timesketch

I choose to use my raw csv from ADTimeline output

And importing it directly in timesketch, by mapping the correct columns:

Exploring the data