Skip to content

Releases: google/timesketch

20260209

09 Feb 20:25
5d78688

Choose a tag to compare

What's Changed

✨ New Features & Major Enhancements

  • Feature: Add structured JSON logging support for containerized environments by @jkppr in #3701
  • Migrate AI integration to unified google-genai SDK by @itsmvd in #3695

📈 Improvements & Refinements

  • Handle OpenSearch ConnectionTimeout with user-friendly 504 error by @jkppr in #3694
  • Adjusts yetiindicators analyzer to latest changes in the Yeti API. by @tomchop in #3687
  • feat: better logging in timesketch/lib/tasks.py:set_timeline_status by @jaegeral in #3690
  • (fix): Minor typos fixed and  vue/valid-v-slot linting errors in all frontend versions. by @jaegeral in #3697

🐞 Bug Fixes

  • fix: crash when deleting sketches with shared timelines/indices by @jaegeral in #3677
  • Fixes an issue where the Sec-Gemini feature fails to process events using the +0000 UTC offset format by @itsmvd in #3693
  • Fix deployment scripts by @jkppr in #3679
  • Fix e2e test entrypoint script. by @jkppr in #3681
  • Minor fixes for v3 UI by @jkppr in #3700
  • build: remove deprecated pkg_resources from setup.py to fix CI failures by @jaegeral in #3698

⬆️ Dependency Updates

  • build(deps): bump lodash from 4.17.21 to 4.17.23 in /timesketch/frontend-v3 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3682
  • build(deps): bump lodash from 4.17.21 to 4.17.23 in /timesketch/frontend-ng in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3683
  • build(deps): bump jspdf from 4.0.0 to 4.1.0 in /timesketch/frontend-v3 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3692
  • build(deps-dev): bump webpack from 5.102.1 to 5.104.1 in /timesketch/frontend-ng in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3696

Full Changelog: 2026011...2026020

20260119

19 Jan 14:58
e8c4342

Choose a tag to compare

What's Changed

📈 Improvements & Refinements

  • Optimize domain analyzer performance by @jkppr in #3645
  • Feat/Celery: Configurable and safe psort logging by @jkppr in #3647
  • Support optional pip packages in Docker build and update AI documentation by @jkppr in #3648
  • fix: (tests) replace random.randint with uuid in e2e tests for uniqueness by @JohannesLks in #3652
  • feat: Add dedicated 403 Access Denied page for sketches by @JohannesLks in #3651
  • feat: Add dedicated 403 Access Denied page for sketches frontend-v3 by @JohannesLks in #3664
  • fix: (cli) make export more stable and introduce stream in sketch.search() as optional by @jaegeral in #3662
  • [DFIQ] Change logger level for missing parent UUID by @jkppr in #3672
  • feat: Add dialog for CSV export limit in Explore view by @jkppr in #3671
  • Refactor WSGI app initialization and enable Gunicorn worker recycling by @jkppr in #3673
  • Remove legacy logging message by @jkppr in #3676

🐞 Bug Fixes

  • Fix index explosion during rapid automated uploads by @jkppr in #3670
  • Fix copy event link bug for negative IDs by @jkppr in #3667
  • fix: Allow archived sketches with failed timelines to be unarchived by @jaegeral in #3656
  • Fix importer client tests by @jkppr in #3643
  • Fix path for docker-entrypoint.sh in Dockerfile-latest by @wajihyassine in #3649
  • Fix HTTP 413 errors via multipart upload and dynamic chunking in ImportStreamer by @jkppr in #3663
  • Fix: chart generation robustness by @jaegeral in #3661
  • fix(e2e): test messages for importing file delay by @jaegeral in #3666
  • Fix stuck timelines by hardening DB connection handling in Celery tasks by @jkppr in #3674

⬆️ Dependency Updates

  • build(deps): bump jspdf from 3.0.2 to 4.0.0 in /timesketch/frontend-v3 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3653
  • build(deps): bump vega-selections from 6.1.0 to 6.1.2 in /timesketch/frontend-ng in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3655
  • build(deps): bump vega-functions from 6.1.0 to 6.1.1 in /timesketch/frontend-ng in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3658
  • Black Formatter Updates by @jkppr in #3675
  • Force qs to v6.14.1 by @jkppr in #3678

📖 Documentation

  • Update User CLI Client Documentation by @jkppr in #3669
  • Update tsctl documentation to match code @jkppr in #3668

