# Plaso

Plaso is a Digital Forensics product. It runs on-premises. Pricing is free.

A Python-based engine for automatic creation of timelines in digital forensic analysis

Checked October 2026.

## What is Plaso?

Plaso Langar Að Safna Öllu, or super timeline all the things, is a Python-based engine used by several tools for automatic creation of timelines. These timelines support digital forensic investigators/analysts, to correlate the large amount of information found in logs and other files found on an average computer.

The initial purpose of Plaso was to collect all timestamped events of interest on a computer system and have them aggregated in a single place for computer forensic analysis (aka Super Timeline).

However Plaso has become a framework that supports:
adding new parsers or parsing plug-ins;
adding new analysis plug-ins;
writing one-off scripts to automate repetitive tasks in computer forensic analysis or equivalent.

And is moving to support:
adding new general purpose parses/plugins that may not have timestamps associated to them;
adding more analysis context;
tagging events;
allowing more targeted approach to the collection/parsing.

Tags: Evidence Collection, Memory Forensics

## Where it fits in your security program (NIST CSF 2.0)

- [Respond](https://cybersectools.com/guides/building-respond-program-small-team): helps you contain and handle incidents.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Digital Forensics](https://cybersectools.com/categories/digital-forensics)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 2,032
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## Plaso FAQ

### What is Plaso?

Plaso is a product in the Digital Forensics category. It covers Evidence Collection and Memory Forensics.

### What is the pricing for Plaso?

Plaso is free. Download and setup instructions are at https://github.com/log2timeline/plaso/.

### What are alternatives to Plaso?

Alternatives to Plaso listed on CybersecTools:

1. [Magnet Forensics](https://cybersectools.com/tools/magnet-forensics) - Digital forensics platform for evidence acquisition, analysis, and DFIR. (Commercial)
2. [Cellebrite Digital Forensics Platform](https://cybersectools.com/tools/cellebrite-digital-forensics-platform) - Digital forensics platform for mobile & endpoint evidence extraction and analysis. (Commercial)
3. [DigiStor WiebeTech](https://cybersectools.com/tools/digistor-wiebetech) - Hardware write-blockers and forensic tools for secure evidence acquisition. (Commercial)
4. [WindowsSCOPE Cyber Forensics](https://cybersectools.com/tools/windowsscope-cyber-forensics) - GUI-based memory forensic capture tool for cyber forensics and cyber crime investigation. (Commercial)
5. [ExtraHop Packet Forensics](https://cybersectools.com/tools/extrahop-packet-forensics) - Continuous full packet capture and forensics for network investigations (Commercial)

Compare all Plaso alternatives at [https://cybersectools.com/alternatives/plaso](https://cybersectools.com/alternatives/plaso)

### What deployment and organization size does Plaso fit?

Plaso is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare Plaso with similar solutions

- [Plaso vs Magnet Forensics](https://cybersectools.com/compare/magnet-forensics-vs-plaso)
- [Plaso vs Cellebrite Digital Forensics Platform](https://cybersectools.com/compare/cellebrite-digital-forensics-platform-vs-plaso)
- [Plaso vs DigiStor WiebeTech](https://cybersectools.com/compare/digistor-wiebetech-vs-plaso)

All alternatives to Plaso: [/alternatives/plaso](https://cybersectools.com/alternatives/plaso)

---

Source: https://cybersectools.com/tools/plaso

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Plaso: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md