Lets Make Needles Glow in Timesketch
summary
Timesketch integrates threat intelligence to prune massive timelines: a fresh Windows Server 2022 ingest shows 4 million events (3M filesystem, 350k journald, 400k registry), then uses hash baselines and VirusTotal-style lookups to cut to 300k and, combined with scoring, down to 2K events. Built features include an intelligence view, a Sigma rule editor, Hasher and Yeti analyzers, Plaso/YARA file scanning, and scenario-based playbooks; demos run analyzers across 1.4M events and surface real indicators (two hits), showing the approach works in practice.
AI-written summary · about
chapters (5)
- 0:00Start
- 3:19What is Timesketch
- 5:56(Binary) File Classification
- 13:05Third party intelligence
- 19:57Initial triage of a system
related talks
27mCollect All the Data; Protect All the Things
41mWhat the Log?! So Many Events, so Little Time...
40mLeveraging Suricata in the Enterprise: Shifting from Events to Insights
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
30mTrawling for IOCs: Catching C2 in a Sea of Data
37mA Needle in a Haystack: How to Find a Threat Hidden in Over 6 Billion Logs Per Day
39mFinding the Needles in a Haystack: Identifying Suspicious Behaviors...
34mKeynote: Multiplying Threat Intelligence