Plaso / Log2timeline
Definition
The cross-artifact super-timeline tool. log2timeline.py extracts events from many sources into a .plaso storage file; psort.py renders the timeline to CSV or Elasticsearch.
- Tool type
- Cross-artifact super-timeline generator
- Extraction step
- log2timeline.py builds a .plaso storage file
- Rendering step
- psort.py outputs CSV or Elasticsearch
- Scope
- Combines events from many source artifacts into one timeline
Common questions
Why use a super-timeline tool instead of examining each artifact source separately?+
Correlating file system, log, and application timestamps into one merged timeline makes it far easier to see the sequence of related events across different sources, which is difficult to reconstruct manually when each artifact is analysed in isolation.
What is the practical difference between log2timeline.py and psort.py in a workflow?+
log2timeline.py is the extraction stage that parses source artifacts into the intermediate .plaso storage format, while psort.py is the separate output stage that filters, sorts, and exports that stored data into a human-readable or searchable format.
Related terms
- Auditd
- The Linux Audit Daemon. Writes /var/log/audit/audit.log based on rules configured in /etc/audit/audit.rules. Read with ausearch and aureport.
- Inode
- The ext2/3/4 metadata structure that holds a file's permissions, ownership, MAC times, link count and block pointers. The file name lives in...
- Journalctl
- The query interface to systemd-journald, the binary structured-logging daemon that backs modern Linux distributions. Binary database under /var/log/journal/.
- SUID / SGID
- Set-User-ID and Set-Group-ID permission bits. A SUID binary runs with the owner's privileges regardless of the invoking user. A common persistence and...
- Wtmp / Utmp / Btmp
- Binary login databases under /var/log and /var/run. wtmp logs successful logins, utmp reflects current sessions, btmp logs failed login attempts. Read with...