/developers/getting-started.md

Run these commands within the Timesketch container to install MkDocs dependencies and serve the documentation locally for testing and review.

```shell
! cd /usr/local/src/timesketch
! pip3 install mkdocs mkdocs-material mkdocs-redirects
! mkdocs serve
```

--------------------------------

### Start Frontend-ng Development Server

Source: https://github.com/google/timesketch/blob/master/docs/developers/getting-started.md

Start the development server for the new frontend-ng UI. Changes to the timesketch/frontend-ng/ path will be automatically built and loaded.

```bash
./tsdev.sh vue-dev frontend-ng
```

--------------------------------

### Start Development Server

Source: https://github.com/google/timesketch/blob/master/timesketch/frontend-v3/README.md

Run this command to start the development server with hot-reloading enabled. The application will be accessible at http://localhost:3000.

```bash
yarn dev
```

--------------------------------

### Install Timesketch CLI Client

Source: https://github.com/google/timesketch/blob/master/docs/guides/user/cli-client.md

Install the Timesketch CLI client using pip.

```bash
pip3 install timesketch-cli-client
```

--------------------------------

### Start Application Services (Non-interactive)

Source: https://github.com/google/timesketch/blob/master/docker/dev/README.md

Start the Celery worker and Gunicorn webserver in the background for a non-interactive development setup.

```bash
docker compose exec -d timesketch celery -A timesketch.lib.tasks worker --loglevel info
docker compose exec -d timesketch gunicorn --reload -b 0.0.0.0:5000 --log-file - --timeout 120 timesketch.wsgi:application
```

--------------------------------

### Start Timesketch Server

Source: https://github.com/google/timesketch/wiki/Vagrant

Once the Vagrant box is up and running, SSH into the box and start the Timesketch server.

```bash
vagrant ssh
tsctl runserver -h 0.0.0.0
```

--------------------------------

### Install and Import Timesketch API Client

Source: https://github.com/google/timesketch/blob/master/notebooks/MUS2019_CTF.ipynb

Installs the Timesketch API client library and imports necessary modules for interacting with Timesketch. This setup is required for programmatic access to Timesketch data within a Python environment like Colab.

```python
# Install the TimeSketch API client if you don't have it
!pip install timesketch-api-client

# Import some things we'll need
from timesketch_api_client import config
from timesketch_api_client import search
import pandas as pd
pd.options.display.max_colwidth = 60
```

--------------------------------

### Install Timesketch API Client

Source: https://github.com/google/timesketch/blob/master/notebooks/SigmaPortFileToDatabase.ipynb

Installs the Timesketch API client library quietly. Use this to add the library to your environment.

```python
!pip install -q timesketch_api_client
```

--------------------------------

### Install PostgreSQL and Psycopg2

Source: https://github.com/google/timesketch/wiki/Installation

Install the PostgreSQL database server and the python-psycopg2 library, which is a PostgreSQL adapter for Python.

```bash
sudo apt-get install postgresql
    sudo apt-get install python-psycopg2
```

--------------------------------

### Modify Serve Command to Include Kill Step in Tiltfile

Source: https://github.com/google/timesketch/blob/master/docs/developers/tilt-development.md

This example shows how to modify the `serve_cmd` in `contrib/Tiltfile` to include a step that kills gunicorn processes before executing the refresh configuration command and starting the service. This can help prevent orphaned processes.

```python
serve_cmd="docker exec timesketch-dev pkill -9 -f gunicorn || true && " + refresh_config_cmd + " && docker exec -i ..."
```

--------------------------------

### Start MkDocs Preview Server

Source: https://github.com/google/timesketch/blob/master/docs/README.md

Launch the local development server for mkdocs. This allows you to preview documentation changes in real-time before deploying them.

```bash
mkdocs serve
```

--------------------------------

### Build and Start Docker Containers

Source: https://github.com/google/timesketch/blob/master/docker/e2e/README.md

Navigate to the e2e directory within the Docker folder and use Docker Compose to build and start the Timesketch services.

```shell
cd docker/e2e
sudo docker compose up
```

--------------------------------

### Sigma Configuration File Example

Source: https://github.com/google/timesketch/blob/master/docs/guides/user/sigma.md

An example of a `sigma_config.yaml` file, which contains mappings used by Timesketch for Sigma rules. Missing mappings can be added and contributed via a Pull Request.

```yaml
sigma_config.yaml
```

--------------------------------

### Start Interactive Shell

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/admin-cli.md

Starts an interactive Python shell with the Timesketch API client pre-initialized.

```bash
tsctl shell
```

--------------------------------

### Install Required Python Libraries for Scapy

Source: https://github.com/google/timesketch/blob/master/notebooks/Stolen_Szechuan_Sauce_Data_Upload.ipynb

