Timeline Cobaltstrike

Timeline Cobalt Strike Parser

Use this skill when the task mentions Cobalt Strike logs, beacon sessions, or the need to capture CS operator commands for the consolidated timeline.

Input Contract

• Expect a directory (input/c2logs/cobaltstrike/) containing beacon logs, weblog.log, events.log, and optional keystroke captures.
• Support standard filenames such as beacon_<id>.log, weblog.log, events.log, and keystrokes_<id>.txt.

Output

• Write JSON to output/cs_entries.json with entries that share the timeline schema (timestamp, source, operator, action, details, raw_timestamp).
• Include metadata such as files processed, entries count, and any parsing errors.

Workflow

1. Normalize timestamps from the CS format (MM/DD YYYY HH:MM:SS UTC) to ISO 8601 UTC.
2. Split each log block by timestamps and detect tags ([metadata], [input], [output], [task], [checkin]).
3. Extract operator, command, and command outputs; map [input] lines to action/command details.
4. Capture Web and Event log lines as summary entries (web_hit, joined, hosted, etc.).
5. If keystroke files lack timestamps, annotate entries using file mtime and the filename-derived context.
6. Emit every entry with source (CS-beacon-<id> or similar) and raw_timestamp for traceability.
7. Write metadata.source_type = "cobaltstrike" plus counters and any errors.

Notes

• Treat [metadata] entries as beacon_init with details about host, user, and IP.
• Use the filename to derive the beacon ID for the source field.
• When [output] follows [input], attach the output to the preceding command entry.