building-incident-timeline-with-timesketch

by mukul975

building-incident-timeline-with-timesketch helps DFIR teams build collaborative incident timelines in Timesketch by ingesting Plaso, CSV, or JSONL evidence, normalizing timestamps, correlating events, and documenting attack chains for incident triage and reporting.

Stars6.1k

Favorites0

Comments0

AddedMay 9, 2026

CategoryIncident Triage

Install Command

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-incident-timeline-with-timesketch

Curation Score

This skill scores 79/100. It is a solid directory candidate for incident-response agents because it includes a real Timesketch-focused workflow, supporting scripts, and reference docs that reduce guesswork for timeline building. Directory users should still expect some adoption friction around exact triggering and setup, since the SKILL.md excerpt does not show a dedicated install command or a very crisp step-by-step entry point.

79/100

Strengths

Evidence-backed workflow content: references/workflows.md lays out evidence collection, Plaso processing, Timesketch import, analyzers, and manual tagging for timeline construction.
Strong operational support: scripts/agent.py and scripts/process.py indicate this is more than prose, with automation for authentication, sketch creation, upload, and processing.
Good install-decision context: SKILL.md includes valid frontmatter, domain/subdomain metadata, cybersecurity tags, and a detailed Timesketch/Plaso description.

Cautions

Triggerability is not fully polished: the SKILL.md excerpt shows broad 'When to Use' guidance, but no install command and some wording appears generic or awkward, which can make agent invocation less obvious.
Evidence is strong but uneven: the repository has rich references, yet the directory user may need to inspect code/docs to understand exact inputs, outputs, and required environment assumptions.

Timesketch Dfir Incident Response Forensics Timeline Analysis Plaso

Overview

Overview of building-incident-timeline-with-timesketch skill

What this skill does

The building-incident-timeline-with-timesketch skill helps you turn scattered evidence into a collaborative incident timeline in Timesketch. It is best for DFIR and incident response work where you need to ingest logs, normalize timestamps, correlate events, and document an attack chain clearly enough for triage and reporting.

Who should use it

Use the building-incident-timeline-with-timesketch skill if you are assembling a case timeline from Windows logs, Plaso output, CSV/JSONL event data, or mixed-source evidence and you want a faster path to analysis than manual spreadsheet work. It is a strong fit for incident responders, threat hunters, and forensic analysts doing building-incident-timeline-with-timesketch for Incident Triage.

What makes it different

Unlike a generic prompt about timelines, this skill is anchored in Timesketch workflow details: upload structure, search and annotation patterns, and report-style outputs. The strongest value is operational—getting from raw evidence to a usable sketch with fewer missed steps, especially when multiple timelines, sources, and investigators are involved.

How to Use building-incident-timeline-with-timesketch skill

Install and inspect the repo

For building-incident-timeline-with-timesketch install, start with the skill path and read the guidance files before prompting:
skills/building-incident-timeline-with-timesketch/SKILL.md, references/workflows.md, references/api-reference.md, references/standards.md, and assets/template.md.
If you are using a skill runner, install it from the parent repository and then confirm the local skill name matches building-incident-timeline-with-timesketch.

Give the skill the right input

The building-incident-timeline-with-timesketch usage pattern works best when you provide:

evidence sources and formats (.plaso, .csv, .jsonl)
case goal, such as initial access, lateral movement, or persistence
time window, timezone, and host names
known indicators, suspicious accounts, or hashes
output format you want, such as sketch notes, saved searches, or a report

A weak request is: “make an incident timeline.”
A stronger request is: “build a Timesketch timeline for a Windows intrusion using EVTX, Prefetch, and PowerShell logs from 2024-01-03 to 2024-01-05 UTC, prioritize logon and execution events, and produce a triage-ready attack narrative.”

Follow the workflow in practice

The building-incident-timeline-with-timesketch guide is most useful when you work in this order:

identify the evidence sources worth importing first
convert or filter them into Timesketch-friendly timelines
create the sketch and upload each timeline with descriptive names
run analyzers, then search for the highest-signal events
tag and annotate events by attack phase before writing the final narrative

Use references/workflows.md to choose between full evidence processing and rapid triage. For urgent cases, target the quickest artifact set first instead of trying to process everything.

