Anthropic-Cybersecurity-Skills/skills/building-incident-timeline-with-timesketch/references/standards.md

Standards and Frameworks for Timeline Analysis

NIST SP 800-86 - Guide to Integrating Forensic Techniques

• Provides guidelines for collecting, examining, and analyzing digital evidence
• Emphasizes importance of timeline reconstruction in incident investigation
• Defines evidence handling procedures for forensic analysis

SANS FOR508 - Advanced Incident Response, Threat Hunting, and Digital Forensics

• Super timeline creation methodology
• Evidence source prioritization for timeline building
• Plaso/log2timeline artifact parsing techniques
• Timeline analysis for APT detection

RFC 3339 / ISO 8601 - Timestamp Standardization

• Standard format for representing dates and times in timelines
• Timesketch normalizes all timestamps to UTC ISO 8601 format
• Ensures consistent chronological ordering across diverse sources

DFRWS (Digital Forensic Research Workshop) Standards

• Forensic timeline analysis research and best practices
• Timesketch presented at DFRWS conferences as reference implementation
• Evidence integrity and chain of custody in digital forensics

Plaso/log2timeline Documentation

• Official parser documentation for 200+ artifact types
• Filter file syntax for targeted evidence collection
• Output format specifications for Timesketch integration
• Reference: https://plaso.readthedocs.io/

OpenSearch/Elasticsearch Indexing Standards

• Event storage and retrieval optimization
• Index lifecycle management for large investigations
• Query DSL for advanced timeline searching

Sigma Detection Standard

• Open signature format for SIEM systems
• Timesketch Sigma analyzer integration
• Community detection rules for common attack patterns
• Reference: https://github.com/SigmaHQ/sigma

MITRE ATT&CK Framework Integration

• Mapping timeline events to ATT&CK techniques
• Tactic-based timeline segmentation
• Attack chain reconstruction methodology