[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG482D2BEA49WRV5C1VGJW":3,"skill-same:01M6AG482D2BEA49WRV5C1VGJW":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AG482D2BEA49WRV5C1VGJW","performing-timeline-reconstruction-with-plaso",null,"Builds comprehensive forensic super-timelines using Plaso (log2timeline and psort) to correlate events across file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. Use during complex forensic investigations that need cross-source event correlation, or when standard log analysis is insufficient to establish the sequence of activities for reporting findings.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-timeline-reconstruction-with-plaso\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"plaso","performing timeline reconstruction with plaso","timeline","log2timeline","registry","analysis","t1074","artifacts","t1059","event-correlation","correlation","super-timeline","browser","cybersecurity","digital-forensics","timeline-analysis","forensics","reporting","logs","file","2026-11-10 10:12:30",false,"---\nname: performing-timeline-reconstruction-with-plaso\ndescription: >-\n  Builds comprehensive forensic super-timelines using Plaso (log2timeline and\n  psort) to correlate events across file system metadata, event logs, browser\n  history, and registry artifacts into a unified chronological view. Use\n  during complex forensic investigations that need cross-source event\n  correlation, or when standard log analysis is insufficient to establish the\n  sequence of activities for reporting findings.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- timeline-analysis\n- plaso\n- log2timeline\n- super-timeline\n- event-correlation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1059\n---\n\n# Performing Timeline Reconstruction with Plaso\n\n## When to Use\n- When building a comprehensive forensic timeline from multiple evidence sources\n- For correlating events across file system metadata, event logs, browser history, and registry\n- During complex investigations requiring chronological reconstruction of activities\n- When standard log analysis is insufficient to establish the sequence of events\n- For presenting investigation findings in a visual, chronological format\n\n## Prerequisites\n- Plaso (log2timeline\u002Fpsort) installed on forensic workstation\n- Forensic disk image(s) in raw (dd), E01, or VMDK format\n- Sufficient storage for Plaso output (can be 10x+ the image size)\n- Minimum 8GB RAM (16GB+ recommended for large images)\n- Timeline Explorer (Eric Zimmerman) or Timesketch for visualization\n- Understanding of timestamp types (MACB: Modified, Accessed, Changed, Born)\n\n## Workflow\n\n### Step 1: Install Plaso and Prepare the Environment\n\n```bash\n# Install Plaso on Ubuntu\u002FDebian\nsudo add-apt-repository ppa:gift\u002Fstable\nsudo apt-get update\nsudo apt-get install plaso-tools\n\n# Or install via pip\npip install plaso\n\n# Or use Docker (recommended for dependency isolation)\ndocker pull log2timeline\u002Fplaso\n\n# Verify installation\nlog2timeline.py --version\npsort.py --version\n\n# Create output directory\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002F\n\n# Verify the forensic image\nimg_stat \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n```\n\n### Step 2: Generate the Plaso Storage File with log2timeline\n\n```bash\n# Basic processing of a disk image (all parsers)\nlog2timeline.py \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Process with specific parsers for faster targeted analysis\nlog2timeline.py \\\n   --parsers \"winevtx,prefetch,mft,usnjrnl,lnk,recycle_bin,chrome_history,firefox_history,winreg\" \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Process with a filter file to focus on specific paths\ncat \u003C\u003C 'EOF' > \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ffilter.txt\n\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\n\u002FWindows\u002FPrefetch\n\u002FUsers\u002F*\u002FNTUSER.DAT\n\u002FUsers\u002F*\u002FAppData\u002FLocal\u002FGoogle\u002FChrome\n\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMozilla\u002FFirefox\n\u002F$MFT\n\u002F$UsnJrnl:$J\n\u002FWindows\u002FSystem32\u002Fconfig\nEOF\n\nlog2timeline.py \\\n   --filter-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ffilter.txt \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Using Docker\ndocker run --rm -v \u002Fcases:\u002Fcases log2timeline\u002Fplaso log2timeline \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Process multiple evidence sources into one timeline\nlog2timeline.py \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fcombined.