Installs necessary Python libraries: `scapy`, `tqdm`, and `ipywidgets`. Use `-q` for quiet installation.

```python
!pip install -q scapy
!pip install -q tqdm
!pip install -q ipywidgets
```

--------------------------------

### Start Development Server

Source: https://github.com/google/timesketch/blob/master/timesketch/frontend-ng/README.md

Compiles and hot-reloads the application for development. Use this for local development and testing changes.

```bash
yarn run serve
```

--------------------------------

### Install Dependencies and Run Tests

Source: https://github.com/google/timesketch/blob/master/CONTRIBUTING.md

Install project dependencies using yarn and run all tests using the provided Python script.

```bash
yarn install
python ./run_tests.py
```

--------------------------------

### Build and Install Local CLI Client

Source: https://github.com/google/timesketch/blob/master/docs/developers/cli-client.md

Build and install a local version of the Timesketch CLI client from source. This is useful for development and testing changes.

```bash
cd /usr/local/src/timesketch/cli_client/python
python3 setup.py build && python3 setup.py install --user
```

--------------------------------

### Install API Client in Notebook

Source: https://github.com/google/timesketch/blob/master/docs/developers/notebook.md

Install the Timesketch API client from a local source within the notebook environment. Ensure the code is accessible and has the correct group ownership before running this command.

```python
!pip install /usr/local/src/timesketch/api_client/python
```

--------------------------------

### Install Dependencies for Timesketch API Client

Source: https://github.com/google/timesketch/blob/master/notebooks/Stolen_Szechuan_Sauce_Analysis.ipynb

Installs necessary Python packages for Timesketch API client, VirusTotal integration, and data manipulation. Execute only if not already installed and running on a cloud runtime.

```python
# @markdown Only execute if not already installed and running a cloud runtime
!pip install -q timesketch_api_client
!pip install -q vt-py nest_asyncio pandas
!pip install -q picatrix
```

--------------------------------

### Start Timesketch with v3 UI Profile

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/investigation-view-setup.md

Enable the v3 UI by adding the --profile v3-ui flag when starting Timesketch with Docker Compose.

```bash
sudo docker compose --profile v3-ui up -d
```

--------------------------------

### Install Dependencies with Package Managers

Source: https://github.com/google/timesketch/blob/master/timesketch/frontend-v3/README.md

Use the appropriate command for your preferred package manager to install project dependencies.

```bash
yarn install
```

```bash
npm install
```

```bash
pnpm install
```

```bash
bun install
```

--------------------------------

### Install Timesketch

Source: https://github.com/google/timesketch/wiki/Installation

Install the Timesketch Python package using pip. This command installs the latest stable version of Timesketch from the Python Package Index.

```bash
sudo pip install timesketch
```

--------------------------------

### Start Gunicorn Webserver (Interactive)

Source: https://github.com/google/timesketch/blob/master/docker/dev/README.md

Manually start the Gunicorn webserver for Timesketch in an interactive terminal. This is recommended for debugging purposes.

```bash
docker compose exec timesketch gunicorn --reload -b 0.0.0.0:5000 --log-file - --timeout 600 -c /usr/local/src/timesketch/timesketch/gunicorn_config.py timesketch.wsgi:application
```

```bash
bash utils/tsdev.sh web
```

--------------------------------

### Install Java for Elasticsearch

Source: https://github.com/google/timesketch/wiki/Installation

Install the Java Runtime Environment (JRE) headless version, which is required for Elasticsearch. Also, install the apt-transport-https package to allow apt to use repositories over HTTPS.

```bash
sudo apt-get install openjdk-8-jre-headless
    sudo apt-get install apt-transport-https
```

--------------------------------

### Install SnakeViz

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/performance_monitoring.md

Install the `snakeviz` package using pip to enable graphical analysis of profiling data.

```bash
pip install snakeviz
```

--------------------------------

### Get Importer CLI Help

Source: https://github.com/google/timesketch/blob/master/docs/guides/user/upload-data.md

Discover available parameters and usage instructions for the importer tool by running the help command.

```shell
timesketch_importer.py -h
```

--------------------------------

### Install Frontend-ng Dependencies

Source: https://github.com/google/timesketch/blob/master/docs/developers/getting-started.md

Install the necessary dependencies for the new frontend-ng UI development using the tsdev.sh script.

```bash
./tsdev.sh vue-install-deps frontend-ng
```

--------------------------------

### Start VueJS Development Server

Source: https://github.com/google/timesketch/blob/master/docs/developers/frontend-development.md

Starts the Vue.js development server for the frontend. Changes to .vue files are automatically picked up. This command is run within the Timesketch Docker container.

```bash
$ CONTAINER_ID="$(docker container list -f name=timesketch-dev -q)"
docker compose exec timesketch yarn run --cwd=/usr/local/src/timesketch/timesketch/frontend serve
```

