mac_build_timeline
Correlate events from macOS forensic artifacts into a unified timeline. Filter by time, source, and keyword across logs, Safari history, and plists.
Instructions
Build a unified timeline from multiple forensic artifacts. Correlates events from unified logs, Safari history, KnowledgeC, and plists.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| keyword | No | Optional keyword to filter across all sources | |
| sources | No | Sources to include: unified_logs, safari, knowledgec, plists | |
| time_end | No | ISO datetime - end of time window | |
| time_start | No | ISO datetime - start of time window | |
| artifacts_dir | Yes | Path to triage collection root |