20240328

Note
Upgrading to this Timesketch version requires a database upgrade!
See https://timesketch.org/guides/admin/upgrade/ for more details.

What's Changed

• DFIQ new UI and navigation by @berggren in #3041
• User profile and settings support by @berggren in #3048
• Enhancements to Yeti indicators by @tomchop in #3038
• More precise field selection when searching by @tomchop in #3044
• Use subqueryload to make loading events with comments faster by @tomchop in #3049
• Improvements to the sigma handling by @tomchop in #3050
• Update run_analyzers in the api client by @jkppr in #3037
• Fix a bug in the feature_extraction analyzer by @jkppr in #3047

Full Changelog: 2024020...2024032

20240207

What's Changed

• Collapsable left panel by @berggren in #3008
• Support for Large Language Model (LLM) services by @berggren in #3019
• Implement user management (create, list, get) via API by @lo-chr in #3024
• Setup frontend unit tests with vitest by @Annoraaq in #3013
• Fix failing Plaso uploads after 6 months by @jkppr in #3017
• Fix error handling in the API client by @jkppr in #3006
• Add optional TLS verification by @tomchop in #3016
• Yeti analyzer fix: use session object by @tomchop in #3020
• Adjust query for Yeti indicators by @tomchop in #3009
• Mark events with indicator's relevant_tags (Yeti) by @tomchop in #3022
• Bump cryptography from 41.0.4 to 41.0.6 by @dependabot in #2998
• SQLalchemy upgrade - step one by @berggren in #2979
• Fix: get and use access token for Yeti by @tomchop in #3010
• Adding form validation to prevent names > 255 char. by @jkppr in #3026
• Update black formatting by @jkppr in #3031
• Timesketch API client: Adding type check to prevent error. by @jkppr in #3030
• Fix double escaping in sigma_util causing yaml.parser.ParserError by @lo-chr in #3028
• Move "old UI" button by @jkppr in #3033
• UI build 20240207 by @jkppr in #3035

New Contributors

• @lo-chr made their first contribution in #3028

Full Changelog: 2023120...2024020

20231206

What's Changed

• Left panel timeline management by @Annoraaq in #2999
• Extract Windows event logs messages attributes by @roshanmaskey in #2910
• API client: Return all field for analysis sessions by @tomchop in #2504
• Highlight DFIQ context card by @berggren in #2996
• Introduce (large) CSV import in e2e tests by @jaegeral in #2912
• "Add to Threat Intelligence" via context links by @jkppr in #2980
• Graph bug and layout fix by @berggren in #2994
• Feature extraction config for BITS and Terminal Services by @roshanmaskey in #2974
• Adjust default example text for yeti endpoint by @tomchop in #2963
• Adding a copy action to filter chips by @JohannesLks in #2990
• Update to the windows deployment script by @coloradosarge in #3000
• Adding and updating tooltips for icons by @jkppr in #2983
• Fix hidden text by @jkppr in #2965
• bug-fix for context links by @jkppr in #2962
• Update for upgrade documentation by @jkppr in #2967
• Removing old feature extractor analyzer by @jkppr in #2969
• Update for the context_links documentation by @jkppr in #2970
• Updating the feature extraction analyzer documentation by @jkppr in #2973
• [tests] Add jsonl e2e tests by @jaegeral in #2976
• Fix vue dependency issues with "v-calendar" by @jkppr in #2989
• Mute noisy info logging in the feature extraction analyzer by @jkppr in #2993
• New empty-state and left panel bugfix by @berggren in #2991
• Update the analyzer timeline picker by @jkppr in #3001
• UI build 20231206 by @jkppr in #3002

New Contributors

• @JohannesLks made their first contribution in #2990
• @coloradosarge made their first contribution in #3000

Full Changelog: 2023102...2023120

20231025

Note
Upgrading to this Timesketch version requires a database upgrade!
See https://timesketch.org/guides/admin/upgrade/ for more details.