--------------------------------

### Install Timesketch Importer Client

Source: https://github.com/google/timesketch/blob/master/docs/guides/user/upload-data.md

Install the importer CLI tool using pip. This tool is a wrapper around the importer client library and API client for uploading files.

```shell
pip3 install timesketch-import-client
```

--------------------------------

### Install Timesketch API Client

Source: https://github.com/google/timesketch/blob/master/notebooks/colab-timesketch-demo.ipynb

Installs the Timesketch API client using pip. This command is executed in the shell and is not needed if running a local kernel with the library pre-installed.

```python
!pip install --upgrade timesketch-api-client
```

--------------------------------

### Install MkDocs Dependencies

Source: https://github.com/google/timesketch/blob/master/docs/README.md

Install the necessary Python packages for mkdocs, including the Material theme and redirects plugin. This enables local building and previewing of the documentation.

```bash
pip3 install mkdocs mkdocs-material mkdocs-redirects
```

--------------------------------

### Install Python Packages in Running Container

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/llm-features.md

Installs `sec_gemini` into a running Timesketch container for ephemeral testing. Note that these changes are lost if the container is recreated.

```bash
# For Google GenAI
sudo docker exec timesketch-web pip install sec_gemini
sudo docker exec timesketch-worker pip install sec_gemini

```

--------------------------------

### Start Main Webserver

Source: https://github.com/google/timesketch/blob/master/docs/developers/frontend-development.md

Starts the main Timesketch webserver using Gunicorn for serving the API and other backend functionalities. This command requires the container ID of the running Timesketch development instance.

```bash
$ CONTAINER_ID="$(docker container list -f name=timesketch-dev -q)"
docker exec -it $CONTAINER_ID gunicorn --reload -b 0.0.0.0:5000 --log-file - --timeout 600 -c /usr/local/src/timesketch/timesketch/gunicorn.conf.py timesketch.wsgi:application
```

--------------------------------

### Install Frontend Dependencies

Source: https://github.com/google/timesketch/blob/master/docs/developers/frontend-development.md

Installs frontend Node.js dependencies using yarn within the Timesketch Docker container. Ensure you are in the correct frontend directory.

```bash
$ docker compose exec timesketch yarn install --cwd=/usr/local/src/timesketch/timesketch/frontend
```

```bash
$ docker compose exec timesketch yarn run --cwd=/usr/local/src/timesketch/timesketch/frontend build --mode development --watch
```

```bash
! cd /usr/local/src/timesketch/timesketch/frontend
```

```bash
! npm install
```

```bash
! yarn install
```

--------------------------------

### Start Timesketch Development Containers

Source: https://github.com/google/timesketch/blob/master/docker/dev/README.md

Navigate to the development Docker directory and start the Timesketch containers in detached mode. Changes in your cloned repository will be reflected automatically.

```bash
cd timesketch/docker/dev/

docker compose up -d
```

--------------------------------

### Start Timesketch Web Server

Source: https://github.com/google/timesketch/blob/master/docs/developers/getting-started.md

Start the Gunicorn web server for the Timesketch WSGI application. Changes to Python files are automatically reloaded.

```bash
./tsdev.sh web
```

```bash
$ docker compose exec timesketch gunicorn --reload -b 0.0.0.0:5000 --log-file - --timeout 120 timesketch.wsgi:application
[2021-05-25 16:36:32 +0000] [94] [INFO] Starting gunicorn 19.10.0
[2021-05-25 16:36:32 +0000] [94] [INFO] Listening at: http://0.0.0.0:5000 (94)
[2021-05-25 16:36:32 +0000] [94] [INFO] Using worker: sync
/usr/lib/python3.8/os.py:1023: RuntimeWarning: line buffering (buffering=1) isn't supported in binary mode, the default buffer size will be used
  return io.open(fd, *args, **kwargs)
[2021-05-25 16:36:32 +0000] [102] [INFO] Booting worker with pid: 102
[2021-05-25 16:36:33,343] timesketch.wsgi_server/INFO Metrics server enabled
```

--------------------------------

### Run Timesketch Deployment Script

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/install.md

Execute the deployment script to set up Timesketch and its dependencies. Ensure you are in the desired installation directory.

```shell
sudo ./deploy_timesketch.sh
```

--------------------------------

### Start Timesketch Docker Services

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/install.md

Start the Timesketch system using Docker Compose. This command brings up all the necessary services in detached mode.

```shell
cd timesketch
sudo docker compose up -d
```

--------------------------------

### Example Virustotal Context Link Configuration

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/context-links.md

An example configuration for a VirusTotal context link, specifying fields for hash and URL lookups with a redirect warning enabled.

```yaml
virustotal:
  short_name: 'VirusTotal'
  match_fields: ['hash', 'sha256_hash', 'sha256', 'sha1_hash', 'sha1', 'md5_hash', 'md5', 'url']
  context_link: 'https://www.virustotal.com/gui/search/<ATTR_VALUE>'
  redirect_warning: TRUE
```

