# timeline-cobaltstrike

Parse Cobalt Strike logs into normalized timeline entries for the reporting workflow.

- **Kind:** skill
- **Source:** https://github.com/SpecterOps/skills
- **Page:** https://forefy.com/skills/a55e32c7-8c0f-4dc3-b4e8-b6caabdb60d3
- **API (JSON + files):** https://forefy.com/api/asr/a55e32c7-8c0f-4dc3-b4e8-b6caabdb60d3

---

## SKILL.md

---
name: timeline-cobaltstrike
description: Parse Cobalt Strike logs into normalized timeline entries for the reporting workflow.
metadata:
  author: "GhostWorks"
---

# Timeline Cobalt Strike Parser

Use this skill when the task mentions Cobalt Strike logs, beacon sessions, or the need to capture CS operator commands for the consolidated timeline.

## Input Contract
- Expect a directory (`input/c2logs/cobaltstrike/`) containing beacon logs, `weblog.log`, `events.log`, and optional keystroke captures.
- Support standard filenames such as `beacon_<id>.log`, `weblog.log`, `events.log`, and `keystrokes_<id>.txt`.

## Output
- Write JSON to `output/cs_entries.json` with entries that share the timeline schema (timestamp, source, operator, action, details, raw_timestamp).
- Include metadata such as files processed, entries count, and any parsing errors.

## Workflow
1. Normalize timestamps from the CS format (`MM/DD YYYY HH:MM:SS UTC`) to ISO 8601 UTC.
2. Split each log block by timestamps and detect tags (`[metadata]`, `[input]`, `[output]`, `[task]`, `[checkin]`).
3. Extract operator, command, and command outputs; map `[input]` lines to action/command details.
4. Capture Web and Event log lines as summary entries (`web_hit`, `joined`, `hosted`, etc.).
5. If keystroke files lack timestamps, annotate entries using file mtime and the filename-derived context.
6. Emit every entry with `source` (`CS-beacon-<id>` or similar) and `raw_timestamp` for traceability.
7. Write `metadata.source_type = "cobaltstrike"` plus counters and any errors.

## Notes
- Treat `[metadata]` entries as `beacon_init` with details about host, user, and IP.
- Use the filename to derive the beacon ID for the `source` field.
- When `[output]` follows `[input]`, attach the output to the preceding command entry.

## agents

```

```

## agents/openai.yaml

```yaml
interface:
  display_name: Timeline Cobalt Strike
  short_description: "Parse Cobalt Strike logs into timeline entries."
  icon_small: ./assets/icon.svg
  icon_large: ./assets/icon.png
  brand_color: '#8E92EB'
  default_prompt: Use $timeline-cobaltstrike for this workflow.
policy:
  allow_implicit_invocation: true
```

## assets

```

```

## assets/icon.png

```

```

## assets/icon.svg

```

```