What's Changed

• filter chip fixes by @jkppr in #2893
• Adding multi analyzer result support by @jkppr in #2894
• Fix CSV upload without timestamp_desc by @jkppr in #2896
• Bump cryptography from 41.0.3 to 41.0.4 by @dependabot in #2904
• Deprecate Sigma status CSV usage from code by @jaegeral in #2913
• Add intelligence command to the CLI client by @jaegeral in #2864
• UI build 2023-10-05 by @jkppr in #2926
• Fix missing plaso_formatters by @jkppr in #2933
• Refactor base layout by @berggren in #2929
• ui build 20231010 by @jkppr in #2934
• Fix #2908 tagger bug by @jkppr in #2935
• Update yeti analyzer by @tomchop in #2930
• Adjusting regular expressions for features extraction by @tomchop in #2932
• [Documentation] timesketch_client.TimesketchApi in api client documentation by @jaegeral in #2938
• Improvements to the Yeti analyzer by @tomchop in #2942
• Truncate timeline names in analyzer results by @jkppr in #2945
• API client method to delete Sigma rule by @jaegeral in #2924
• Fix missing sketchId in Search.vue by @jkppr in #2955
• Unfurl integration by @jkppr in #2897
• Copy saved search ID by @jkppr in #2956
• Support emojis in new UI by @NightAcrobat777 in #2951
• SSL/TLS support and authentication for SMTP by @fazledyn-or in #2940
• Instantiate side panel only once by @berggren in #2949
• Unit test to ensure invalid timestamp conversions do not occur by @bwhelan212 in #2954
• Add DFIQ context to SearchHistory by @berggren in #2957
• Sanitise HTML from Unfurl by @berggren in #2959
• Context link backwards compatibility & sanitation by @jkppr in #2958
• UI build 2023-10-25 by @jkppr in #2960

New Contributors

• @NightAcrobat777 made their first contribution in #2951
• @fazledyn-or made their first contribution in #2940
• @bwhelan212 made their first contribution in #2954

Full Changelog: 2023091...2023102

20230913

What's Changed

• [Analyzers] Spelling errors by @jaegeral in #2860
• correct paramters in cli attributes method by @jaegeral in #2863
• Update troubleshooting.md by @jaegeral in #2866
• adding timeline info to the tsctl by @jaegeral in #2870
• Feature extraction for TI data in "Windows-Bits-Client" events by @jkppr in #2873
• Update Date chip to support milliseconds by @sydp in #2867
• Allow API port to listen on localhost by @tomchop in #2875
• Loading indicator active analyzers by @Annoraaq in #2855
• OpenSearch 2.x support by @berggren in #2876
• ui build 20230831 by @jkppr in #2878
• Bump cryptography from 41.0.2 to 41.0.3 by @dependabot in #2858
• Add TTY check for providing missing config values by @ramo-j in #2850
• Don't exit with error if user chooses not to start timesketch by @pemontto in #2857
• Export query result to CSV by @berggren in #2882
• Run analyzers only once per timeline by @jkppr in #2883
• Support overriding/extending Plaso formatter definitions by @berggren in #2881
• New UI build (automated) by @berggren in #2884
• Tag list refactor & bug fixes by @jkppr in #2886
• Event attribute include / exclude filters by @jkppr in #2888
• refactor verbose analyzer output by @jkppr in #2885
• Analyzer Output UI update by @jkppr in #2887
• Adding tag filter chips to sigma rules by @jkppr in #2890
• Search History graph cleanup by @berggren in #2891
• UI build 20230913 by @jkppr in #2892

Full Changelog: 2023072...2023091

20230721

What's Changed

• fixes #2809 UI bug by @jkppr in #2810
• Timeline and Scenarios fixes + small UI fixes by @berggren in #2808
• Show selected event in context view by @berggren in #2811
• Consitent forms and cleaned up XML viewer by @berggren in #2812
• Remove ports from e2e-tests by @berggren in #2816
• Update Account Finder Analyzer by @jkppr in #2803
• Delete sketch and list archived sketches by @berggren in #2817
• Add json and tab output to CLI client by @jaegeral in #2818
• [CLI] Add output-format as cli wide argument by @jaegeral in #2819
• Update hashR analyzer by @jkppr in #2820
• [CLI] refactor to use central output-format by @jaegeral in #2821
• Support OpenSearch queries in DFIQ by @berggren in #2822
• Add Windows Lateral Movement DFIQ scenario by @berggren in #2823
• Adding hashR user documentation by @jkppr in #2824
• New UI build by @berggren in #2828
• Update tsdev.sh to add creation of api client and cli client by @jaegeral in #2830
• fix mkdocs warnings by @jkppr in #2832
• fix docs formatting by @jkppr in #2833
• Add a test case for conditions with multiple words in a Sigma rule by @jaegeral in #2835
• Always set active timelines by @berggren in #2838
• Preserve user defined filters by @berggren in #2840
• Support event list sorting (asc/desc) by @berggren in #2843
• Rework comments by @jkppr in #2845
• Upgrade to PyYAML 6.0.1 and NodeJS 18 by @berggren in #2853
• Bump cryptography from 41.0.0 to 41.0.2 by @dependabot in #2844
• Documentation updates for analyzers by @jkppr in #2851
• Add timesketch analyze results to the CLI client by @jaegeral in #2846
• Manage sketch attributes in the CLI client by @jaegeral in #2841
• New UI build and update version numbers by @berggren in #2854