--------------------------------

### Start VueJS Development Server for Frontend-ng

Source: https://github.com/google/timesketch/blob/master/docs/developers/frontend-development.md

Starts the Vue.js development server for the 'frontend-ng' project. This command is executed within the Timesketch Docker container and enables hot-reloading for .vue files.

```bash
$ CONTAINER_ID="$(docker container list -f name=timesketch-dev -q)"
docker compose exec timesketch yarn run --cwd=/usr/local/src/timesketch/timesketch/frontend-ng serve
```

--------------------------------

### Create Timesketch Vagrant Box

Source: https://github.com/google/timesketch/wiki/Vagrant

Navigate to the Vagrant directory within the Timesketch repository and start the Vagrant box.

```bash
cd timesketch/vagrant
vagrant up
```

--------------------------------

### List Installed Sigma Rules

Source: https://github.com/google/timesketch/blob/master/notebooks/Sigma_test_Notebook.ipynb

Fetches a list of all Sigma rules currently installed on the Timesketch instance. Useful for understanding available detection logic.

```python
rules = ts_client.list_sigmarules()
```

--------------------------------

### Get Timesketch Version

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/admin-cli.md

Displays the installed version of Timesketch.

```shell
tsctl version
Timesketch version: 20210602
```

--------------------------------

### Query Windows OS Installation Date

Source: https://github.com/google/timesketch/blob/master/notebooks/MUS2019_CTF.ipynb

Searches for the specific data type indicating Windows OS installation. Requires the 'search' object to be initialized.

```python
search_obj = search.Search(ctf)

search_obj.query_string = 'data_type:"windows:registry:installation"'
search_obj.return_fields = 'datetime,timestamp_desc,data_type,message'
ts_results = search_obj.table

ts_results[['datetime','timestamp_desc','data_type','message']]
```

--------------------------------

### Install Frontend-ng Dependencies

Source: https://github.com/google/timesketch/blob/master/docs/developers/frontend-development.md

Installs Node.js dependencies for the 'frontend-ng' project using yarn within the Timesketch Docker container. Navigate to the 'frontend-ng' directory first.

```bash
! cd /usr/local/src/timesketch/timesketch/frontend-ng
```

```bash
! npm install
```

```bash
! yarn install
```

--------------------------------

### Example Event with Sigma Rule Matches

Source: https://github.com/google/timesketch/blob/master/docs/guides/user/sigma.md

An example of how an event might appear after the Sigma Analyzer has run, showing the matched rule title and any associated ATT&CK tags.

```text
ts_sigma_rule:[ "Suspicious Installation of ZMap" ]
ts_ttp:[ "attack.discovery", "attack.t1046"]
```

--------------------------------

### Clone Timesketch Repository

Source: https://github.com/google/timesketch/wiki/Vagrant

Clone the Timesketch repository to your local machine to begin the setup process.

```bash
git clone https://github.com/google/timesketch.git
```

--------------------------------

### Build for Production

Source: https://github.com/google/timesketch/blob/master/timesketch/frontend-v3/README.md

Execute this command to build the project for production deployment.

```bash
yarn build
```

--------------------------------

### Connect to Timesketch Demo Server

Source: https://github.com/google/timesketch/blob/master/notebooks/OSDFCon Demo.ipynb

Establishes a connection to the Timesketch demo server using provided credentials. Ensure you have the timesketch-client library installed.

```python
client = timesketch_client.TimesketchApi('https://demo.timesketch.org', 'demo', 'demo')
```

--------------------------------

### Download and Prepare Timesketch Deployment Script

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/install.md

Download the Timesketch deployment script and make it executable. This script automates the setup of necessary services.

```shell
curl -s -O https://raw.githubusercontent.com/google/timesketch/master/contrib/deploy_timesketch.sh
chmod 755 deploy_timesketch.sh
```

--------------------------------

### Launch Timesketch Development Environment with Tilt

Source: https://github.com/google/timesketch/blob/master/docs/developers/tilt-development.md

Run this command from the project root to start the Timesketch development environment using Tilt and the specified Tiltfile.

```bash
tilt up -f contrib/Tiltfile
```

--------------------------------

### Change to Timesketch Installation Directory

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/upgrade.md

Navigate to your Timesketch installation directory before proceeding with the upgrade process.

```shell
$ cd /<PATH TO TIMESKETCH INSTALLATION>
```

--------------------------------

### List Sigma Rules

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/admin-cli.md

Lists all installed Sigma rules. You can specify which columns to display using the --columns option.

```bash
tsctl list-sigma-rules --columns=rule_uuid,title,status
```

--------------------------------

### Create a New Sketch

Source: https://github.com/google/timesketch/blob/master/docs/guides/user/cli-client.md

