# log2timeline/plaso

Super timeline all the things

Repository: https://github.com/log2timeline/plaso
Canonical: https://ross.abutalabs.com/products/plaso
Homepage: https://plaso.readthedocs.io
Language: Python
License: Apache-2.0
License Family: permissive
Topics: forensics, parsing, timeline
Last push: 2026-08-03T04:16:33+00:00

## Health v2 (maintenance only)
Score: 87/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 95, release rhythm 69, longevity 100
- inputs: {"age_days": 4377, "days_push": 30, "days_rel": 44, "gap_med": 108, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2140, forks 423 (observed 2026-08-28T04:06:18.348111+00:00)

## What it is
Plaso (log2timeline) is a Python-based engine for automatically creating super timelines from timestamped events found in logs and files on computer systems. It is a extensible framework with parser and analysis plug-ins used widely in digital forensic investigations (DFIR).

## Use cases
- create a super timeline of events from a disk image
- parse windows event logs and browser history for forensic analysis
- correlate timestamps from many file formats into one timeline
- build a timeline of user activity during an incident response
- write custom parsers for forensic artifacts
- automate repetitive forensic log analysis tasks

## When to choose
- you need to aggregate timestamped events from many sources into a single forensic timeline
- you are a DFIR investigator analyzing a compromised system
- you want an extensible framework for writing custom artifact parsers

## When to avoid
- you only need simple log aggregation without timestamp correlation
- you need real-time log monitoring rather than post-hoc analysis
- you want a GUI-only forensic suite

## Facets
- artifact type: framework
- maturity: active
- function: parser, etl, search-engine, cli
- domain: security, developer-tools, files
- platform: python, windows, cli
- tags: digital-forensics, dfir, timeline-analysis, log-parsing, incident-response, forensics, linux, macos

## Member repositories
- log2timeline/plaso (main) score 87

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:18.348111+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:51:29.137071+00:00, confidence not recorded.
  - readme: https://github.com/log2timeline/plaso (fetched 2026-08-28T04:06:18.348111+00:00, sha a4b2448788f5)
  - registry_pypi: https://pypi.org/pypi/plaso/json (fetched 2026-08-29T10:31:58.225275+00:00, sha 41278f8c7a76)
- Data as of 2026-08-30T08:39:29.467469+00:00.