Skill UI

Timesketch is a powerful, open-source tool for security teams to build collaborative forensic timelines. It ingests, normalizes, and analyzes multi-source event data—including logs, artifacts, and Plaso outputs—to reconstruct complex attack chains and document incident investigations. Ideal for joint analysis and deep dive DFIR work.

This skill provides comprehensive forensic analysis of cryptocurrency payment flows stemming from ransomware attacks. It leverages blockchain APIs and advanced techniques to identify wallet clusters, track fund movement through obfuscation methods like mixers and peel chains, and map funds to exchanges. It is crucial for law enforcement, incident responders, and threat intelligence analysts conducting ransomware attribution.

This specialized skill is designed for Digital Forensics and Incident Response (DFIR) scenarios. It correlates evidence from multiple disparate sources—including EVTX, PCAP, registry, memory, and filesystem artifacts—to build a comprehensive, ordered, and replayable forensic timeline. Use it when the goal is to map the full sequence of attacker actions, establishing initial access, lateral movement, and persistence chains based on cross-source evidence correlation.