Create a new sketch with a specified name and description. Essential for starting new analysis projects.

```bash
timesketch sketch create --name "My New Sketch" --description "Analysis of incident X"
```

--------------------------------

### Update Ubuntu System

Source: https://github.com/google/timesketch/wiki/Installation

Update the package list and upgrade installed packages on Ubuntu. This should be done after the base system installation.

```bash
sudo apt-get update
    sudo apt-get dist-upgrade
```

--------------------------------

### Start Celery Worker (Interactive)

Source: https://github.com/google/timesketch/blob/master/docker/dev/README.md

Manually start the Celery worker for Timesketch in an interactive terminal. This is recommended for debugging purposes.

```bash
docker compose exec timesketch celery -A timesketch.lib.tasks worker --loglevel info
```

```bash
bash utils/tsdev.sh celery
```

--------------------------------

### Download and Install Elasticsearch 2.x

Source: https://github.com/google/timesketch/wiki/Installation

Download the Elasticsearch 2.4.3 Debian package and install it. Note that only Elasticsearch 2.x is supported, not 5.x.

```bash
wget https://download.elastic.co/elasticsearch/release/org/elasticsearch/distribution/deb/elasticsearch/2.4.3/elasticsearch-2.4.3.deb
    sudo dpkg -i elasticsearch-2.4.3.deb
```

--------------------------------

### Run SnakeViz Server

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/performance_monitoring.md

Start the `snakeviz` web server in the directory containing `.prof` files. The `-s` flag enables the server mode.

```bash
# For local development
cd /usr/local/src/timesketch/profiles/

# For release containers
# cd /var/log/timesketch/profiles/

# Start snakeviz, pointing it to all .prof files
snakeviz . -s
```

--------------------------------

### Example pinfo.py Error Message

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/troubleshooting.md

This is an example of the error message you might see when running `pinfo.py` if the Plaso file format is not supported.

```text
2020-08-19 14:40:48,912 [ERROR] (MainProcess) PID:568 <pinfo_tool> Format of storage file: $FILENAME not supported
```

--------------------------------

### Pull and Start Timesketch Notebook Container

Source: https://github.com/google/timesketch/blob/master/docs/guides/user/notebook.md

Commands to download the latest Timesketch Notebook Docker image and start the container in detached mode.

```shell
$ sudo docker compose pull
$ sudo docker compose up -d

```

--------------------------------

### Create First Timesketch User

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/install.md

Create the initial user account for Timesketch using the command-line tool. Replace <USERNAME> with the desired username.

```shell
sudo docker compose exec timesketch-web tsctl create-user <USERNAME>
```

--------------------------------

### Display Host and Product Name

Source: https://github.com/google/timesketch/blob/master/notebooks/Stolen_Szechuan_Sauce_Analysis.ipynb

Selects and displays the 'hostname' and 'product_name' columns from the queried data, useful for initial inspection of OS information.

```python
cur_df[['hostname', 'product_name']]
```

--------------------------------

### Timesketch CLI Help Menu

Source: https://github.com/google/timesketch/blob/master/docs/guides/user/cli-client.md

View the main help menu for the Timesketch CLI client by invoking it without parameters or with the --help flag.

```bash
$ timesketch
Usage: timesketch [OPTIONS] COMMAND [ARGS]...

  Timesketch CLI client.

  This tool provides similar features as the web client does. It operates
  within the context of a sketch so you either need to provide an existing
  sketch or create a new one.

  Basic options for editing the sketch is provided, e.g re-naming and changing
  the description as well as archiving and exporting. For other actions not
  available in this CLI client the web client should be used.

  For detailed help on each command, run  <command> --help

Options:
  --version             Show the version and exit.
  --sketch INTEGER      Sketch to work in.
  --output-format TEXT  Set output format [json, text, tabular, csv]
                        (overrides global setting).
  -h, --help            Show this message and exit.

Commands:
  analyze         Analyze timelines.
  config          Configuration for this CLI tool.
  events          Manage event.
  import          Import timeline.
  intelligence    Manage intelligence within a sketch.
  saved-searches  Managed saved searches.
  search          Searches and explores events within a Timesketch sketch.
  sigma           Manage sigma rules.
  sketch          Manage sketch.
  timelines       Manage timelines.
```

--------------------------------

### Initialize and Extend Watch List

Source: https://github.com/google/timesketch/blob/master/notebooks/OSDFCon Demo.ipynb

Initializes a watch list with known corporate domains and extends it with top domains from network data. Ensure 'network_data' is defined and populated before execution.

```python
watch_list = ['greendale.xyz']

# Let's add the top domains to the list.
watch_list.extend(network_data.tld.value_counts()[:10].keys())
watch_list.extend(network_data.domain.value_counts()[:10].keys())
```

