Chronicle

Skill: Chronicle System

Supplementary Files:

• chronicle-template.py — Chronicle detailed record template generator (Python script that automatically generates event record files and creates directory structures)

Summary

Through a three-layer document system (overview -> detailed records -> knowledge distillation), raw conversation events are transformed into reusable experience.

Tools: MEMORY.md, HEARTBEAT.md, TOOLS.md, skills/

Domain: knowledge

Description

A system for recording, indexing, and distilling knowledge from agent lifecycle events. Through a three-layer document system (overview -> detailed records -> knowledge distillation), raw conversation events are transformed into reusable experience.

Distinction from MEMORY.md: Chronicle records "what happened," while MEMORY.md records "what was learned."

Use Cases

• Completing a major security discovery (high-severity vulnerability, data breach)
• Achieving a key milestone (learning plan completion, tool mastery)
• Important environment or configuration changes
• Need to quickly review historical events and handling approaches
• Periodic archiving of expired logs from memory/

Three-Layer Architecture

+------------------------------------------+
|  Layer 1: CHRONICLE.md (Overview Index)  |
|  Timeline + one-line summary + nav links |
+------------------+-----------------------+
                   |
                   v
+------------------------------------------+
|  Layer 2: chronicle/YYYY-MM/             |
|  YYYY-MM-DD-event-name.md (Detail)       |
|  Background, process, results, outputs,  |
|  impact                                   |
+------------------+-----------------------+
                   |
                   v
+------------------------------------------+
|  Layer 3: MEMORY.md (Knowledge Distill)  |
|  Experience, lessons, capability growth   |
+------------------------------------------+

Event Classification

Event Template

File path: chronicle/YYYY-MM/YYYY-MM-DD-event-name.md

# YYYY-MM-DD - Event Name

> **Type**: [icon] [type name]
> **Priority**: P[0/1/2]
> **Recorded**: YYYY-MM-DD HH:MM

---

## Background

[Why this was done]

---

## Process

### Phase 1: [Name]
- **Action**: [What was done]
- **Result**: [What happened]

### Phase 2: [Name]
- **Action**: [What was done]
- **Result**: [What happened]

---

## Outputs

- `path/to/file` — [description]

---

## Impact

[Significance for future work]

---

## Related

- Daily notes: `memory/YYYY-MM-DD.md`
- Knowledge distillation: `MEMORY.md#[section]`
- Related skill: `skills/[skill-name]/SKILL.md`

Index Format

File path: CHRONICLE.md (root directory)

# Chronicle

## YYYY-MM

### YYYY-MM-DD (Weekday) — Event Name
**Type**: [icon] [type name] | **Priority**: P[0/1/2]

[One-line summary]

**Outcomes**: [key outcomes]
**Details**: -> chronicle/YYYY-MM/YYYY-MM-DD-event-name.md

---

Workflow

Recording Events

1. Determine event type and priority (refer to classification table)
2. Create detailed record file (use template)
3. Update CHRONICLE.md overview index
4. If lessons learned -> distill to MEMORY.md

Periodic Maintenance (Heartbeat Task Integration)

Memory Archiving Rules

When logs in memory/ exceed 30 days:

1. Extract important content to corresponding chronicle detailed records
2. Distill lessons learned to MEMORY.md
3. Retain original memory files but mark as archived

Detection Methods

Chronicle SIEM Native Detections

• YARA-L rules: Chronicle's detection language; matches patterns across events.
• Asset graph anomalies: Sudden connections between previously unrelated assets.
• Statistical outliers: Login time anomalies; data transfer size outliers.
• IOC matches: Hashes, IPs, domains matched against threat intel.
• UDM (Unified Data Model) enrichment: All events normalized; cross-source correlation.

Common Rule Categories

• Initial access: Suspicious email attachment exec; new ASN login + admin action.
• Persistence: New scheduled task with system privileges; new service binary in temp dir.
• Lateral movement: SMB connections from non-admin workstation; RDP to domain controller.
• Exfiltration: DNS tunneling signatures; large uploads to unknown cloud storage.

Sample YARA-L Rule

rule suspicious_powershell_download {
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.command_line /= /powershell.*DownloadFile/
  condition:
    $e
}

Defense Evasion Techniques

Bypassing Chronicle Ingestion

• Avoid UDM-enriched sources: Target data sources not yet normalized (less detectable).
• Slow operations: Spread actions across the 24h+ retention window for correlation.
• Compromise logging pipeline: Modify syslog forwarder to drop specific events.
• Use legitimate credentials: Don't trigger new-login alerts; use stolen but valid tokens.
• Time-stomp before event ingestion: Modify file timestamps before they're collected.

Rule Bypass

• Avoid known YARA-L patterns: Don't use DownloadFile keyword; use base64 encoded command.
• Distribute across rules: Avoid triggering any single rule's threshold (e.g., 5+ failed logins).
• Off-hours activity: Run during peak business hours to blend with normal traffic.
• Piggyback on legitimate admin actions: Trigger detection in same window as scheduled maintenance.

Hacker Laws

System Integration

Based on CHRONICLE_SYSTEM.md, condensed and rewritten

Orchestration

ECC Loop Pattern

• Pattern: Sequential Pipeline (record event → index in chronicle → distill to MEMORY.md)
• Rationale: Chronicle follows a strict three-layer progression — raw events are recorded first, then indexed for navigation, then selectively distilled into long-term knowledge
• Integration: continuous-learning (feeds knowledge extraction), safety-guard (incident events), HEARTBEAT.md (periodic maintenance triggers), TOOLS.md (tool mastery milestones)

Cross-Skill Pipeline

[any skill event] → chronicle (record) → CHRONICLE.md (index) → MEMORY.md (distill)
                          ↓                                      ↑
                   safety-guard (incidents)          continuous-learning (patterns)

Quality Gate

• Pre-condition: Event meets recording threshold (P0-P2 priority classification)
• Post-condition: Event recorded in chronicle/YYYY-MM/, indexed in CHRONICLE.md, lessons distilled to MEMORY.md if applicable
• Verification: CHRONICLE.md index matches detail files, MEMORY.md reflects distilled knowledge