Full Changelog: 2023062...2023072

20230628

What's Changed

• Update changelog by @berggren in #2768
• Scenarios model refactor by @berggren in #2672
• Ssh bruteforce analyzer by @roshanmaskey in #2769
• Add missing dependency for e2e container by @berggren in #2783
• 🐛 Handle None response from ip2geo by @pemontto in #2770
• Fix #2784 - pandas.read_csv arguments by @jkppr in #2785
• Add tzdata to all container builds by @berggren in #2788
• Fix for #2738 - Analyzer not in AnalyzerList by @jkppr in #2786
• Fixing #2393 - analysis of broken timelines by @jkppr in #2787
• Helm k8s by @wajihyassine in #2661
• Enable settings from environment (needs Flask 2.1+) by @bpereto in #2417
• Add 🐀 emoji for remote access tools by @pemontto in #2779
• Switch to Compose V2 by @koromodako in #2654
• Return user defined aggregation name when using the API client by @sydp in #2507
• Bump cryptography from 39.0.1 to 41.0.0 by @dependabot in #2778
• Bump pyjwt from 1.7.1 to 2.4.0 by @dependabot in #2192
• Update Helm README to refer to OSDFIR Infrastructure by @wajihyassine in #2790
• DFIQ support by @berggren in #2782
• Fix for importing small JSONL files by @berggren in #2793
• Restyle timeline chips by @Annoraaq in #2777
• Windows bruteforce analyzer by @roshanmaskey in #2792
• Automate verbose analyzer output metadata collection by @jkppr in #2798
• Update the event tags UI by @jkppr in #2805
• UI support for verbose analyzer output by @jkppr in #2797
• New UI build (automated) by @berggren in #2806

New Contributors

• @bpereto made their first contribution in #2417
• @koromodako made their first contribution in #2654

Full Changelog: 2023052...2023062

20230526

Version 20230526

What's Changed

• Minor fixes/updates for AggregateDialog by @sydp in #2726
• Implicit String Fix by @LX5321 in #2650
• 🐛 Fix invalid sigma YAML by @pemontto in #2757
• Ensure that upload path is valid by @berggren in #2763
• Update to Flask 2.3.x and dependencies by @berggren in #2764
• New UI build (auto generated) by @berggren in #2767

