specterops Timeline Workflow
Use when the task is to generate or update an engagement timeline for reporting.
Behavior
- Run each parser skill (timeline-cobaltstrike, timeline-mythic, timeline-asciinema, timeline-markdown-notes, timeline-pdf-notes, timeline-ghostwriter) over their respective inputs.
- Execute timeline-consolidator after parser outputs exist to merge, tag, and sort the entries.
- Produce output/timeline.md and output/timeline.json, then feed the consolidated timeline into the report-writer agent for findings if requested.
Input Requirements
- Populate the input/ directory with sections: c2logs/, terminallogs/, notes/, gw_oplog/, matching the skill-specific expectations.
- Provide MITRE tagging config or use defaults documented in references/timeline-config.yaml.
Output
- Consolidated timeline files plus diagnostics described in timeline-consolidator.
- Optionally call report-writer to weave timelines into findings.
Notes
- If some inputs are missing, run the available parsers and document gaps in timeline-gaps.txt.
- Provide logistic details (input structure, MITRE settings) in references/timeline-readme.md.