# timeline-consolidator

Merge parsed timeline entries, apply MITRE tagging, and produce the final timeline outputs.

- **Kind:** skill
- **Source:** https://github.com/SpecterOps/skills
- **Page:** https://forefy.com/skills/9df3a901-a6cf-4718-81e2-8a9a308996a9
- **API (JSON + files):** https://forefy.com/api/asr/9df3a901-a6cf-4718-81e2-8a9a308996a9

---

## SKILL.md

---
name: timeline-consolidator
description: Merge parsed timeline entries, apply MITRE tagging, and produce the final timeline outputs.
metadata:
  author: "GhostWorks"
---

# Timeline Consolidator

Use after parser skills to merge their JSON entries into the consolidated timeline.

## Input Contract
- JSON files in `output/`: `cs_entries.json`, `mythic_entries.json`, `terminal_entries.json`, `md_notes_entries.json`, `pdf_notes_entries.json`, `gw_entries.json`.

## Output
- `output/timeline.md` (markdown table) and `output/timeline.json` (normalized array) following the schema: timestamp, source, operator, action, details, mitre_tags, duplicate_flag, raw_timestamp.
- Metadata report summarizing counts per source, duplications, and MITRE tag coverage.

## Workflow
1. Load available entry files; skip missing ones but note their absence.
2. Normalize each entry:
   - Ensure timestamp is ISO 8601 UTC.
   - Guarantee `source`, `operator`, `action`, and `details` are filled.
3. Apply MITRE ATT&CK tagging using pattern mappings (discovery, execution, lateral movement, persistence, etc.) and add `mitre_tags` array.
4. Detect duplicates within a 5-second window per operator using textual similarity (SequenceMatcher). Flag duplicates with `duplicate_flag` and keep evidence of why flagged.
5. Merge entries, sort chronologically, and emit timeline table with columns (Timestamp, Source, Operator, MITRE, Action, Details).
6. Store diagnostics (parsers processed, duplicates found, errors) in metadata for reporting.
7. Preserve JSON-friendly `raw_timestamp` and `source_file` references for auditing.

## Notes
- Document MITRE pattern definitions in `references/mitre-patterns.md` for future tuning.
- Provide config knobs for duplicate detection window and similarity threshold (default 5s / 0.8 similarity).

## agents

```

```

## agents/openai.yaml

```yaml
interface:
  display_name: Timeline Consolidator
  short_description: "Merge, tag, and render reporting timeline entries."
  icon_small: ./assets/icon.svg
  icon_large: ./assets/icon.png
  brand_color: '#8E92EB'
  default_prompt: Use $timeline-consolidator for this workflow.
policy:
  allow_implicit_invocation: true
```

## assets

```

```

## assets/icon.png

```

```

## assets/icon.svg

```

```

## references

```

```

## references/entry-schema.md

# Timeline Entry Schema

Each parser writes entries that the consolidator merges. Ensure the following fields appear in every JSON entry:

- `timestamp` (ISO 8601 UTC string)
- `source` (e.g., CS-beacon-12345, Mythic-task-100, terminal-session)
- `operator` (operator username or system for automated events)
- `action` (short verb describing the event)
- `details` (free-text details, e.g., full command or log line)
- `raw_timestamp` (original timestamp string from the source)
- `mitre_tags` (array added by the consolidator)
- `duplicate_flag` (boolean set by the consolidator)
- Additional source-specific metadata such as `command`, `output`, `source_ip`, `dest_ip`, `tool`, `user_context`, and `source_file` may also be present for auditing.

## references/mitre-patterns.md

# MITRE Pattern Mapping

Use this reference when adding or tuning MITRE ATT&CK tags in the consolidator.

## Sample technique patterns
- Discovery: whoami, ipconfig, net user, net share, systeminfo, tasklist, nmap, masscan
- Credential Access: mimikatz, sekurlsa, hashdump, dcsync, kerberoast, asreproast, rubeus, keylog, password spray, responder
- Lateral Movement: psexec, wmiexec, ssh, rdesktop, mstsc, winrm, pass the hash/ticket
- Execution: powershell, cmd, bash, python, mshta, rundll32, certutil
- Persistence: schtasks, cron, reg add, service create, webshell
- Privilege Escalation: getsystem, sudo, token, potato, uac bypass
- Defense Evasion: obfuscate, inject, amsi bypass, timestomp, clear log
- Collection: screenshot, clipboard, zip, tar
- Exfiltration: exfil, upload, transfer, dnscat
- Command & Control: beacon, callback, tunnel, proxy, proxychains, chisel

## Tuning
- Patterns are case-insensitive regexes evaluated over the combined action + details text.
- Each match adds the technique ID (e.g., T1018) to the entry's mitre_tags list.
- Keep the list of regex/technique pairs centralized here for easy updates.

## references/timeline-config.yaml

```yaml
timezone:
  default_assumption: UTC
  output: UTC

output:
  filename: timeline.md

mitre:
  enabled: true

duplicates:
  detection_enabled: true
  time_window_seconds: 5
  similarity_threshold: 0.8

sources:
  cobaltstrike:
    timezone: UTC
  mythic:
    include_output: true
    output_max_chars: 500
  asciinema:
    min_command_length: 2
    include_output: true
    output_max_chars: 500
  notes:
    operator_pattern: (?P<operator>[a-zA-Z0-9_-]+)[-_]notes
  ghostwriter:
    columns:
      timestamp: start_date
      operator: operator_name
      tool: tool
      command: command
      output: output
      comments: comments
      target: dest_ip
```

## references/timeline-gaps.md

# Timeline Gaps

Use this note to capture missing inputs when generating a timeline. Document:
- which input directories were empty or missing files
- what parsing errors prevented entries from being produced
- any manual steps taken to compensate (e.g., manual CSV exports)

Example entries:
```
2026-04-04 10:00 UTC - Missing input/c2logs/mythic/ exports for this engagement.
2026-04-04 10:01 UTC - Ghostwriter CSV had malformed timestamp on row 12; entry skipped.
```

## references/timeline-readme.md

# Timeline Workflow Reference

Use this reference to understand how the timeline pipeline consumes inputs and produces outputs.

- Parsers expect input directories:
  - `input/c2logs/cobaltstrike/`
  - `input/c2logs/mythic/`
  - `input/terminallogs/`
  - `input/notes/` (Markdown/PDF)
  - `input/gw_oplog/`
- Parser outputs are JSON files under `output/` that follow a shared schema.
- `timeline-consolidator` merges those JSON files, adds MITRE tags, handles duplicates, and writes `timeline.md` and `timeline.json`.
- `timeline-workflow` runs the parsers first then the consolidator; missing inputs are documented in `timeline-gaps.txt`.

Refer to `references/timeline-config.yaml` for tuning timezone/duplicate/mitre defaults and `references/mitre-patterns.md` for the regex rules.