Read these files first

If you want reliable output, preview the files that affect decisions most:

references/workflows.md for the processing path
references/api-reference.md for upload, search, and annotation structure
references/standards.md for timeline and forensic expectations
assets/template.md for the report structure the skill is optimized for
scripts/agent.py and scripts/process.py if you need automation or API-driven execution

building-incident-timeline-with-timesketch skill FAQ

Is this skill only for Timesketch users?

Yes, this skill is specifically for Timesketch-centered investigations. If you do not plan to import, search, or annotate timelines in Timesketch, a general incident-response prompt may be a better fit than building-incident-timeline-with-timesketch.

Do I need Plaso to use it?

No. Plaso is important for deep artifact parsing, but the skill also supports direct CSV and JSONL ingestion. That makes building-incident-timeline-with-timesketch useful for both full forensic processing and faster triage timelines.

Is it beginner-friendly?

It is usable for beginners, but the best results come from users who can name evidence sources, time ranges, and investigation goals. Without that input, the skill can still help structure the work, but it cannot choose the right timeline scope for you.

When should I not use this skill?

Do not use building-incident-timeline-with-timesketch if your task is only incident summary writing, static log review, or detection rule authoring. It is most valuable when the deliverable is a searchable timeline with evidence correlation and investigator annotations.

How to Improve building-incident-timeline-with-timesketch skill

Provide a tighter evidence brief

The biggest quality gain comes from better source detail. Include source type, host, date range, and what you already suspect. For example, specify “Security.evtx, Sysmon, browser history, and M365 audit logs from a single workstation” instead of “logs from the endpoint.” That helps the building-incident-timeline-with-timesketch skill choose better parsing and search priorities.

Ask for a decision, not just a timeline

The skill performs better when the output goal is explicit: confirm initial access, identify account abuse, map movement, or document persistence. That changes which events matter, which analyzers to run first, and how the timeline should be narrated.

Use the first output as a triage draft

Treat the first result as a working sketch, then refine with missing time bounds, better indicators, or additional timelines. The most common failure mode is under-scoping: too many sources, too little chronology, and no priority order. Narrowing the window and adding known IOCs usually improves building-incident-timeline-with-timesketch usage more than asking for “more detail.”

Iterate with targeted follow-ups

After the first pass, ask for one of these refinements:

“rebuild the timeline around the first suspicious logon”
“separate execution, persistence, and exfiltration events”
“tag events by ATT&CK phase”
“convert this into the report template in assets/template.md”

That keeps the skill focused on analysis quality instead of generic summarization and makes the building-incident-timeline-with-timesketch guide more useful in real incident workflows.

Ratings & Reviews

No ratings yet

Share your review

0/10000

Latest reviews

Saving...

more skill

conducting-malware-incident-response

by mukul975

conducting-malware-incident-response helps IR teams triage suspected malware, confirm infections, scope spread, contain endpoints, and support eradication and recovery. It is designed for conducting-malware-incident-response for Incident Response workflows with evidence-backed steps, telemetry-driven decisions, and practical containment guidance.

Incident Response

Favorites 0GitHub 0

building-incident-response-playbook

by mukul975

building-incident-response-playbook helps security teams create reusable incident response playbooks with step-by-step phases, decision trees, escalation criteria, RACI ownership, and SOAR-ready structure. It is designed for incident response procedure documentation, incident triage workflows, and audit-friendly operational response plans.

Incident Triage

Favorites 0GitHub 6.1k

detecting-privilege-escalation-attempts

by mukul975

detecting-privilege-escalation-attempts helps hunt privilege escalation on Windows and Linux, including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse. Built for threat hunting teams that need a practical workflow, reference queries, and helper scripts.

Threat Hunting

Favorites 0GitHub 0

detecting-evasion-techniques-in-endpoint-logs

by mukul975

The detecting-evasion-techniques-in-endpoint-logs skill helps hunt defense evasion in Windows endpoint logs, including log clearing, timestomping, process injection, and security tool disabling. Use it for threat hunting, detection engineering, and incident triage with Sysmon, Windows Security, or EDR telemetry.

Threat Hunting

Favorites 0GitHub 0

analyzing-network-traffic-for-incidents

by mukul975

analyzing-network-traffic-for-incidents helps incident responders analyze PCAPs, flow logs, and packet captures to confirm C2, lateral movement, exfiltration, and exploitation attempts. Built for analyzing-network-traffic-for-incidents for Incident Response with Wireshark, Zeek, and NetFlow-style investigation.

