Base
Hardened build
minimal ports, security patches applied at build time
Timesketch on Ubuntu 24.04 LTS
Azure
Security
Timesketch, a collaborative forensic timeline analysis platform where an investigation team works one shared timeline instead of separate spreadsheets.
Overview
Timesketch is an open source platform for collaborative forensic timeline analysis. Investigators load timelines from evidence, in plaso storage format, CSV or JSONL, into a shared sketch and then search, filter and pivot across millions of combined events at once. Findings are recorded on the timeline itself: events can be tagged, starred, commented on and annotated, saved views capture a line of enquiry so it can be returned to or handed over, and stories turn a sequence of events into a written narrative with the underlying evidence still attached. Sigma rules can be run across ingested timelines to surface known suspicious patterns automatically.
Because a sketch is shared, several analysts can work the same timeline at the same time with every annotation attributed, which suits incident response where a team is reconstructing what happened under time pressure, digital forensics casework, threat hunting across host and network artefacts, and teaching or exercise environments where a worked timeline is the teaching material.
Why the cloudimg image
Timesketch is a multi service stack, a web application, an ingest worker, a search cluster, a database and a task queue, and upstream ships sample secrets in its configuration, including a published placeholder signing key. cloudimg replaces every one of them before the platform is ever reachable. The administrator account, the database password, the application signing key and the task queue password are generated uniquely on the first boot of each instance, and the published image contains no database, no search index and no configured secret at all, because the live configuration is deleted at build time and rebuilt from secret free templates on first boot. The application is held back from starting until those first boot credentials are actually in place, so an instance can never come up on a build time default. Because this platform holds evidence, the search cluster, database and task queue are reachable only on the internal container network and never from the internet, and every image is verified by enumerating its listeners to prove it. The search cluster is sized automatically from the memory of the machine you launch on rather than a value fixed at build time, so it is tuned correctly on any instance size. Every image is proven by creating a real sketch and ingesting a real timeline, and ships with a paired deploy guide and 24/7 cloudimg support.
Common uses
- Incident response timeline reconstruction across combined evidence sources
- Collaborative digital forensics casework with attributed annotations
- Threat hunting and Sigma rule matching over ingested timelines
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.