Which best describes Timesketch's role and its integration with Plaso?

• A. Timesketch is a malware sandbox used to execute suspicious binaries.
• B. Timesketch is a database for storing event logs.
• C. Timesketch is a collaborative browser-based timeline viewer that ingests Plaso timelines for analysis and annotation.
• D. Timesketch is a network sniffing tool for real-time traffic capture.

Answer: (C)

Timesketch is a collaborative browser-based timeline viewer that ingests Plaso timelines for analysis and annotation. It provides a shared workspace where investigators can visualize events in a timeline, search and filter data, and add notes or tags to highlight important activity. Plaso (log2timeline) generates the timeline data from various sources, and Timesketch consumes that output so analysts can review the sequence of events, collaborate on findings, and annotate the data without altering the underlying sources. It isn’t a malware sandbox, a general-purpose database for logs, or a network sniffing tool, which is why the described integration best fits a visualization and collaboration role that leverages Plaso timelines for deeper investigation.