Full Changelog: 2025121...2026011

20251219

19 Dec 11:27
24e40a4

Choose a tag to compare

What's Changed

✨ New Features & Major Enhancements

  • Add a custom prompt field to the AI investigation view by @itsmvd in #3612
  • feat: timeline tooltip & local defaults by @jkppr in #3641
  • Feat: Add delete-group and help commands to tsctl by @jaegeral in #3574
  • Feat: High-performance streaming event export API and client support by @jkppr in #3611
  • feat(tsctl): Add sync-groups-from-json command for bulk user management by @jkppr in #3619
  • feat: tsctl analyzer-management by @jaegeral in #3636
  • feat: Add story section in cli-client by @jaegeral in #3599

📈 Improvements & Refinements

  • URL handling improvements by @jeflagel in #3573
  • feat: add list of registered test classes in end2end tests by @jaegeral in #3594
  • Cleanup: Remove e2e tests for Opensearch v1 & Ubuntu 22.04 by @jkppr in #3603
  • feat: API client: refactor retry logic by @jaegeral in #3581
  • feat: decoupled the profiling configuration from the debug setting by @jaegeral in #3613
  • build(e2e): Optimize Dockerfile by using official Plaso base image by @jkppr in #3620
  • UI: Add icons to user/group autocomplete in Share dialog by @jkppr in #3621
  • feat: tsctl chunked for check-opensearch-links by @jaegeral in #3618
  • Update secgemini_log_analyzer_agent.py by @babirous in #3623
  • test: new e2e test for events with comments by @jaegeral in #3588
  • Improve LLM error handling: reduce log noise and refine frontend feedback by @jkppr in #3633
  • Upgrade GitHub Actions to latest versions by @salmanmkc in #3638
  • Upgrade GitHub Actions for Node 24 compatibility by @salmanmkc in #3637
  • feat: add sketch id and analysis id on multiple logging points in analyzer/interface.py by @jaegeral in #3639
  • docs: by @jaegeral in #3601

🐞 Bug Fixes

  • fix: API client - ensure functions in scenario return strings by @jkppr in #3598
  • fix: Ensure safe default return fields for saved views by @jkppr in #3602
  • Fix back-to-back SecGemini investigations by @gpavlidi in #3597
  • api_client: fix: some smaller fixes to retry logic by @jaegeral in #3608
  • fix: API Client: safely retrieve _retry_count and _backoff_factor using getattr with d… by @jaegeral in #3609
  • Revert "fix: API Client: safely retrieve _retry_count and _backoff_factor using getattr with d…" by @jaegeral in #3610
  • Fix: Handle issue in events with CommentsMixin.get_with_comments() by @jaegeral in #3590
  • initial attempt to fix some delete workflows by @jaegeral in #3587
  • Fix: Remove unsupported 'features' argument in tsctl by @jaegeral in #3631
  • Fix: [importer] Prevent duplicate jsonl uploads by fixing ImportStreamer.close() by @jkppr in #3640

⬆️ Dependency Updates

  • build(deps): bump vega from 5.32.0 to 6.2.0 in /timesketch/frontend-ng in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3596
  • build(deps): bump js-yaml from 3.14.1 to 3.14.2 in /timesketch/frontend-ng in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3606
  • build(deps): bump js-yaml from 4.1.0 to 4.1.1 in /timesketch/frontend-v3 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3604
  • build(deps): bump node-forge from 1.3.1 to 1.3.2 in /timesketch/frontend-ng in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3614
  • build(deps): bump werkzeug from 3.0.6 to 3.1.4 in the pip group across 1 directory by @dependabot[bot] in #3616
    • ⚠️ Ensure to update your local timesketch.conf with the new config value. See #3644 for more.

New Contributors

Full Changelog: 2025111...2025121

20251114

14 Nov 09:02
fea3eb3

Choose a tag to compare

🚀 Timesketch 20251114 Release: Critical Stability Hotfix & The Intelligence
Deploying on November 14, 2025.

If you upgraded to 20251112, please roll out this release asap, as your explore api might not return any results due to a bug that is fixed with this release.

🛡️ Core Stability & Code Hardening
Critical updates to fortify your database and ensure a seamless exploration experience.

Database Fortification: We upgraded SQLAlchemy to 1.4.54. This ensures your core database interactions are stable, secure, and ready for high-volume operations.