New Contributors

• @LX5321 made their first contribution in #2650

Full Changelog: 2023051...2023052

20230518

Timesketch release 20230518

What's Changed

• Added provider/context for uploads in the importer by @kiddinn in #1640
• Added provider/context to the CLI importer tool. by @kiddinn in #1644
• Added data source DB model by @berggren in #1642
• [API] introduce text --> sigma rule by @jaegeral in #1511
• Replace use of the csv library by pandas built-ins for data ingestion by @rayanht in #1534
• Added a Timesketch CLI client by @berggren in #1414
• Fixed couple of bugs in the sigma API and API Client by @jaegeral in #1646
• Docker: e2e / dev Sigma directory was not created before by @jaegeral in #1650
• Add the ability to use elasticsearch with SSL but without username/password authentication. by @alexgoedeke in #1645
• Mention end2end tests in dev guide by @jaegeral in #1651
• Another round of minor checks where unittests did not reflect the reality by @jaegeral in #1647
• fixing some lint issues in the the e2e Docker readme file by @jaegeral in #1653
• Bump sigmatools pypi version up by @jaegeral in #1633
• Added search templates to API and API client by @kiddinn in #1643
• Forgot to include the searchtemplate.py file in the last PR by @kiddinn in #1655
• Prometheus metric collection by @berggren in #1611
• Update 2021_timesketch_summit.md by @jaegeral in #1658
• Add external talk to the agenda by @jaegeral in #1660
• Fixed limitations in file size in the data source model. by @kiddinn in #1662
• Cleaned up some of the API code. by @kiddinn in #1657
• Made slight changes to the API client and REST API. by @kiddinn in #1664
• Update marked library by @berggren in #1668
• Remove reg form and update agenda by @jaegeral in #1672
• Added several enhancements to the importer and importer tasks. by @kiddinn in #1667
• Update 2021_timesketch_summit.md by @jaegeral in #1675
• Fixed a bug in data ingestion by @kiddinn in #1674
• Changed how we fill in NAN values while ingesting CSV files. by @kiddinn in #1676
• Update installation/upgrading docs by @berggren in #1678
• Added instructions on how to install a notebook container by @kiddinn in #1681
• Minor bug fixes to the API client by @kiddinn in #1686
• Added a new documentation site by @berggren in #1680
• Added a PR template. by @kiddinn in #1688
• Moved the PR template to a file instead of a folder. by @kiddinn in #1689
• Fixed few bugs in the API and alpha sorted saved searches by @kiddinn in #1691
• Fix broken links in README.md by @stevengoossensB in #1696
• [Tiny fix] Updated link for Docker installation process by @toshiro92 in #1702
• Update sigma.md by @jaegeral in #1705
• Changed how import errors are presented as well as ability to change passwords for the current user. by @kiddinn in #1700
• Changed how ES object is created to support auth without ssl, as well as minor bug fix in analyzer selection. by @kiddinn in #1710
• Changed upload behavior when appending to an already existing timeline by @kiddinn in #1712
• Use DataSource error message and UI cleanup by @berggren in #1713
• UI: Quick typo fix, and change provider string from the importer library by @berggren in #1714
• UI: Remove old error field by @berggren in #1719
• Always uniq index lists by @berggren in #1718
• Added upper memory limits to psort. by @kiddinn in #1722
• Allow other OIDC providers for authentication by @asmirazali in #1717
• Update developer-guide.md by @jaegeral in #1725
• UI: Fixing a bug in the Interval time filters by @binglot in #1598
• Moved the Notebook.md to learn/notebook.md to correspond to where the docs point to it. by @kiddinn in #1732
• Removed index analyzers and changed API/import client. by @kiddinn in #1723
• introduce tags in the sample rule and add tags from the rule to the s… by @jaegeral in #1735
• Add Get Timesketch client object into dev/notebook snippet by @jaegeral in #1737
• Set timeline ID in the GCS importer by @berggren in #1738
• fix the bug by @jaegeral in #1741
• Introduce os filsystem in sigma mapping by @jaegeral in #1734
• Sigma api e2e by @jaegeral in #1730
• Timeline name is not an optional field, changed text to avoid confusion by @itsmvd in #1747
• Added the ability to ingest data ingested by other means than through Timesketch backend by @kiddinn in #1383
• Prevent users from uploading unsupported file formats by @itsmvd in #1751
• Added generic mappings for CSV/JSON ingestion by @lprat in #1753
• Changed how duplicate attributes are displayed when adding manual eve… by @warrinot in #1758
• Bugfix: Error messages not showing in the UI by @berggren in #1765
• Search history by @berggren in #1757
• Refactor frontend by @berggren in #1746
• refactor and bugfix by @berggren in #1769
• Add metrics to SearchHistory actions by @berggren in #1770
• Bugfix: Navigation error by @berggren in #1771
• Bugfix: Ensure correct root history node is fetched by @berggren in #1773
• Change default search operator by @berggren in #1775
• Bugfix: Navigation links by @berggren in #1778
• Fixed some links pointing to non-existing docs by @warrinot in #1776
• Bugfix: Not able to star events by @berggren in #1784
• Changed how sketch attributes are stored and read from datastore. by @kiddinn in #1789
• Broken link in getting started by @jordanrule in #1788
• Fixed a minor issue in the attribute REST API. by @kiddinn in #1790
• Changed how sketch attributes are handled. by @kiddinn in #1792
• UI: Expose sketch attributes by @tomchop in #1793
• Fix broken attribute count in navbar by @tomchop in #1795
• UI: Use prettier formatter consistently by @berggren in #1798
• UI: Expose sketch attributes through a dynamic table display component by @tomchop in #1796
• Added regular expressions into the tagging analyzer to provide more flexibility. by @kiddinn in #1768
• Add Youtube Channel and Twitter account to docs by @jaegeral in #1802
• Fix typo: encourage by @nagytam in #1799
• Updated Sigma tagging, few improvements by @jaegeral in #1766
• Added a data analyzer by @kiddinn in #1791
• Sigma verify tool improv by @jaegeral in #1804
• Added a small logger statement in the importer client. by @kiddinn in #1806
• Add additional regexes to extract IP addresses from sshd messages by @itsmvd in #1809
• Update developer guide by @tomchop in #1808
• Change default font by @berggren in https://github.com...