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fworkstation.dd\n\nlog2timeline.py \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fcombined.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fserver.dd\n```\n\n### Step 3: Filter and Export Timeline with psort\n\n```bash\n# Export full timeline to CSV (super-timeline format)\npsort.py \\\n   -o l2tcsv \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ffull_timeline.csv \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso\n\n# Export with date range filter (focus on incident window)\npsort.py \\\n   -o l2tcsv \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fincident_window.csv \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \"date > '2024-01-15 00:00:00' AND date \u003C '2024-01-20 23:59:59'\"\n\n# Export in JSON Lines format (for ingestion into SIEM\u002FTimesketch)\npsort.py \\\n   -o json_line \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ftimeline.jsonl \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso\n\n# Export with specific source type filters\npsort.py \\\n   -o l2tcsv \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fregistry_events.csv \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \"source_short == 'REG'\"\n\npsort.py \\\n   -o l2tcsv \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevtx_events.csv \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \"source_short == 'EVT'\"\n\n# Export for Timeline Explorer (dynamic CSV)\npsort.py \\\n   -o dynamic \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ftimeline_explorer.csv \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso\n```\n\n### Step 4: Analyze Timeline with Timesketch\n\n```bash\n# Install Timesketch (Docker deployment)\ngit clone https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ftimesketch.git\ncd timesketch\ndocker compose up -d\n\n# Import Plaso file into Timesketch via CLI\ntimesketch_importer \\\n   --host http:\u002F\u002Flocalhost:5000 \\\n   --username analyst \\\n   --password password \\\n   --sketch_id 1 \\\n   --timeline_name \"Case 2024-001 Workstation\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso\n\n# Alternatively, import JSONL\ntimesketch_importer \\\n   --host http:\u002F\u002Flocalhost:5000 \\\n   --username analyst \\\n   --sketch_id 1 \\\n   --timeline_name \"Case 2024-001\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ftimeline.jsonl\n\n# In Timesketch web UI:\n# 1. Search for events: \"data_type:windows:evtx:record AND event_identifier:4624\"\n# 2. Apply Sigma analyzers for automated detection\n# 3. Star\u002Ftag important events\n# 4. Create stories documenting the investigation narrative\n# 5. Share with team members\n```\n\n### Step 5: Perform Targeted Timeline Analysis\n\n```bash\n# Analyze specific time periods around known events\npython3 \u003C\u003C 'PYEOF'\nimport csv\nfrom collections import defaultdict\nfrom datetime import datetime\n\n# Load incident window timeline\nevents_by_hour = defaultdict(list)\nsource_counts = defaultdict(int)\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fincident_window.csv', 'r', errors='ignore') as f:\n    reader = csv.DictReader(f)\n    total = 0\n    for row in reader:\n        total += 1\n        timestamp = row.get('datetime', row.get('date', ''))\n        source = row.get('source_short', row.get('source', 'Unknown'))\n        description = row.get('message', row.get('desc', ''))\n\n        source_counts[source] += 1\n\n        # Group by hour for activity patterns\n        try:\n            dt = datetime.strptime(timestamp[:19], '%Y-%m-%dT%H:%M:%S')\n            hour_key = dt.strftime('%Y-%m-%d %H:00')\n            events_by_hour[hour_key].append({\n                'time': timestamp,\n                'source': source,\n                'description': description[:200]\n            })\n        except (ValueError, TypeError):\n            pass\n\nprint(f\"Total events in incident window: {total}\\n\")\n\nprint(\"=== EVENTS BY SOURCE TYPE ===\")\nfor source, count in sorted(source_counts.items(), key=lambda x: x[1], reverse=True):\n    print(f\"  {source}: {count}\")\n\nprint(\"\\n=== ACTIVITY BY HOUR ===\")\nfor hour in sorted(events_by_hour.keys()):\n    count = len(events_by_hour[hour])\n    bar = '#' * min(count \u002F\u002F 10, 50)\n    print(f\"  {hour}: {count:>6} events {bar}\")\n\n# Find hours with unusual activity spikes\navg = total \u002F max(len(events_by_hour), 1)\nprint(f\"\\n=== ANOMALOUS HOURS (>{avg*3:.0f} events) ===\")\nfor hour in sorted(events_by_hour.keys()):\n    if len(events_by_hour[hour]) > avg * 3:\n        print(f\"  {hour}: {len(events_by_hour[hour])} events (SPIKE)\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Super-timeline | Unified chronological view combining all artifact timestamps from multiple sources |\n| MACB timestamps | Modified, Accessed, Changed (metadata), Born (created) - four key file timestamp types |\n| Plaso storage file | SQLite-based intermediate format storing parsed events before export |\n| L2T CSV | Log2timeline CSV format with standardized columns for timeline events |\n| Parser | Plaso module extracting timestamps from a specific artifact type (e.g., winevtx, prefetch) |\n| Psort | Plaso sorting and filtering tool for post-processing storage files |\n| Timesketch | Google open-source collaborative timeline analysis platform |\n| Pivot points | Known timestamps (e.g., malware execution) used to focus investigation scope |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| log2timeline (Plaso) | Primary timeline generation engine parsing 100+ artifact types |\n| psort | Plaso output filtering, sorting, and export utility |\n| Timesketch | Web-based collaborative forensic timeline analysis platform |\n| Timeline Explorer | Eric Zimmerman's Windows GUI for CSV timeline analysis |\n| KAPE | Automated triage collection feeding into Plaso processing |\n| mactime (TSK) | Simpler timeline generation from Sleuth Kit bodyfiles |\n| Excel\u002FSheets | Manual timeline review for small filtered datasets |\n| Elastic\u002FKibana | Alternative visualization platform for JSONL timeline data |\n\n## Common Scenarios\n\n**Scenario 1: Ransomware Attack Reconstruction**\nProcess the full disk image with Plaso, filter to the week before encryption was discovered, identify the initial access vector from browser history and event logs, trace privilege escalation through registry and Prefetch, map lateral movement from network logon events, pinpoint encryption start from MFT timestamps showing mass file modifications.\n\n**Scenario 2: Data Theft Investigation**\nCreate super-timeline from suspect's workstation, filter for USB device connection events, file access timestamps, and cloud storage browser activity, build a narrative showing data staging, compression, and exfiltration, present timeline to legal team with tagged evidence points.\n\n**Scenario 3: Multi-System Breach Analysis**\nProcess disk images from all affected systems into a single Plaso storage file, import into Timesketch for collaborative analysis, search for lateral movement patterns across system timelines, identify the patient-zero system and initial compromise vector, map the full attack chain across the environment.\n\n**Scenario 4: Insider Threat After-Hours Activity**\nFilter timeline to non-business hours only, identify file access patterns outside normal working times, correlate with authentication events (badge access, VPN logon), search for data access to sensitive directories during these periods, build evidence package for HR\u002Flegal.\n\n## Output Format\n\n```\nTimeline Reconstruction Summary:\n  Evidence Sources:\n    Disk Image: evidence.dd (500 GB, NTFS)\n    Plaso Storage: evidence.plaso (2.3 GB)\n\n  Processing Statistics:\n    Total events extracted: 4,567,890\n    Parsers used: 45 (winevtx, prefetch, mft, usnjrnl, lnk, chrome, firefox, winreg, ...)\n    Processing time: 3h 45m\n\n  Incident Window (2024-01-15 to 2024-01-20):\n    Events in window: 234,567\n    Event Sources:\n      MFT:          89,234\n      Event Logs:   45,678\n      USN Journal:  56,789\n      Registry:     23,456\n      Prefetch:     1,234\n      Browser:      5,678\n      LNK Files:    2,345\n      Other:        10,153\n\n  Key Timeline Events:\n    2024-01-15 14:32 - Phishing email opened (browser)\n    2024-01-15 14:33 - Malicious document downloaded\n    2024-01-15 14:35 - PowerShell executed (Prefetch + Event Log)\n    2024-01-15 14:36 - C2 connection established (Registry + Event Log)\n    2024-01-16 02:30 - Mimikatz execution (Prefetch)\n    2024-01-16 02:45 - Lateral movement to DC (Event Log)\n    2024-01-17 03:00 - Data exfiltration (MFT + USN Journal)\n    2024-01-18 03:00 - Log clearing (Event Log)\n\n  Exported Files:\n    Full Timeline:     \u002Ftimeline\u002Ffull_timeline.csv (4.5M rows)\n    Incident Window:   \u002Ftimeline\u002Fincident_window.csv (234K rows)\n    Timesketch Import: \u002Ftimeline\u002Ftimeline.jsonl\n```\n","# Performing Timeline Reconstruction with Plaso\n\n## When to Use\n- When building a comprehensive forensic timeline from multiple evidence sources\n- For correlating events across file system metadata, event logs, browser history, and registry\n- During complex investigations requiring chronological reconstruction of