Fix: update sqlalchemy to 1.4.54 by @jaegeral in #3592

Targeted Error Handling: Refined the code in explore.py to intelligently handle comments. We now use a more precise try-catch block, preventing unexpected interruptions and guaranteeing a smoother exploration experience.

Fix: only add a try catch block for comments in explore.py by @jaegeral in #3593

You are absolutely right. For release notes, clarity, accuracy, and a factual tone are paramount.

Here is the revised, factual description for the Timesketch 20251114 release, ensuring all technical details, authors, and links are accurately presented without marketing language:

🛠️ Timesketch Release 20251114
Release Date: November 14, 2025

This is a focused release addressing core stability, dependency management, and the introduction of a new log analysis agent.

✨ Feature
The introduction of a new agent for log analysis utilizing Sec-Gemini capabilities.

Sec-Gemini Log Analysis Agent: Implements a new agent for processing and analyzing log data using the Sec-Gemini feature set.

feat: Sec-Gemini log analysis agent by @itsmvd in #3591

Full Changelog: 2025111...2025111

20251112

12 Nov 09:09
567b6d7

Choose a tag to compare

20251112 Pre-release
Pre-release

🚀 Timesketch Release Notes

🛡️ Security & Dependencies

These changes address critical security vulnerabilities and keep our third-party libraries up-to-date.

  • Critical Security Fix: Upgrade Redis to version 7.2.11 to address critical vulnerability by @jaegeral in (#3551)
  • Dependency Bumps:
    • Bump vite from 5.4.20 to 5.4.21 in /timesketch/frontend-v3 by @dependabot[bot] in (#3558)
    • Bump happy-dom from 15.11.7 to 20.0.0 in /timesketch/frontend-ng by @dependabot[bot] in (#3556)
    • Build (deps): Bump the npm_and_yarn group with 3 updates by @dependabot[bot] in (#3577)
    • Bumping some frontend-ng packages by @jkppr in (#3565)

✨ New Features & LLM Integrations

Introducing new capabilities for analysis, including performance tracking and support for new providers.

  • New Providers:
  • Log Analyzer Improvements:
    • Improve Log Analyzer robustness and update JSON format by @jaegeral in (#3550)
    • Introduce a log_pretext in log_analyzer.py by @jaegeral in (#3552)
  • Performance Monitoring: Add performance monitoring to Timesketch by @jaegeral in (#3568)
  • tsctl Enhancement: Enhance tsctl sketch-info with data source details by @jaegeral in (#3585)

🐞 Bug Fixes & Stability

Important fixes addressing errors, preserving data integrity, and improving the user interface.

  • Time Filter UX:
  • Data Integrity: Fix: Preserve Sub-Second Timestamp Precision in timesketch_importer by @jaegeral in (#3578)
  • API Stability: Fix: AttributeError in Sketch API when user is admin and sketch non existant by @jaegeral in (#3582)
  • Minor Fixes: Fix: A small typo by @jaegeral in (#3580)

⚙️ Refactoring, Testing, & Platform

Updates to the underlying infrastructure, code quality, and testing environments.

  • Ubuntu 24.04 Migration:
    • Upgrade Docker development environment to Ubuntu 24.04 by @jkppr in (#3567)
    • Update release Dockerfile to use the Ubuntu 24.04 base image by @jkppr in (#3584)
    • Fix unit-tests for Ubuntu 24.04 containers by @jkppr in (#3569)
    • Fix: Start Ubuntu 24.04 e2e tests by @jaegeral in (#3524)
    • Fix: Make staging tests for Plaso 24.04 for now optional by @jaegeral in (#3583)
  • Error Handling & Debugging:
    • Refactor: Enhance JSON decoding error logging in API client by @jaegeral in (#3547)
    • Display contents of actual failed response by @tomchop in (#3559)
    • Feat: Log secGemini response to /tmp/ if timesketch app mode is set to DEBUG by @jaegeral in (#3562)
    • Feat: Enhanced e2e Test Debugging by @jaegeral in (#3549)
  • Test Suite Improvements:
    • Refactor (e2e): Move event-related tests to a dedicated file by @jaegeral in (#3554)
    • Test (e2e): Add sketch export functionality test by @jaegeral in (#3553)

📝 Documentation Updates

Documentation improvements to help users and developers understand new and existing features.

