MetisTracker · Incident timelines
Rapid event logging on a timeline your whole team builds
MetisTracker is where an investigation's events go as they are found. Every analyst logs into the same timeline at once, the chart shows where things cluster and what stands out, and the events that matter become the report.
MetisTracker
AvailableThe incident timeline your whole team builds at once.
During an investigation every analyst finds something different. MetisTracker puts it all on one timeline as it happens: one line per event, logged in seconds, drawn on a chart that helps the team see the pattern. Licensed on its own or with MetisForge.
Log it as it happens
Type what happened and press Enter. The time comes from the server's clock unless you type one. @ names a host or account, # adds a tag, and pasted log lines are added together after a preview.
A timeline you can read
Lanes by host, account, analyst or ATT&CK tactic, with hours outside the working day shaded and a panel that points out bursts, quiet stretches and out-of-hours events. A movement view shows which host reached which.
The whole team, at once
Analysts log into the same investigation live, each in their own color, with comments and a history of every change. Leads manage the people, analysts log, observers read.
From timeline to report
Mark the events that matter, write the story around them and download it as PDF or HTML, with indicators defanged by default. Export to an Excel workbook or CSV.
Nothing quietly disappears. A deleted event keeps its history and can be put back, and investigations are archived, never deleted.
In and out
Bring the timeline you have. Leave with the report.
Start from the files and logs you already have, and take the timeline wherever it needs to go next.
In
- Typed events
- Pasted log lines
- CSV
- JSON Lines
- Forensic timeline files
Out
- PDF report
- HTML report
- Excel workbook
- CSV
- Indicators defanged
Questions
Questions about MetisTracker.
What is MetisTracker for?
Logging what happens during an investigation, fast, on a timeline the whole team builds at once. It is not a SIEM, a ticketing system or a forensics tool: it is where the team's account of events lives while the work goes on.
Do I have to type a time for every event?
No. Press Enter and the event is logged at that moment by the server's clock. Start the line with a time to set another, mark it approximate, or leave it undated and place it later.
Can several analysts work at once?
Yes. Everyone on an investigation sees new events as they are logged, each analyst in their own color. Leads manage the people and settings, analysts add and edit events, and observers read.
What happens when an event is deleted?
It moves to Removed, keeps its history and can be put back. Investigations are archived, never deleted, and can be restored.
Can we bring in timelines we already have?
Yes. Import CSV, JSON Lines and common forensic timeline files, up to 500 rows at a time, or paste log lines and check them in a preview before they are added. Export to an Excel workbook or CSV, with indicators defanged if you choose.
Does MetisTracker use AI?
No. Times, log lines and indicators are read by fixed rules, and nothing in an investigation is sent to an AI model.
How is MetisTracker licensed?
MetisTracker is a product of its own, licensed alone or together with MetisForge and MetisHunter. Ask for a quote through the contact page.