Mmcp.market

building-super-timelines-with-plaso skill

by mukul975·mukul975/Anthropic-Cybersecurity-Skills·34k stars·Apache-2.0

Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py,

A100/100content scan

Is the building-super-timelines-with-plaso skill safe?

Clean: nothing in its files matched our rules. We read 5 files in the folder on 2026-09-28.

No findings.

Install the building-super-timelines-with-plaso skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description. 

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git /tmp/Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills
cp -r /tmp/Anthropic-Cybersecurity-Skills/skills/building-super-timelines-with-plaso ~/.claude/skills/building-super-timelines-with-plaso
available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

Building Super Timelines with Plaso

Authorized Use Only: Build timelines only from evidence you are authorized to analyze. Work from forensic images/copies and preserve chain of custody.

Overview

Plaso (Plaso Langar Að Safna Öllu) is the open-source engine behind log2timeline, the standard for building forensic super timelines — a single chronological, normalized view fusing hundreds of artifact types (file-system MACB times, registry, EVTX, browser history, prefetch, LNK, $UsnJrnl, syslog, and more) into one timeline. Plaso has three core CLI tools:

  • log2timeline.py — extracts events from a source (disk image, mount point, directory, or device) into a .plaso storage file using its large parser/plugin set.
  • pinfo.py — reports on the contents and processing metadata of a .plaso file.
  • psort.py — post-processes, filters, deduplicates, time-zones, and exports the storage file to an output format (CSV, JSON-line, Elasticsearch, Timesketch, etc.).
  • psteal.py — convenience wrapper that runs extraction + export in one step.

The resulting timeline is enormous, so analysts triage it in Timesketch — a collaborative, web-based timeline analysis platform that ingests .plaso files (or CSV/JSONL) and supports filtering, tagging, starring, saved searches, and automated analyzers.

When to Use

  • Reconstructing the full sequence of events on a compromised host during incident response.
  • Correlating activity across many artifact sources on a single normalized timeline.
  • Investigating anti-forensic behavior such as timestomping or log clearing (which stands out against MACB and journal evidence).
  • Feeding a curated timeline into Timesketch for team triage.

Prerequisites

  • Install Plaso (Docker is the supported, reproducible method):
docker pull log2timeline/plaso
  # Run a tool, mounting your evidence/output directory
  docker run -v /cases:/data log2timeline/plaso log2timeline.py --version

Alternatively on Ubuntu via the GIFT PPA:

sudo add-apt-repository ppa:gift/stable
  sudo apt-get update && sudo apt-get install -y plaso-tools
  • A Timesketch instance (docker-compose deployment from https://github.com/google/timesketch) for triage.
  • A forensic image (E01/raw) or mounted file system.

Objectives

  • Extract events from an image into a .plaso storage file.
  • Inspect the storage file with pinfo.
  • Filter and export a focused super timeline with psort.
  • Import the timeline into Timesketch and triage it.

MITRE ATT&CK Mapping

Plaso is a defensive forensics engine; the mapping reflects the anti-forensic adversary behavior super timelines are well suited to detect.

Workflow

1. Extract events into a storage file

log2timeline.py writes a .plaso file from a source. --storage-file names the output; the source can be an .E01, raw image, mount point, or directory.

log2timeline.py --storage-file timeline.plaso /cases/greendale/image.E01

Scope parsers for speed/relevance with --parsers (presets like win7, webhist, or explicit parser names):

log2timeline.py --parsers "win7,!filestat" --storage-file timeline.plaso /cases/image.E01

2. Inspect the storage file

pinfo.py reports source, parsers used, event counts, and any warnings.

pinfo.py timeline.plaso

3. Export a filtered super timeline (CSV)

psort.py selects an output module with -o, writes with -w, normalizes the timezone with --output-time-zone, and accepts an event filter expression to scope a date range.

psort.py --output-time-zone 'UTC' \
  -o l2tcsv \
  -w supertimeline.csv \
  timeline.plaso \
  "date > datetime('2026-01-01T00:00:00') AND date < datetime('2026-01-27T00:00:00')"

For Timesketch-friendly JSON lines, use the json_line output module:

psort.py --output-time-zone 'UTC' -o json_line -w supertimeline.jsonl timeline.plaso

4. One-step extraction + export with psteal

psteal.py runs extraction and CSV export together for quick triage.

psteal.py --source /cases/greendale/image.E01 -o l2tcsv -w supertimeline.csv

5. Import into Timesketch

Use the official timesketch_importer CLI to upload the .plaso (or CSV/JSONL) into a sketch. Timesketch chunks/reassembles and indexes the file.

timesketch_importer \
  --host http://127.0.0.1:5000 \
  --username admin \
  --timeline_name "greendale-host01" \
  --sketch_id 1 \
  timeline.plaso

6. Triage in Timesketch

In the sketch UI:

  • Filter to a suspicious window or data_type (e.g. windows:evtx:record, fs:stat).
  • Star/tag events of interest and add comments for collaboration.
  • Save searches and run analyzers (e.g. browser timeframe, similarity, sigma) over the timeline.
  • Build a narrative from corroborating events across artifact sources.

7. Hunt for anti-forensics

Look for MACB timestamps that disagree with $UsnJrnl entries (timestomping), gaps or EventLog cleared (1102) records, and deleted-then-recreated files — all visible on the unified timeline.

Tools and Resources

Key Commands

Validation Criteria

  • [ ] .plaso storage file produced from the source image
  • [ ] pinfo confirms expected parsers ran and event counts are non-zero
  • [ ] Super timeline exported with UTC normalization and a scoped filter
  • [ ] Timeline imported into a Timesketch sketch and indexed
  • [ ] Suspicious window triaged with tags/stars/saved searches
  • [ ] Anti-forensic indicators (timestomping, log clearing) checked
  • [ ] Findings documented with corroborating cross-source events

More skills from mukul975/Anthropic-Cybersecurity-Skills

  • Aabusing-dpapi-for-credential-accessExtract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
  • Aabusing-shadow-credentials-for-privescTake over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
  • Aachieving-cmmc-level-2-compliancePrepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or responding to a CMMC assessment, when computing or improving an SPRS score, when building a System Security Plan or POA&M for 800-171, or when scoping which systems are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2, CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.
  • Aacquiring-disk-image-with-dd-and-dcflddCreate forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
  • Aanalyzing-active-directory-acl-abuseDetect dangerous ACL misconfigurations in Active Directory using ldap3
  • Aanalyzing-android-malware-with-apktoolPerform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
  • Danalyzing-api-gateway-access-logs'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect
  • Aanalyzing-apt-group-with-mitre-navigatorQuery ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.
  • Aanalyzing-azure-activity-logs-for-threats'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query
  • Aanalyzing-bootkit-and-rootkit-samples'Analyzes bootkit and advanced rootkit malware infecting the Master
  • Aanalyzing-browser-forensics-with-hindsightParse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.
  • Aanalyzing-campaign-attribution-evidenceSystematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

All agent skills → · MCP servers