New Contributors

Full Changelog: 2025092...2025111

20250929

29 Sep 20:07
347715a

Choose a tag to compare

What's Changed

✨ New Features & Major Enhancements

  • [feat] Keep track of used time filters for searches by @Annoraaq in #3512
  • feat(opensearch): Add support for custom CA certificates by @jkppr in #3528
  • Enhance Scenario and Question API Client Functionality by @jkppr in #3508
  • Support Sec-Gemini log analysis agent: Refactor log_analyzer feature & sec-gemini provider by @itsmvd in #3536
  • Sketch delete by @jaegeral in #3261
  • [tsctl] Archive improvements by @jaegeral in #3431
  • Add support of SQLAlchemy engine options by @jbaptperez in #3481

📈 Improvements & Refinements

🐛 Bug Fixes

  • fix: remove "version" from the toplevel from docker-compose files by @jaegeral in #3510
  • refactor: s/prometheus_multiproc_dir/PROMETHEUS_MULTIPROC_DIR by @jaegeral in #3515
  • [Fix] Empty Sketch List Overview by @jkppr in #3527
  • [Fix] Update Yeti certificate handling by @jkppr in #3529
  • fix: Update importer.py error message for label import by @jaegeral in #3541
  • fix: [import_client] improve error message handling for importing_files by @jaegeral in #3539

⬆️ Dependency Updates

  • [CI] Remove python 3.9 checks by @jkppr in #3502
  • Bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #3520
  • Bump axios from 1.9.0 to 1.12.0 in /timesketch/frontend-v3 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3530
  • Bump sha.js from 2.4.11 to 2.4.12 in /timesketch/frontend-ng in the npm_and_yarn group by @dependabot[bot] in #3504
  • Bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #3531

Full Changelog: 2025080...2025092

20250807

07 Aug 08:31
443c10f

Choose a tag to compare

What's Changed

✨ New Features & Major Enhancements

📈 Improvements & Refinements

  • Feat: Enhance CSV parser for robust timestamp handling by @jaegeral in #3463
  • Refactor: Centralize OpenSearch Datastore Connection Configuration by @jkppr in #3483
  • Update upgrade.md by @matthewthomaskelly in #3464
  • [docs] Timesketch at Blackhat 2025 by @jkppr in #3474
  • Add documentation for Investigation View and AI features by @jkppr in #3485
  • [tsctl] display the latest timeskertch commit used on the system in tsctl by @jaegeral in #3473

🐛 Bug Fixes

⬆️ Dependency Updates

  • Bump form-data from 4.0.1 to 4.0.4 in /timesketch/frontend-v3 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3478

New Contributors

Full Changelog: 2025070...2025080

20250708

08 Jul 11:52
e82a1de

Choose a tag to compare

What's Changed

✨ New Features & Major Enhancements

📈 Improvements & Refinements

🐛 Bug Fixes

⬆️ Dependency Updates

  • Bump requests from 2.32.3 to 2.32.4 in the pip group by @dependabot in #3446
  • Bump pbkdf2 from 3.1.2 to 3.1.3 in /timesketch/frontend-ng in the npm_and_yarn group by @dependabot in #3456

Full Changelog: 2025052...2025070

20250521

21 May 08:56
e43a0b2

Choose a tag to compare

What's Changed

✨ New Features & Major Enhancements

  • Efficient Bulk Export with Opensearch using PIT and Slicing by @jkppr in #3409
  • tsctl:
  • cli client:

📈 Improvements & Refinements

  • AI/LLM:
    • Avoid needlessly calling the llm_summarize feature by @itsmvd in #3386
    • Initial Gemini Github Code Review bot config / Styleguide by @jaegeral in #3381
  • Testing / Code quality:
    • Add End-to-End Tests for tsctl by @jaegeral in #3383
    • Update E2E / unit Test Matrix (drop Ubuntu20) by @jaegeral in #3384
    • [Workflows] Add 30-minute timeouts to GitHub Actions workflow jobs by @jaegeral in #3396
    • Improve OpenSearch search method docstring and error logging by @jaegeral in #3414
    • Update scenarios.py by @jaegeral in #3420
    • Replacing timeline descriptions or names with IDs in various log by @jaegeral in #3417
    • [Workflows] Run unittests in paralell in github workflow by @jaegeral in #3400
    • Timesketch CLI and E2E Test Enhancements by @jaegeral in #3399
    • [API Client] Robustness and Readability Enhancements by @jaegeral in #3402
  • Others

