What is the primary function of Plaso (log2timeline) in timeline analysis?

• A. Visualize data in Timesketch
• B. Encrypt data
• C. Create timelines from log files and artifacts
• D. Generate firewall rules

Answer: (C)

Plaso, or log2timeline, is used to transform disparate forensic artifacts into a single, coherent timeline. It does this by running a broad set of parsers that understand many log formats and artifact types—from operating system logs to application logs and browser histories. Each parsed item yields an event with a timestamp and contextual data. Plaso then normalizes these timestamps to a common standard and aggregates all events into a timeline datastore, which can be exported in formats like CSV or JSON or fed into visualization tools. This enables you to see how events unfold across multiple sources and to correlate activities that span different artifacts.

It does not encrypt data, it does not directly visualize data (that role is filled by tools like Timesketch that consume the timeline), and it does not generate firewall rules.