--------------------------------

### Timesketch CLI Help Output

Source: https://github.com/google/timesketch/blob/master/docs/developers/cli-client.md

Displays the available commands and options for the Timesketch CLI client. Use this to understand the CLI's structure and available functionalities.

```bash
timesketch -h
Usage: timesketch [OPTIONS] COMMAND [ARGS]...

  Timesketch CLI client.

  This tool provides similar features as the web client does. It operates
  within the context of a sketch so you either need to provide an existing
  sketch or create a new one.

  Basic options for editing the sketch is provided, e.g. re-naming and
  changing the description as well as archiving and exporting. For other
  actions not available in this CLI client the web client should be used.

  For detailed help on each command, run  <command> --help

Options:
  --version         Show the version and exit.
  --sketch INTEGER  Sketch to work in.
  -h, --help        Show this message and exit.

Commands:
  analyze         Analyze timelines.
  config          Configuration for this CLI tool.
  events          Manage event.
  import          Import timeline.
  saved-searches  Managed saved searches.
  search          Search and explore.
  
  ...
```

--------------------------------

### Upgrade Timesketch using pip

Source: https://github.com/google/timesketch/wiki/Upgrading

Upgrade your Timesketch installation to the latest version using pip. This command fetches and installs the most recent stable release.

```bash
pip install timesketch --upgrade
```

--------------------------------

### Run Importer CLI Tool

Source: https://github.com/google/timesketch/blob/master/docs/guides/user/upload-data.md

Execute the importer tool with the path to your data file. If authentication or server information is missing, the tool will prompt for it and save it to ~/.timesketchrc.

```shell
timesketch_importer.py path_to_my_file.csv
```

--------------------------------

### Configure the Timesketch CLI

Source: https://context7.com/google/timesketch/llms.txt

Run `timesketch config` to set up the CLI client, which typically writes configuration to `~/.timesketchrc`.

```bash
# Configure the CLI (writes ~/.timesketchrc)
timesketch config
```

--------------------------------

### Display Help for Test Runner

Source: https://github.com/google/timesketch/blob/master/docs/developers/testing.md

Use this command to view all available options for the main test runner script.

```python
!
```

--------------------------------

### Run l2t scaffolder for sketch analyzer

Source: https://github.com/google/timesketch/blob/master/docs/developers/analyzer-development.md

Example of running the l2t scaffolder to generate a sketch analyzer, including interactive prompts and output.

```shell
$ cd ~/timesketch/
$ l2t_scaffolder.py
   == Starting the scaffolder ==
Gathering required information.

Available definitions:
  [0] plaso
  [1] timesketch
  [2] turbinia
Definition choice: 1
timesketch chosen.

Path to the project root: .
Path [.] set as the project path.

Name of the module to be generated. This can be something like "foobar sqlite"
or "event analytics".

This will be used for class name generation and file name prefixes.
Module Name: best_analyzer
About to create a new feature branch to store newly generated code.
Creating feature branch: best_analyzer inside .
Switching to feature branch best_analyzer

Available scaffolders for timesketch:
  [0] index_analyzer
  [1] sketch_analyzer
Scaffolder choice: 1
Ready to generate files? [Y/n]: Y
File: ./timesketch/lib/analyzers/best_analyzer.py written to disk.
File: ./timesketch/lib/analyzers/BEST_ANALYZER_test.py written to disk.
File: ./timesketch/lib/analyzers/__init__.py written to disk.
```

--------------------------------

### Install Timesketch Dependencies

Source: https://github.com/google/timesketch/wiki/Installation

Install necessary Python dependencies for Timesketch: python-pip for package management, python-dev for development headers, and libffi-dev for the foreign function interface.

```bash
sudo apt-get install python-pip python-dev libffi-dev
```

--------------------------------

### Prepare to Create Timelines from a List of Files

Source: https://github.com/google/timesketch/blob/master/notebooks/debugging_timesketch.ipynb

Initializes a list to store file paths for creating multiple timelines. This section is a placeholder and requires modification to populate the 'list_files' array.

```python
# feel free to modify these lines as they are only used to fill the array list_files
import os
dir_path = r'/tmp/list_files'

# list to store files
list_files = []

```

--------------------------------

### Install Plaso on Ubuntu

Source: https://github.com/google/timesketch/wiki/UserGuidePlasoUpload

Follow these commands to install the necessary Plaso version on Ubuntu. Ensure you are using the latest Plaso version (>=1.5.0) due to format changes.

```bash
sudo add-apt-repository universe
sudo add-apt-repository ppa:gift/dev
sudo apt-get update
sudo apt-get install python-plaso
```

--------------------------------

### Example Request Body (NDJSON stream)

Source: https://github.com/google/timesketch/blob/master/docs/developers/log-analyzer-agent.md

