Autonomous Timeline Analysis and Threat Hunting: An AI Agent for Timesketch

Autonomous Timeline Analysis and Threat Hunting: An AI Agent for Timesketch

Speakers: Maarten van Dantzig, Security Engineer, Google (DFIR); Alex, Privacy and Security Research, Google

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=9EA7kz4bGvQ

Reading time: ~8 minutes

Type: Briefing

TL;DR

Google engineers Maarten van Dantzig and Alex present SecGemini, an AI agent that autonomously performs digital forensics and incident response across hundreds of millions of log records — finding 53% of critical attack indicators in the hinted (timeline reconstruction) mode and 47% in the unhinted (threat hunting) mode, for under $3 per investigation. The agent avoids the context-window limitations of naive LLM approaches by maintaining an "exploration graph" as structured memory, enabling multi-step reasoning across massive datasets without losing track of what it has learned.

Introduction

A freshly installed Windows Server 2022 base image — before anyone has used it for anything — contains approximately four million logged events. File system activity alone accounts for 3.1 million of those. Add registry events (400,000), USN journals (350,000), and EDR telemetry, and any analyst investigating a live system is looking at a haystack of staggering scale before the attacker has even generated a single meaningful artifact.

This is the core problem Maarten van Dantzig and Alex address in their Black Hat USA 2025 briefing. Digital forensics and incident response (DFIR) has always been a volume problem, but the gap between the scale of available data and the human capacity to analyze it has grown to the point where traditional approaches — even those augmented with basic LLM summarization — can no longer keep up. Their solution, SecGemini, is an AI agent built into Timesketch, Google's open-source collaborative timeline analysis platform, that can process hundreds of millions of log records, generate verifiable investigative findings, and reduce the cost of a complete autonomous investigation to under $3.

▶ Watch: The Log Volume Problem (00:00)

The Google DFIR Stack: Timesketch and Its Ecosystem

To understand SecGemini, it helps to understand the toolchain it sits inside. Google's open-source DFIR stack operates in three phases: collection, processing, and analysis.

Collection uses libcloud-forensics, an open-source tool compatible with major cloud platforms (GCP, AWS, Azure) that retrieves disk images and cloud console logs. Processing uses Plaso, another open-source tool that parses artifacts from disk images into normalized event records — effectively a timelining engine for all major forensic artifact types. Analysis uses Timesketch, which ingests Plaso output and provides a collaborative investigation interface where analysts can search events chronologically, annotate specific records, mark them as suspicious or benign, and build shared timelines.

The entire pipeline from a raw GCP disk image to searchable events in Timesketch runs with a single command. Van Dantzig demonstrates this with a GCP example: an organization receives a notification that their cloud project may be abused (the example given is cryptocurrency mining). The timestamps in the notification become a starting point; Timesketch lets analysts search that six-hour window. But even a six-hour window on an active server may return nearly 8,000 events — far too many for manual triage.

The team had already added an LLM summarization feature to Timesketch, capable of generating a plain-text summary of up to 500 events at a time. This helped analysts get oriented faster, but it required clicking through paginated results and still left the fundamental needle-in-haystack problem unsolved.

▶ Watch: The Timesketch Ecosystem and Existing LLM Features (04:00)

Why Naive LLM Approaches Fail at Scale

The obvious extension — just send all the logs to an LLM — runs into three problems that make it impractical for real DFIR work.

Context window exhaustion: A standard react-loop agent (equip an LLM with a tool to fetch log batches, reason on them, loop) will clog its context window within a handful of iterations. Each batch of logs consumed leaves less room for the LLM to reason, and by the time it has seen even a fraction of the total log volume, the window is full and the agent cannot continue.

Degraded reasoning over accumulation: Even when the context window is not full, adding large quantities of raw log records to the context causes an experimental degradation in reasoning quality. The LLM "loses track of where it is and what it's trying to accomplish." This is not a theoretical concern — the team observed it empirically.

Auditability: A free-form agent interaction produces hundreds of pages of interleaved log records and LLM outputs. A human analyst trying to verify the agent's conclusions has no practical way to follow the reasoning chain. For security investigations — where findings may be used in legal proceedings or executive briefings — verifiability is not optional.

▶ Watch: Limitations of Naive LLM Approaches (10:01)

The Exploration Graph: Structured Memory for Multi-Step Investigation

SecGemini's solution to all three problems is the exploration graph, a structured representation of the investigation's state that serves as the agent's external memory. Instead of accumulating raw log text in the context window, the LLM's only job is to update the graph by adding nodes. The graph stores what has been learned; the LLM processes only the current step.

The graph has four node types:

• Investigative directions — high-level goals the agent sets for itself, like "examine SSH connections to the machine"
• Tool calls — specific search queries the agent executes against the log database
• Observations — written summaries of what those tool calls returned
• Investigative findings — specific conclusions about attacker behavior, with direct references to log record line numbers

Edges in the graph represent logical entailment: one node is an analysis of, or an answer to, another node. This structure means the agent can revisit earlier reasoning, understand how it reached each conclusion, and a human analyst can reconstruct the entire investigation chain.

The agent's loop is simple: generate investigative directions, write tool calls to pursue them, summarize the results as observations, and update the graph with any findings. Repeat until the investigation is complete or the graph indicates no further leads.

