log2timeline/plaso

Health v2 · maintenance only

Adoption not part of the score

2176 stars · 431 forks observed · 2026-10-21

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Plaso (log2timeline) is a Python-based engine for automatically creating super timelines from timestamped events found in logs and files on computer systems. It is a extensible framework with parser and analysis plug-ins used widely in digital forensic investigations (DFIR).

Use cases

• create a super timeline of events from a disk image
• parse windows event logs and browser history for forensic analysis
• correlate timestamps from many file formats into one timeline
• build a timeline of user activity during an incident response
• write custom parsers for forensic artifacts
• automate repetitive forensic log analysis tasks

When to choose

• you need to aggregate timestamped events from many sources into a single forensic timeline
• you are a DFIR investigator analyzing a compromised system
• you want an extensible framework for writing custom artifact parsers

When to avoid

• you only need simple log aggregation without timestamp correlation
• you need real-time log monitoring rather than post-hoc analysis
• you want a GUI-only forensic suite

Facets

framework · maturity active

parser etl search-engine cli security developer-tools files python windows cli digital-forensics dfir timeline-analysis log-parsing incident-response forensics linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="log2timeline/plaso")