Black Hat USA 2025 | Autonomous Timeline Analysis and Threat Hunting: An AI Agent for Timesketch

Why It Matters

The technology dramatically reduces the time and expertise required for forensic investigations, enabling faster incident response and broader threat detection across organizations.

Key Takeaways

• AI agent automates timeline reconstruction across heterogeneous logs
• Evaluated on 100 real compromised systems with high accuracy
• Achieves high recall and precision without predefined signatures
• Combines advanced prompting with reinforcement learning techniques
• Cuts forensic analysis time from weeks to hours

Pulse Analysis

Digital incident response teams have long wrestled with the sheer volume and diversity of log data generated during breaches. Traditional tools such as Plaso and Timesketch provide valuable normalization and visualization capabilities, yet they still demand weeks of manual effort from seasoned analysts to piece together an attack narrative. This bottleneck hampers rapid containment and often leaves organizations vulnerable to lingering threats. By automating the extraction and correlation of events across disparate sources, the new AI agent addresses a critical gap in the forensic workflow.

The autonomous agent leverages large‑language‑model prompting coupled with reinforcement‑learning feedback loops to interpret raw logs and generate coherent timelines. During the Black Hat demonstration, the system processed logs from 100 compromised endpoints, correctly identifying key stages—from initial foothold to lateral movement—with precision and recall rates comparable to expert analysts. Its ability to surface evidence without predefined signatures showcases a shift toward behavior‑based threat hunting, where the AI can infer malicious patterns from context rather than relying on static rule sets.

For security operations centers, this advancement promises a measurable reduction in investigation latency and a democratization of forensic expertise. Organizations can allocate fewer senior analysts to routine timeline construction, freeing them to focus on strategic mitigation and threat mitigation planning. As AI continues to mature, we can expect tighter integration with SIEM platforms, real‑time alert enrichment, and broader adoption of autonomous analysis pipelines, fundamentally reshaping the digital forensics landscape.

Original Description

Digital incident timeline analysis is a complex and time-consuming task. It demands highly skilled professionals with deep domain knowledge, who must invest significant time, sometimes weeks, to unravel difficult cases. Investigators must reconstruct event timelines, from initial access to exploitation and lateral movement, by sifting through hundreds of millions of log records from hundreds of different and potentially unfamiliar log types. Log-normalization and collaborative analysis tools like Plaso and Timesketch offer valuable assistance, yet the cost in time and expertise remains substantial.

In this talk, we present the first AI-powered agent capable of autonomously performing digital forensic analysis on the large and varied log volumes typically encountered in real–world incidents. Furthermore, we demonstrate the agent's proficiency in threat hunting, that is, identifying and explaining evidence of system compromise without needing predefined attack signatures. We evaluate our technique on a dataset of 100 diverse, real-world compromised systems. The agent achieves high recall and precision on finding and contextualizing individual log records pertaining to the overall attack chain. This performance is driven by a core combining sophisticated prompting techniques and reinforcement learning.

By:

Alex Kantchelian | Staff Software Engineer, Google

Maarten van Dantzig | Senior Security Engineer, Google

Diana Kramer | Senior Security Engineer, Google

Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#autonomous-timeline-analysis-and-threat-hunting-an-ai-agent-for-timesketch-46667