In this post I will go through all the steps of setting up an automated processing pipeline for generation of timelines using Velociraptor, Plaso and Timesketch.  Based on this fantastic project by ReconInfoSec  timeline generation from Kape forensic artifacts collected by Velociraptor can be automated and implemented at Enterprise scale using open-source software.  The purpose of this post is to provide a more detailed explanation of how to deploy velociraptor-to-timesketch Prerequisites :  Velociraptor instance: I will cover setting up Velociraptor in another post An AWS instance for installing Timesketch and timesketch-to-velociraptor (as least 8GiB memory). I am using Ubuntu Server 22.04 LTS t2.xlarge. Overview of Components : Server Monitoring Artifact , Server.Utils.BackupS3, on Velociraptor will monitor clients for any Artifacts matching "Windows.KapeFiles.Triage" and automatically upload to S3 storage. watch-s3-to-timsketch.py watch s3 bucket for new zi...