IRFlow Timeline

Appearance

Interactive Demo ​

Experience IRFlow Timeline's core analysis workflow on a realistic 50-event attack scenario — directly in your browser.

IRFlow Timeline — interactive_demo.csv
IRFlowLIVE DEMO
🔍
Try:
50 / 50 events
03:10▲ BURST: 03:10–03:12 (12 events)03:27
PROCESS INSPECTORSYSMON EID 1
explorer.exe:1204
\u251C\u2500outlook.exe:2108
│ \u251C\u2500WINWORD.EXE:3456
│ │ \u251C\u2500cmd.exe:5528T1059.003
│ │ │ \u251C\u2500powershell.exe:6744T1059.001
│ │ │ │ \u251C\u2500whoami.exe:7012
│ │ │ │ \u251C\u2500net.exe:7180T1087.002
│ │ │ │ \u251C\u2500mimikatz.exe:7344T1003.001CREDENTIAL DUMP
│ │ │ │ \u251C\u2500PsExec.exe:7520T1570LATERAL TOOL
│ │ │ │ \u251C\u2500procdump.exe:7688T1003.001LSASS DUMP
LATERAL MOVEMENT TRACKEROUTLIER DETECTED
6HOSTS
6CONNECTIONS
4CHAIN DEPTH
1OUTLIERS
RDP ×1PsExec ×12WMIC ×2SMB ×5RDP ×3WinRM ×4KALI!OUTLIERKali Linux defaultWS-PC01PIVOTDC01Domain ControllerSRV-DB01DatabaseSRV-WEB01Web ServerSRV-FILE02File ServerOutlierPivotRDPNet
⚠
CRITICAL Outlier Host Detected — Possible Threat Actor Workstation
Hostname KALI matches Kali Linux default naming pattern. This machine initiated the RDP session to WS-PC01 and is likely the attacker's workstation. IRFlow flags these automatically using hostname pattern matching.
ATTACK CHAINKALI→WS-PC01→DC01→SRV-DB01
OUTLIER PATTERNS
KALIPARROTDESKTOP-XXXXXWIN-XXXXXHACKERATTACKER
● In-Browser Demo50 rowstext search
50 sample events

What You're Seeing ​

The 50 events above tell the story of a complete attack chain across 7 phases:

PhaseEventsWhat Happened
Initial Access1–5Phishing email → malicious .docm opened via Outlook
Execution6–12Encoded PowerShell, C2 beacon to 185.220.101.42
Discovery13–18whoami, net group, nltest, systeminfo enumeration
Credential Access19–25mimikatz, LSASS dump, secretsdump, procdump
Lateral Movement26–35PsExec to DC01, RDP to SRV-DB01, WMIC, WinRM
Persistence36–40Registry Run key, service install, scheduled tasks
Impact41–50Shadow delete, ransomware encryption, log clearing

Timeline Histogram ​

The histogram above the grid buckets events by minute (03:10–03:27). It updates live as you search — try "mimikatz" to see activity spike at 03:15, or "DC01" to watch it shift to the 03:18+ lateral movement window. The burst label dynamically identifies the densest 3-minute window.

Process Inspector ​

The process tree below the grid reconstructs the attack chain from Sysmon Event ID 1 (process creation). Each node shows the parent-child relationship, with MITRE ATT&CK technique IDs (blue badges) and threat labels (red badges) on suspicious processes. The tree tells the classic phishing-to-ransomware story: explorer.exe → outlook.exe → WINWORD.EXE → cmd.exe → powershell.exe → mimikatz/PsExec/procdump.

Search Modes ​

ModeHow It WorksExample
TextCase-insensitive substring match across all columnsmimikatz, 4624, DC01
RegexFull regular expression with new RegExp(pattern, 'i')\d+\.\d+ matches IP addresses, PsExec|wmic matches either
FuzzyBigram similarity — tolerates typos and partial matchesmimkatz still finds mimikatz, powrshell finds powershell

Lateral Movement Tracker ​

Below the grid you'll see a network graph showing how the attacker moved between machines. The key insight: IRFlow immediately identifies the threat actor's machine by hostname pattern matching.

In this scenario, the attacker connected via RDP from a machine named KALI — the default Kali Linux hostname. IRFlow's two-tier outlier detection automatically flags this:

  • Tier 1 (Red): Known attacker OS defaults — KALI, PARROT, HACKER, ATTACKER
  • Tier 2 (Orange): Suspicious patterns — DESKTOP-XXXXXXX, WIN-XXXXXXXX, VPS, WINVM

Click any node in the graph to highlight its connections.

Tips ​

  • Click column headers to sort ascending, click again for descending, third click to reset
  • Click any row to expand full details (especially useful on mobile)
  • Press Escape to clear the search field
  • The histogram updates reactively as you search — watch the burst detection shift
  • The sparkline in the results bar updates live to show event density as you filter
  • Click graph nodes to highlight connections in the lateral movement tracker

Ready for the Real Thing? ​

The full app handles 30–50 GB+ forensic timelines with 847,000+ rows, SQLite-backed virtual scrolling, process trees, lateral movement graphs, and 342 detection rules.

Built for the DFIR community.

Copyright 2025-2026 IRFlow Timeline