Incident Response

Favorites 0GitHub 0

detecting-insider-threat-behaviors

by mukul975

detecting-insider-threat-behaviors helps analysts hunt insider-risk signals like unusual data access, off-hours activity, mass downloads, privilege abuse, and resignation-correlated theft. Use this detecting-insider-threat-behaviors guide for threat hunting, UEBA-style triage, and threat modeling with workflow templates, SIEM query examples, and risk weights.

Threat Modeling

Favorites 0GitHub 0

detecting-command-and-control-over-dns

by mukul975

detecting-command-and-control-over-dns is a cybersecurity skill for spotting C2 over DNS, including tunneling, beaconing, DGA domains, and TXT/CNAME abuse. It supports SOC analysts, threat hunters, and security audits with entropy checks, passive DNS correlation, and Zeek or Suricata-style detection workflows.

Security Audit

Favorites 0GitHub 0

deploying-osquery-for-endpoint-monitoring

by mukul975

deploying-osquery-for-endpoint-monitoring guide for deploying and configuring osquery for endpoint visibility, fleet-wide monitoring, and SQL-driven threat hunting. Use it to plan installation, read the workflow and API references, and operationalize scheduled queries, log collection, and centralized review across Windows, macOS, and Linux endpoints.

Monitoring

Favorites 0GitHub 0

correlating-security-events-in-qradar

by mukul975

correlating-security-events-in-qradar helps SOC and detection teams correlate IBM QRadar offenses with AQL, offense context, custom rules, and reference data. Use this guide to investigate incidents, reduce false positives, and build stronger correlation logic for Incident Response.

Incident Response

Favorites 0GitHub 0

analyzing-windows-event-logs-in-splunk

by mukul975

The analyzing-windows-event-logs-in-splunk skill helps SOC analysts investigate Windows Security, System, and Sysmon logs in Splunk for authentication attacks, privilege escalation, persistence, and lateral movement. Use it for incident triage, detection engineering, and timeline analysis with mapped SPL patterns and event ID guidance.

Incident Triage

Favorites 0GitHub 0

analyzing-windows-amcache-artifacts

by mukul975

The analyzing-windows-amcache-artifacts skill parses Windows Amcache.hve data to recover evidence of program execution, installed software, device activity, and driver loading for DFIR and security audit workflows. It uses AmcacheParser and regipy-based guidance to support artifact extraction, SHA-1 correlation, and timeline review.

Security Audit

Favorites 0GitHub 0

analyzing-powershell-empire-artifacts

by mukul975

analyzing-powershell-empire-artifacts skill helps Security Audit teams detect PowerShell Empire artifacts in Windows logs using Script Block Logging, Base64 launcher patterns, stager IOCs, module signatures, and detection references for triage and rule writing.

Security Audit

Favorites 0GitHub 0

analyzing-network-traffic-of-malware

by mukul975

analyzing-network-traffic-of-malware helps inspect PCAPs and telemetry from sandbox runs or incident response to find C2, exfiltration, payload downloads, DNS tunneling, and detection ideas. It is a practical analyzing-network-traffic-of-malware guide for Security Audit and malware triage.

Security Audit

Favorites 0GitHub 0

analyzing-linux-system-artifacts

by mukul975

analyzing-linux-system-artifacts helps investigate Linux hosts for compromise by reviewing auth logs, shell history, cron jobs, systemd services, SSH keys, and other persistence points. Use this analyzing-linux-system-artifacts guide for Security Audit, incident response, and forensic triage. It includes practical install and usage guidance.

Security Audit

Favorites 0GitHub 0

analyzing-indicators-of-compromise

by mukul975

Analyzing-indicators-of-compromise helps triage IOCs such as IPs, domains, URLs, file hashes, and email artifacts. It supports threat-intelligence workflows for enrichment, confidence scoring, and block/monitor/whitelist decisions using source-backed checks and clear analyst context.

Threat Intelligence

Favorites 0GitHub 0

analyzing-docker-container-forensics

by mukul975

analyzing-docker-container-forensics helps investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and preserve evidence. Use this analyzing-docker-container-forensics skill for a Security Audit, incident review, or container hardening assessment.

Security Audit

Favorites 0GitHub 0