search

google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.59k stars 590 forks source link

Split timelines in sub timlines #1891

Open jaegeral opened 3 years ago

jaegeral commented 3 years ago

Sometimes it might be handy to split a timeline into multiple timelines, e.g. to only run an analyzer on a subset of events.

A timeline is just an ID that is added as an attribute to events. So if you filter out the events you want to split out, create a new timeline DB object and then edit the __ts_timeline_id attribute you should in theory get a second timeline.

jaegeral commented 3 years ago

This feature would have touching points on all the stack, from API to API client and of course UX to expose it to users.