activities\n- When standard log analysis is insufficient to establish the sequence of events\n- For presenting investigation findings in a visual, chronological format\n\n## Prerequisites\n- Plaso (log2timeline\u002Fpsort) installed on forensic workstation\n- Forensic disk image(s) in raw (dd), E01, or VMDK format\n- Sufficient storage for Plaso output (can be 10x+ the image size)\n- Minimum 8GB RAM (16GB+ recommended for large images)\n- Timeline Explorer (Eric Zimmerman) or Timesketch for visualization\n- Understanding of timestamp types (MACB: Modified, Accessed, Changed, Born)\n\n## Workflow\n\n### Step 1: Install Plaso and Prepare the Environment\n\n```bash\n# Install Plaso on Ubuntu\u002FDebian\nsudo add-apt-repository ppa:gift\u002Fstable\nsudo apt-get update\nsudo apt-get install plaso-tools\n\n# Or install via pip\npip install plaso\n\n# Or use Docker (recommended for dependency isolation)\ndocker pull log2timeline\u002Fplaso\n\n# Verify installation\nlog2timeline.py --version\npsort.py --version\n\n# Create output directory\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002F\n\n# Verify the forensic image\nimg_stat \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n```\n\n### Step 2: Generate the Plaso Storage File with log2timeline\n\n```bash\n# Basic processing of a disk image (all parsers)\nlog2timeline.py \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Process with specific parsers for faster targeted analysis\nlog2timeline.py \\\n   --parsers \"winevtx,prefetch,mft,usnjrnl,lnk,recycle_bin,chrome_history,firefox_history,winreg\" \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Process with a filter file to focus on specific paths\ncat \u003C\u003C 'EOF' > \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ffilter.txt\n\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\n\u002FWindows\u002FPrefetch\n\u002FUsers\u002F*\u002FNTUSER.DAT\n\u002FUsers\u002F*\u002FAppData\u002FLocal\u002FGoogle\u002FChrome\n\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMozilla\u002FFirefox\n\u002F$MFT\n\u002F$UsnJrnl:$J\n\u002FWindows\u002FSystem32\u002Fconfig\nEOF\n\nlog2timeline.py \\\n   --filter-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ffilter.txt \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Using Docker\ndocker run --rm -v \u002Fcases:\u002Fcases log2timeline\u002Fplaso log2timeline \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Process multiple evidence sources into one timeline\nlog2timeline.py \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fcombined.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fworkstation.dd\n\nlog2timeline.py \\\n   --storage-file \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fcombined.plaso \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fserver.dd\n```\n\n### Step 3: Filter and Export Timeline with psort\n\n```bash\n# Export full timeline to CSV (super-timeline format)\npsort.py \\\n   -o l2tcsv \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ffull_timeline.csv \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso\n\n# Export with date range filter (focus on incident window)\npsort.py \\\n   -o l2tcsv \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fincident_window.csv \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \"date > '2024-01-15 00:00:00' AND date \u003C '2024-01-20 23:59:59'\"\n\n# Export in JSON Lines format (for ingestion into SIEM\u002FTimesketch)\npsort.py \\\n   -o json_line \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ftimeline.jsonl \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso\n\n# Export with specific source type filters\npsort.py \\\n   -o l2tcsv \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fregistry_events.csv \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \"source_short == 'REG'\"\n\npsort.py \\\n   -o l2tcsv \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevtx_events.csv \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso \\\n   \"source_short == 'EVT'\"\n\n# Export for Timeline Explorer (dynamic CSV)\npsort.py \\\n   -o dynamic \\\n   -w \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ftimeline_explorer.csv \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso\n```\n\n### Step 4: Analyze Timeline with Timesketch\n\n```bash\n# Install Timesketch (Docker deployment)\ngit clone https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ftimesketch.git\ncd timesketch\ndocker compose up -d\n\n# Import Plaso file into Timesketch via CLI\ntimesketch_importer \\\n   --host http:\u002F\u002Flocalhost:5000 \\\n   --username analyst \\\n   --password password \\\n   --sketch_id 1 \\\n   --timeline_name \"Case 2024-001 Workstation\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fevidence.plaso\n\n# Alternatively, import JSONL\ntimesketch_importer \\\n   --host http:\u002F\u002Flocalhost:5000 \\\n   --username analyst \\\n   --sketch_id 1 \\\n   --timeline_name \"Case 2024-001\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Ftimeline.jsonl\n\n# In Timesketch web UI:\n# 1. Search for events: \"data_type:windows:evtx:record AND event_identifier:4624\"\n# 2. Apply Sigma analyzers for automated detection\n# 3. Star\u002Ftag important events\n# 4. Create stories documenting the investigation narrative\n# 5. Share with team members\n```\n\n### Step 5: Perform Targeted Timeline Analysis\n\n```bash\n# Analyze specific time periods around known events\npython3 \u003C\u003C 'PYEOF'\nimport csv\nfrom collections import defaultdict\nfrom datetime import datetime\n\n# Load incident window timeline\nevents_by_hour = defaultdict(list)\nsource_counts = defaultdict(int)\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Ftimeline\u002Fincident_window.csv', 'r', errors='ignore') as f:\n    reader = csv.DictReader(f)\n    total = 0\n    for row in reader:\n        total += 1\n        timestamp = row.get('datetime', row.get('date', ''))\n        source = row.get('source_short', row.get('source', 'Unknown'))\n        description = row.get('message', row.get('desc', ''))\n\n        source_counts[source] += 1\n\n        # Group by hour for activity patterns\n        try:\n            dt = datetime.strptime(timestamp[:19], '%Y-%m-%dT%H:%M:%S')\n            hour_key = dt.strftime('%Y-%m-%d %H:00')\n            events_by_hour[hour_key].append({\n                'time': timestamp,\n                'source': source,\n                'description': description[:200]\n            })\n        except (ValueError, TypeError):\n            pass\n\nprint(f\"Total events in incident window: {total}\\n\")\n\nprint(\"=== EVENTS BY SOURCE TYPE ===\")\nfor source, count in sorted(source_counts.items(), key=lambda x: x[1], reverse=True):\n    print(f\"  {source}: {count}\")\n\nprint(\"\\n=== ACTIVITY BY HOUR ===\")\nfor hour in sorted(events_by_hour.keys()):\n    count = len(events_by_hour[hour])\n    bar = '#' * min(count \u002F\u002F 10, 50)\n    print(f\"  {hour}: {count:>6} events {bar}\")\n\n# Find hours with unusual activity spikes\navg = total \u002F max(len(events_by_hour), 1)\nprint(f\"\\n=== ANOMALOUS HOURS (>{avg*3:.0f} events) ===\")\nfor hour in sorted(events_by_hour.keys()):\n    if len(events_by_hour[hour]) > avg * 3:\n        print(f\"  {hour}: {len(events_by_hour[hour])} events (SPIKE)\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Super-timeline | Unified chronological view combining all artifact timestamps from multiple sources |\n| MACB timestamps | Modified, Accessed, Changed (metadata), Born (created) - four key file timestamp types |\n| Plaso storage file | SQLite-based intermediate format storing parsed events before export |\n| L2T CSV | Log2timeline CSV format with standardized columns for timeline events |\n| Parser | Plaso module extracting timestamps from a specific artifact type (e.g., winevtx, prefetch) |\n| Psort | Plaso sorting and filtering tool for post-processing storage files |\n| Timesketch | Google open-source collaborative timeline analysis platform |\n| Pivot points | Known timestamps (e.g., malware execution) used to focus investigation scope |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| log2timeline (Plaso) | Primary timeline generation engine parsing 100+ artifact types |\n| psort | Plaso output filtering, sorting, and export utility |\n| Timesketch | Web-based collaborative forensic timeline analysis platform |\n| Timeline Explorer | Eric Zimmerman's Windows GUI for CSV timeline analysis |\n| KAPE | Automated triage collection feeding into Plaso processing |\n| mactime (TSK) | Simpler timeline generation from Sleuth Kit bodyfiles |\n| Excel\u002FSheets | Manual timeline review for small filtered datasets |\n| Elastic\u002FKibana | Alternative visualization platform for JSONL timeline data |\n\n## Common Scenarios\n\n**Scenario 1: Ransomware Attack Reconstruction**\nProcess the full disk image with Plaso, filter to the week before encryption was discovered, identify the initial access vector from browser history and event logs, trace privilege escalation through registry and Prefetch, map lateral movement from network logon events, pinpoint encryption start from MFT timestamps showing mass file modifications.