# Forensic Timeline Investigation Report Template

## Case Information

| Field | Details |
|-------|---------|
| Case ID | |
| Sketch Name | |
| Lead Investigator | |
| Date Started | |
| Timesketch Instance | |
| Number of Timelines | |
| Total Events Indexed | |

## Evidence Sources

| Timeline Name | Source Type | Host/System | Events | Time Range |
|--------------|------------|-------------|--------|------------|
| | Windows EVTX | | | |
| | Plaso Full | | | |
| | Cloud Logs | | | |
| | Network Logs | | | |

## Investigation Objectives

1. [ ] Determine initial access vector
2. [ ] Identify compromised accounts
3. [ ] Map lateral movement paths
4. [ ] Identify persistence mechanisms
5. [ ] Determine data access and exfiltration
6. [ ] Establish complete attack timeline

## Attack Timeline Summary

| Time (UTC) | Event | Source | Host | ATT&CK Technique | Tags |
|------------|-------|--------|------|-------------------|------|
| | | | | | |

## Key Findings

### Finding 1: [Title]
- **Timesketch Search:** `[query string]`
- **Events:** [count]
- **Time Range:** [start] to [end]
- **Description:** [analysis]
- **Impact:** [assessment]

## Analyzers Run

| Analyzer | Results | Findings |
|----------|---------|----------|
| Sigma Rules | | |
| Domain Analyzer | | |
| Chain of Events | | |
| Feature Extraction | | |

## Saved Views

| View Name | Query | Purpose |
|-----------|-------|---------|
| | | |

## IOC Summary

### IP Addresses
### Domains
### File Hashes
### User Accounts

## Recommendations

1.
2.
3.

## Appendix
- Timesketch sketch export
- Full query list
- Plaso parser configuration
