Skip to content

Timesketch at Black Hat USA 2025 & defcon 33

Find links for all the topics we talked about below.

Timesketch

Sec-Gemini Log Analysis Capability

Sec-Gemini and its Log Analysis Capability are experimental research. The team is looking for trusted testers for access to the Log Reasoning Capabilities:

Exploration Graph & Killchain

AI Exploration Graph Example

Coin Mining Kill Chain Example

Talks & Demos

Black Hat Briefing: Autonomous Timeline Analysis and Threat Hunting - An AI Agent for Timesketch

The Timesketch team has partnerd with the Sec-Gemini research team to develop an experimental Log Reasoning Agent. This session will dive deeper into the architecture, capabilities, and development of the Sec-Gemini Log Reasoning Agent. We will discuss the challenges and breakthroughs in creating an AI for log analysis.

Link: View on Black Hat Briefing Schedule

Black Hat Arsenal: Timesketch - AI-Powered Super Timeline Analysis

Come see a demonstration of the new Investigation View workflow. We'll showcase how an analyst can trigger an external AI agent to process millions of events, automatically generating and populating Digital Forensics Investigative Questions (DFIQ). Discover how this AI-assisted workflow helps analysts rapidly triage findings, synthesize conclusions, and accelerate the reporting process.

Link: View on Blackhat Arsenal Schedule

defcon 33

We will be running some presentations and demos at the AI Village at defcon 33. Come and discuss with us the challenges of working with AI in DFIR investigations and explore a demonstration of the AI Investigation View in Timesketch.

Link: Scheduling TBD