This is an example of the Newline Delimited JSON (NDJSON) stream format sent to the AI agent. Each object represents a Timesketch event.

```json
{"_index": "a1b2c3d4...", "_id": "event_id_1", "_source": {"message": "User 'admin' logged in from 192.168.1.100", "timestamp": 1672531200000000, ...}}
{"_index": "a1b2c3d4...", "_id": "event_id_2", "_source": {"message": "Process 'evil.exe' created by pid 1234", "timestamp": 1672531201000000, ...}}
```

--------------------------------

### Install vega for Altair rendering in JupyterLab

Source: https://github.com/google/timesketch/blob/master/notebooks/OSDFCon Demo.ipynb

This command is used to install the 'vega' package, which is required for Altair to render plots within a JupyterLab environment. It is commented out for local runs.

```python
#!pip install vega
```

--------------------------------

### Initialize Timesketch Client and List Sketches

Source: https://github.com/google/timesketch/blob/master/notebooks/Stolen_Szechuan_Sauce_Data_Upload.ipynb

Retrieves an instance of the Timesketch API client using configuration settings and then lists all available sketches associated with the client. This is a prerequisite for uploading data to a specific sketch.

```python
ts_client = config.get_client()
[(x.id, x.name) for x in ts_client.list_sketches()]
```

--------------------------------

### Update Package List and Install Pylint

Source: https://github.com/google/timesketch/blob/master/docs/developers/testing.md

Ensure the package list is up-to-date and install a specific version of Pylint within the Docker container. This is a prerequisite for running linting checks.

```bash
! apt-get update
```

```bash
! apt-get install pylint==2.6.0
```

--------------------------------

### Build for Production

Source: https://github.com/google/timesketch/blob/master/timesketch/frontend-ng/README.md

Compiles and minifies the application for production deployment. This command creates optimized build artifacts.

```bash
yarn run build
```

--------------------------------

### List API Routes

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/admin-cli.md

Displays all available API routes in the Timesketch instance.

```bash
tsctl routes
Endpoint                           Methods            Rule
---------------------------------  -----------------  -------------------------------------------------------------------------
aggregationexploreresource         POST               /api/v1/sketches/<int:sketch_id>/aggregation/explore/
```

--------------------------------

### Configure Timesketch Client in Python

Source: https://github.com/google/timesketch/blob/master/docs/guides/user/notebook.md

Python code snippets demonstrating how to configure the Timesketch client to connect to different servers.

```python
ts_client = config.get_client(confirm_choices=True)

```

```python
ts_client = config.get_client(config_section='myserver')

```

--------------------------------

### Configure Search with from_manual

Source: https://github.com/google/timesketch/blob/master/docs/developers/api-client.md

Use the `from_manual` function to configure search parameters like query string, DSL, filters, return fields, and maximum entries. Provide either `query_string` or `query_dsl` to initiate a search.

```python
search_obj.from_manual(
    query_string, query_dsl, query_filter,
    return_fields, max_entries)

```

--------------------------------

### Manage Search Index Status

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/admin-cli.md

Use this command to get or set the status of a specific search index. Specify the index ID, the action (get or set), and the desired status.

```bash
tsctl searchindex-status --searchindex_id 1 --action set --status fail
```

--------------------------------

### Initialize TimesketchApi Client using Config File

Source: https://context7.com/google/timesketch/llms.txt

Initializes the TimesketchApi client by loading configuration from the default user config file (~/.timesketchrc). It can prompt for missing fields interactively.

```python
from timesketch_api_client import client, config

# --- Option 2: Config-file helper (reads ~/.timesketchrc) ---
ts = config.get_client()   # prompts for missing fields interactively
```

--------------------------------

### Get Timesketch API Client

Source: https://github.com/google/timesketch/blob/master/docs/developers/api-client.md

Use the config client to get an authenticated Timesketch API client instance. It reads connection information from `~/.timesketchrc` and prompts for missing details.

```python
from timesketch_api_client import config

ts_client = config.get_client()
```

--------------------------------

### Initialize a Search Object

Source: https://github.com/google/timesketch/blob/master/docs/developers/api-client.md

Create a search object from a sketch object to begin configuring search parameters. Requires importing the `search` module.

```python
from timesketch_api_client import search
...

search_obj = search.Search(sketch=sketch)
```

--------------------------------

### Get a specific Sigma rule by UUID using REST API

Source: https://context7.com/google/timesketch/llms.txt

Retrieve details of a specific Sigma rule using its UUID via a GET request to the API. Authentication is required.

```bash
curl -s -b cookies.txt \
  https://timesketch.example.com/api/v1/sigmarules/8f14f552-1e4e-4d5c-9f47-b7d5c9e4a312/
```

--------------------------------

### Initialize Timesketch Client and Sketch

Source: https://github.com/google/timesketch/blob/master/notebooks/add_a_single_event_to_a_sketch.ipynb