20210224

Release 20210224

What's Changed

• Various updates to the API Client by @kiddinn in #1542
• Update SearchQueryGuide views by @jaegeral in #1550
• Fix remove_timeline_label() permission check by @rgayon in #1544
• Changes to dpkg configuration for release by @joachimmetz in #1546
• Adding additional sleep to e2e tests. by @kiddinn in #1551
• Move stories to metadata by @berggren in #1552
• Bugfix: Handle system generated stories by @berggren in #1553
• Update Axios package by @berggren in #1554
• Misc UI fixes by @berggren in #1555
• Timesketch summit 2021 by @jaegeral in #1557
• Changes to API and API client by @kiddinn in #1562
• Added new IP address related feature extractors by @itsmvd in #1563
• Minor API client changes by @kiddinn in #1566
• First phase of new way of storing data in TS. by @kiddinn in #1565
• corrects README doc link to Sigma by @ghchinoy in #1571
• hyphen error in readme by @neilgoyal in #1572
• New storage - UI fix [phase one] by @berggren in #1573
• Adding datetime limits on the aggregation bucket. by @kiddinn in #1568
• Changing __timeline_id to __ts_timeline_id and fixing build_query by @kiddinn in #1574
• Adding the ability to check whether a given index has __timeline_id in it. by @kiddinn in #1569
• New build and DSL bugfix by @berggren in #1575
• New storage - UI fix for counting documents by @berggren in #1576
• UI: Dedicated analysis tab by @berggren in #1577
• Simplified regex for IPv4 features by @itsmvd in #1581
• Small bugfix in SSH features regex by @itsmvd in #1582
• UI: Timeline tab and removing ability to add old indices to sketches by @berggren in #1583
• UI: Move aggregations to its own tab by @berggren in #1584
• Bugfix: Wrong query count for new style timelines by @berggren in #1585
• Index Change: Changed plaso file ingestion, added query_dsl support and analyzer support by @kiddinn in #1578
• UI: Set status on timeline by @berggren in #1587
• UI: Add loading spinner while searching by @berggren in #1589
• Adding timeline supports into aggregations. by @kiddinn in #1588
• Updated e2e tests after plaso change and the run_plaso task to match and added timeline_id support to graphs by @kiddinn in #1590
• UI: Support index and time range filters in aggregations by @berggren in #1592
• Moved docker configs to the dev GIFT PPA by @kiddinn in #1595
• Deprecated the option to import timelines in tsctl. by @kiddinn in #1594
• Fixed a minor issue with Docker files by @kiddinn in #1599
• UI: Shifted filter buttons & added button titles by @binglot in #1597
• Fixed #1600 by adding mappings to deployment script. by @kiddinn in #1601
• Bump cryptography from 3.3.1 to 3.3.2 by @dependabot in #1604
• Extract IP address from RdpCoreTS event logs by @itsmvd in #1605
• Upgraded the importer version by @kiddinn in #1606
• Add .venv to .gitignore by @jaegeral in #1608
• Set correct timeline for analysis pipeline by @berggren in #1613
• UI: Fix missing timeline color by @berggren in #1612
• UI: Cleanup formatting by @berggren in #1614
• Fixed few issues: large text file imports, aggregations failing and upgrading PPA in docker files by @kiddinn in #1610
• Add ESLint GH action by @berggren in #1616
• Fixed issues with running analyzers in API client. by @kiddinn in #1623
• Minor bug fixes. by @kiddinn in #1625
• UI: Fix wrong timeline id in aggregations by @berggren in #1624
• Issue when removing timeline with a shared index by @kiddinn in #1626
• Added more error handling into the API, as well as retry to flushing events queue. by @kiddinn in #1627
• adding concepts and API dev guide by @jaegeral in #1618
• Increased timeout value for bulk inserts by default, also made it configurable. by @kiddinn in #1628
• Update docker-compose.yml by @berggren in #1631
• Update ES version for release docker by @berggren in #1632
• Update pylint by @berggren in #1635
• Pinned pylint version by @kiddinn in #1636
• Pinned astroid to version 2.4.0 in linter action by @kiddinn in #1637
• Spelling in some files comments by @jaegeral in #1634
• Release 20210224 by @berggren in #1638

New Contributors

• @ghchinoy made their first contribution in #1571
• @neilgoyal made their first contribution in #1572

Full Changelog: 2020122...2021022