# Incident Timeline Builder

> ---

- Skill: `maxwellokumu/incident-timeline-builder` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add maxwellokumu/incident-timeline-builder`
- Raw SKILL.md: https://api.skillmd.com/api/skills/maxwellokumu/incident-timeline-builder/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: maxwellokumu (https://skillmd.com/u/maxwellokumu)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/maxwellokumu/incident-timeline-builder

---

---
name: incident-timeline-builder
description: Reconstruct incidents from log data into a clear chronological timeline so Claude can explain what happened, when it happened, and which actors or indicators matter most.
---

# Incident Timeline Builder

Use this skill when the user needs to reconstruct an incident sequence from logs, focus on a time window, or build a timeline for investigation or reporting.

## Goal

Help Claude turn raw event data into an understandable timeline that highlights important actions, indicators, and actor activity.

## Workflow

1. Confirm the log source, relevant time range, and whether the user wants actor-specific filtering.
2. Review the events and normalize them into a consistent chronological view.
3. Highlight notable indicators, suspicious actions, or clusters of activity that matter to the investigation.
4. Group or summarize events in a way that preserves sequence without overwhelming the user with noise.
5. Present a timeline that is useful for incident review, audit documentation, or stakeholder reporting.

## Inputs

Expected inputs from the bundled tool metadata:
- logs: Path to a JSON-lines or CSV log file.
- start: Optional ISO timestamp filter start.
- end: Optional ISO timestamp filter end.
- actor: Optional actor or source filter.
- output: Optional output format.

## Bundled Files

- main.py contains the executable timeline-building logic.
- README.md provides usage guidance and examples.
- skill.yaml captures the repo-native metadata for this skill.
- sample_input may contain representative incident logs.

## Guidance

Preserve chronology and be careful not to imply causation where the data only shows sequence. Call out notable IOC-related events and any gaps in visibility.