Please see ccf-project's report for more information

using-timesketch-api.py

from timesketch_api_client import client
import pandas as pd
pd.options.display.max_colwidth = 60

# set the connection parameters
server = 'http://0.0.0.0'
user = 'admin'
password = 'INSERT_PASSWORD_HERE'

ts_client = client.TimesketchApi(server, user, password)

# get the right sketch
sketches = ts_client.list_sketches()
print(sketches[0].name)
current = sketches[0]

# make a query
ts_results = current.explore(
    'data_type:"dpkg:line"', 
    return_fields='datetime,timestamp_desc,data_type,inode,filename', 
    as_pandas=True)

# print results
print(ts_results)