\n\n**Scenario 2: Data Theft Investigation**\nCreate super-timeline from suspect's workstation, filter for USB device connection events, file access timestamps, and cloud storage browser activity, build a narrative showing data staging, compression, and exfiltration, present timeline to legal team with tagged evidence points.\n\n**Scenario 3: Multi-System Breach Analysis**\nProcess disk images from all affected systems into a single Plaso storage file, import into Timesketch for collaborative analysis, search for lateral movement patterns across system timelines, identify the patient-zero system and initial compromise vector, map the full attack chain across the environment.\n\n**Scenario 4: Insider Threat After-Hours Activity**\nFilter timeline to non-business hours only, identify file access patterns outside normal working times, correlate with authentication events (badge access, VPN logon), search for data access to sensitive directories during these periods, build evidence package for HR\u002Flegal.\n\n## Output Format\n\n```\nTimeline Reconstruction Summary:\n  Evidence Sources:\n    Disk Image: evidence.dd (500 GB, NTFS)\n    Plaso Storage: evidence.plaso (2.3 GB)\n\n  Processing Statistics:\n    Total events extracted: 4,567,890\n    Parsers used: 45 (winevtx, prefetch, mft, usnjrnl, lnk, chrome, firefox, winreg, ...)\n    Processing time: 3h 45m\n\n  Incident Window (2024-01-15 to 2024-01-20):\n    Events in window: 234,567\n    Event Sources:\n      MFT:          89,234\n      Event Logs:   45,678\n      USN Journal:  56,789\n      Registry:     23,456\n      Prefetch:     1,234\n      Browser:      5,678\n      LNK Files:    2,345\n      Other:        10,153\n\n  Key Timeline Events:\n    2024-01-15 14:32 - Phishing email opened (browser)\n    2024-01-15 14:33 - Malicious document downloaded\n    2024-01-15 14:35 - PowerShell executed (Prefetch + Event Log)\n    2024-01-15 14:36 - C2 connection established (Registry + Event Log)\n    2024-01-16 02:30 - Mimikatz execution (Prefetch)\n    2024-01-16 02:45 - Lateral movement to DC (Event Log)\n    2024-01-17 03:00 - Data exfiltration (MFT + USN Journal)\n    2024-01-18 03:00 - Log clearing (Event Log)\n\n  Exported Files:\n    Full Timeline:     \u002Ftimeline\u002Ffull_timeline.csv (4.5M rows)\n    Incident Window:   \u002Ftimeline\u002Fincident_window.csv (234K rows)\n    Timesketch Import: \u002Ftimeline\u002Ftimeline.jsonl\n```\n",{"name":5,"tags":49,"author":50,"domain":37,"license":15,"version":51,"nist_csf":52,"subdomain":38,"description":7,"mitre_attack":56},[40,39,24,27,35,33],"mahipal","1.0",[53,54,55],"RS.AN-03","DE.AE-02","RS.MA-01",[57,58,59,60,61],"T1005","T1074","T1119","T1070","T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-timeline-reconstruction-with-plaso",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-timeline-reconstruction-with-plaso",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-timeline-reconstruction-with-plaso",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-timeline-reconstruction-with-plaso","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-timeline-reconstruction-with-plaso\u002FSKILL.md",true,[86,91,97],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-timeline-reconstruction-with-plaso\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",2575,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-timeline-reconstruction-with-plaso\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",6872,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-timeline-reconstruction-with-plaso\u002Fscripts\u002Fagent.py",[104,130,154,182,204,231],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":111,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[110],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[112,113,114,115,116,37,117,118,119,120,31,121,122,123,124,125,126,127,128,129],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[136],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[138,126,139,140,116,141,37,119,142,143,144,145,146,147,148,149,150,151,152,153],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[160,163],{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[148,165,166,167,168,37,169,170,142,171,172,173,174,175,176,177,178,179,180,181],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[188],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,192,37,28,36,42,193,194,195,196,197,198,199,38,200,145,201,202,203],"windows","kape","triaging windows with kape","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,37,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[237],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,239,37,240,43,241,242,243,244,245,246,177,247,178,29,248,249,250,251,252],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]