🐛 Bug Fixes

⬆️ Dependency Updates

  • Update docker release version by @jkppr in #3380
  • Various updates to dependencies / versions by @jaegeral in #3391
  • Bump vite from 5.4.17 to 5.4.19 in /timesketch/frontend-v3 in the npm_and_yarn group across 1 directory by @dependabot in #3392
  • Bump vite from 5.4.17 to 5.4.19 in /timesketch/frontend-ng in the npm_and_yarn group by @dependabot in #3393
  • bump pandas version by @jaegeral in #3418

Full Changelog: 2025040...2025052

20250408

08 Apr 16:35
cdeed0c

Choose a tag to compare

What's Changed

✨ New Features & Major Enhancements

  • Core Functionality & API:
    • Add Support for Searching Processing Timelines by @jbaptperez in #3241
    • Add Timeline, SearchIndex and Datasource creation to client api by @Tijnoz in #2919
  • LLM Integration:
    • Add nl2q and llm_summarize as LLM features by @itsmvd in #3311
    • Add LLM features manager and interface by @itsmvd in #3308
    • Introduce LLMResource API method, tests, and add it as a method for the frontend by @itsmvd in #3310
    • Add Ollama provider with response schema support & create LLM provider directory by @itsmvd in #3306
    • Enhance LLM configuration handling and settings UI by @itsmvd in #3366
    • LLM provider fallback to default config by @itsmvd in #3307
  • Vue3 Frontend Migration:
  • tsctl (CLI Tool) Enhancements:

📈 Improvements & Refinements

  • UI/UX:
    • Make suggested queries the active questions tab by @dianakramer in #3313
    • Improve snackbar.js: add support for custom timeouts & small refactor by @itsmvd in #3330
  • Documentation:
    • Add initial admin & user documentation for LLM features by @itsmvd in #3301
    • Add instructions to load DFIQ templates to documentation by @jkppr in #3322
  • Testing:
  • Code Health & Refactoring:
    • Update pylint & astroid by @jkppr in #3329
    • Update api_client code for new pylint version by @jkppr in #3336
    • Update importer client for new pylint config by @jkppr in #3339
    • Update cli client for new pylint config by @jaegeral in #3340
    • Remove sketch.upload() from the api client (depracated for a long time) by @jaegeral in #3349
    • Update dfiq_analyzer/manager.py logging level by @jkppr in #3309
    • Update nginx.conf by @jkppr in #3318
  • Build, CI & Deployment:

🐛 Bug Fixes

  • Fix: Resolve race condition errors on first timeline upload with SEARCH_PROCESSING_TIMELINES=True by @jkppr in #3363
  • bugfix when llm_summarize tries to summarize no events by @itsmvd in #3378
  • Fix: Removal Logic Bug in Annotation Mixins by @jaegeral in #3323
  • [API] Fix on how timelines are listed Two new test cases around timeline listing. by @jaegeral in #3359
  • fix renaming in sidebar by @Annoraaq in #3326
  • Filtered back-ticks and other trailing characters from the resulting query by @dianakramer in #3304

⬆️ Dependency Updates

  • Bump vitest from 1.0.4 to 1.6.1 in /timesketch/frontend-ng in the npm_and_yarn group by @dependabot in #3280
  • Bump the npm_and_yarn group in /timesketch/frontend-ng with 2 updates by @dependabot in #3338
  • Bump the npm_and_yarn group in /timesketch/frontend-ng with 2 updates by @dependabot in #3361
  • Bump vite from 5.4.14 to 5.4.17 in /timesketch/frontend-ng in the npm_and_yarn group by @dependabot in #3376
  • Bump axios from 1.7.9 to 1.8.2 in /timesketch/frontend-v3 in the npm_and_yarn group across 1 directory by @dependabot in #3335
  • Bump vite from 5.4.14 to 5.4.16 in /timesketch/frontend-v3 in the npm_and_yarn group across 1 directory by @dependabot in #3370
  • Bump vite from 5.4.16 to 5.4.17 in /timesketch/frontend-v3 in the npm_and_yarn group across 1 directory by @dependabot in #3375
  • Bump axios from 0.21.4 to 0.29.0 in /timesketch/frontend by @dependabot in #3337
  • Bump the pip group with 2 updates by @dependabot in #3294
  • Bump gunicorn from 22.0.0 to 23.0.0 in the pip group by @dependabot in #3355

New Contributors

Full Changelog: 2025011...2025040