▶ Watch: The Exploration Graph Design (14:02)

Modes of Operation: Investigation and Threat Hunting

SecGemini operates in two modes that address different DFIR scenarios.

Hinted mode (timeline reconstruction): The agent is given initial detection information — an alert, a suspicious IP, a timeframe — and investigates to reconstruct the full attack timeline. This mirrors how most incident response engagements start: a SOC alert or a customer notification contains some seed information, and the analyst must establish what actually happened.

Unhinted mode (threat hunting): The agent receives only a description of the available log types and their counts, with no information about what happened. It performs autonomous threat hunting, generating its own investigative directions and looking for any evidence of compromise. This is closer to proactive hunting operations where there is no known starting point.

In the example walk-through, a Linux VM with one million log records across seven log types receives the agent without any incident context. The agent's first investigative direction is to examine SSH connections. After fetching and summarizing the relevant records, it pivots to examine activity around the login timestamps, identifies suspicious cron job modifications and unusual file activity, and produces a finding with specific log record line numbers as references. The entire reasoning chain from initial direction to finding is preserved in the exploration graph.

▶ Watch: Investigation Example and Exploration Graph Walk-Through (16:02)

Integration into Timesketch: The AI View

The team built a dedicated "AI view" inside Timesketch that surfaces the agent's work to analysts in real time. As the agent processes the investigation, findings stream into the interface. For each investigative question the agent pursues, analysts see: the question, the specific log records the agent identified as relevant, and a conclusion that the analyst can accept or reject.

Critically, the cited log records are actual records from the Timesketch sketch — not LLM-generated summaries or paraphrases. An analyst who wants to verify a finding can click directly to the source event, perform context searches around it, and continue the investigation from that point. This closes the auditability gap: findings cannot be hallucinated in a way that would survive record-level verification.

Multiple rounds of user studies with analysts informed the design. The most important requirement that emerged was not speed but trust: analysts need to be able to verify what the agent found before acting on it. The accept/reject mechanism for conclusions and the direct event linking are both responses to that requirement.

▶ Watch: Timesketch AI View and Analyst Workflow (22:03)

Evaluation: 100 Real Investigations, Under $3 Each

The team evaluated SecGemini against a dataset of 100 real incident investigations — cases that Google DFIR has actually worked. Each case includes:

• An initial detection signal (a suspicious IP, an abuse notification, etc.)
• Log data from Linux and Windows VMs
• An average of 15 different log types (up to 50 in complex cases)
• An average of 4 million log records per case (up to 100 million)
• Human-annotated ground truth: an average of 38 log records per case identified by expert analysts as directly attacker-related

The evaluation metric asks SecGemini to identify attack-related indicators (IP addresses, file names, URLs, PIDs, executable names) at three relevance levels: critical, important, and supplemental.

Results (hinted mode): 53% recall on critical indicators. Precision is reported at 12%, but the team notes the ground truth is deliberately under-labeled — human analysts, being human, do not achieve perfect recall on 100 million log records, so some of what SecGemini identifies as critical and the human analysts missed is likely correct, not a false positive.

Results (unhinted mode): 47% recall on critical indicators — a modest reduction for fully autonomous threat hunting with no starting context.

Cost: Under $3 per complete investigation. The team expects this to decrease as Gemini model costs decline.

The team also tested the agent on a public forensics CTF (hosted at dfirmadness.com, created by James Smith), which is more widely reproducible for comparison. Given only a disk image and the parsed artifacts, SecGemini answered 20 of 30 CTF questions and found 50% of critical indicators without being given any scenario context — blind threat hunting on an unfamiliar dataset.

▶ Watch: Evaluation Dataset, Metrics, and Results (24:04)

Notable Quotes

"Four million events on a freshly installed Windows server — and that's on a system that hasn't even been used yet. Once you start using it, there's gonna be even more." — Maarten van Dantzig ▶ 00:00

"If you keep adding previous log records to the context window, the LLM eventually loses its ability to reason and loses track of where it is and what it's trying to accomplish." — Alex ▶ 14:02

"Even finding one critical indicator is a big deal. In at least 90% of cases, SecGemini is able to find at least one critical indicator — and the total cost for this currently is under $3." — Alex ▶ 32:04

"The results are right there — immediately you know they were not hallucinated. You can then pivot from the events the agent has highlighted directly to anything around them as well." — Maarten van Dantzig ▶ 24:04

Key Takeaways

• The exploration graph solves the LLM context window problem for DFIR. By storing investigation state as a structured graph rather than raw log accumulation, SecGemini can reason across hundreds of millions of log records without degradation.
• 53% recall on critical indicators at under $3 per case is operationally significant. In DFIR, a single finding that identifies attacker infrastructure or persistence mechanism can anchor an entire investigation — and SecGemini finds at least one critical indicator in over 90% of cases.
• Unhinted threat hunting (47% recall) means AI-driven proactive detection is viable today. SecGemini does not require an initial alert to begin an investigation — it can operate as a proactive hunt across arbitrary log data.
• Verifiability is built into the design, not bolted on. Log record line number citations and direct Timesketch event linking ensure analysts can audit every finding before acting on it.
• Timesketch and the full pipeline are open source and LLM-agnostic. Teams can run the agent with locally hosted models via Ollama, or swap in any Gemini-compatible LLM. Demos are available at the Google Cloud booth and at the GenSec CTF at DEF CON.

Slides PDF: Not available at time of publication.