Establishes a connection to the Timesketch API and retrieves a sketch object using the configured sketch ID.

```python
# @title Timesketch connnection
ts_client = config.get_client()
sketch = ts.get_sketch(Sketch_id)

```

--------------------------------

### Start Timesketch HTTP Server

Source: https://github.com/google/timesketch/wiki/Installation

Start the Timesketch HTTP server using the tsctl runserver command. It is configured to listen on all network interfaces (0.0.0.0) on port 5000. Note: This is unencrypted and not recommended for production.

```bash
tsctl runserver -h 0.0.0.0 -p 5000
```

--------------------------------

### Manage Timeline Status

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/admin-cli.md

Gets or sets the status of a timeline. This is useful for manually correcting the state of an import that has failed or stalled. Available actions are 'get' and 'set', with possible statuses including 'ready', 'processing', and 'fail'.

```bash
# Get the status of timeline with ID 123:
tsctl timeline-status 123 --action get
```

```bash
# Set the status of timeline with ID 456 to "ready":
tsctl timeline-status 456 --action set --status ready
```

--------------------------------

### Query Network Traffic for Specific IPs and HTTP GET

Source: https://github.com/google/timesketch/blob/master/notebooks/Stolen_Szechuan_Sauce_Analysis.ipynb

Queries network packet capture data for traffic between two specific IP addresses that also contains HTTP GET requests. Useful for identifying payload delivery attempts.

```python
attacker_dst_http = timesketch_query_func(
    '(194.61.24.102 AND 10.42.85.10) AND data_type:"scapy:pcap:entry" AND *http* AND *GET*',
    fields='datetime,message,timestamp_desc,ip_flags,ip_dst,ip_src,payload,tcp_flags,tcp_seq,tcp_sport,tcp_dport,tcp_window').table
attacker_dst_http.head(4)
```

--------------------------------

### Get Sketch

Source: https://github.com/google/timesketch/blob/master/docs/developers/api-client.md

Fetches a specific sketch by its ID.

```APIDOC
## get_sketch

### Description
Retrieves a specific sketch object using its unique identifier.

### Parameters
- **sketch_id** (int) - Required - The ID of the sketch to retrieve.

### Example
```python
sketch = ts_client.get_sketch(SKETCH_ID)
sketch = ts_client.get_sketch(25)
```
```

--------------------------------

### Get Single Sketch

Source: https://context7.com/google/timesketch/llms.txt

Retrieves a single sketch by its ID.

```APIDOC
## Get Single Sketch

### Description
Retrieves a single sketch by its ID.

### Method
GET

### Endpoint
https://timesketch.example.com/api/v1/sketches/{id}/

### Parameters
#### Path Parameters
- **id** (integer) - Required - The ID of the sketch to retrieve.
```

--------------------------------

### Get Timesketch Info

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/admin-cli.md

Displays detailed version information for Timesketch and its dependencies.

```shell
tsctl info
Timesketch version: 20250708
Timesketch commit: 2cb3356b (dirty)
plaso - psort version 20240308
Node version: v20.19.1
npm version: 10.8.2
yarn version: 1.22.22
Python version: Python 3.10.12
pip version: pip 22.0.2 from /usr/lib/python3/dist-packages/pip (python 3.10)
```

--------------------------------

### Get a list of Sigma rules

Source: https://github.com/google/timesketch/blob/master/docs/developers/api-client.md

Retrieves a list of available Sigma rules.

```APIDOC
## Get a list of Sigma rules

### Description
Retrieves a list of available Sigma rules.

### Method
`ts.list_sigma_rules(as_pandas: bool = False)`

### Parameters
*   **as_pandas** (bool) - If True, returns a pandas DataFrame. Defaults to False (returns a Python dict).

### Response
The output can be a pandas DataFrame or a Python dict, depending on the `as_pandas` parameter.
```

--------------------------------

### Build Custom Docker Image with Extra Packages

Source: https://github.com/google/timesketch/blob/master/docs/guides/admin/llm-features.md

Use this command to build a Docker image with additional Python packages like `sec_gemini` pre-installed. This is recommended for operational deployments to ensure persistence.

```bash
docker build \
  --build-arg EXTRA_PIP_PACKAGES="sec_gemini" \
  -t timesketch:ai-enabled .

```

--------------------------------

### Get Saved Search

Source: https://github.com/google/timesketch/blob/master/docs/developers/api-client.md

Retrieves a specific saved search by its ID or name.

```APIDOC
## get_saved_search

### Description
Fetches a specific saved search from a sketch, identified by its ID or name.

### Parameters
- **search_id** (int) - Required - The ID of the saved search.
- **search_name** (str) - Required - The name of the saved search.

### Example
```python
saved_search = sketch.get_saved_search(search_id=<SEARCH_ID>)
saved_search = sketch.get_saved_search(search_name=<SEARCH_NAME>)
```
```