# Timeline Workflow

> Orchestrate the full Pentest Timeline workflow (parsers + consolidator) for reporting delivery.

- Skill: `specterops/timeline-workflow` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add specterops/timeline-workflow`
- Raw SKILL.md: https://api.skillmd.com/api/skills/specterops/timeline-workflow/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Docs & Writing
- Author: specterops (https://skillmd.com/u/specterops)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/specterops/timeline-workflow

---


# Timeline Workflow

Use when the task is to generate or update an engagement timeline for reporting.

## Behavior
1. Run each parser skill (timeline-cobaltstrike, timeline-mythic, timeline-asciinema, timeline-markdown-notes, timeline-pdf-notes, timeline-ghostwriter) over their respective inputs.
2. Execute timeline-consolidator after parser outputs exist to merge, tag, and sort the entries.
3. Produce output/timeline.md and output/timeline.json, then feed the consolidated timeline into the report-writer agent for findings if requested.

## Input Requirements
- Populate the input/ directory with sections: c2logs/, terminallogs/, notes/, gw_oplog/, matching the skill-specific expectations.
- Provide MITRE tagging config or use defaults documented in references/timeline-config.yaml.

## Output
- Consolidated timeline files plus diagnostics described in timeline-consolidator.
- Optionally call report-writer to weave timelines into findings.

## Notes
- If some inputs are missing, run the available parsers and document gaps in timeline-gaps.txt.
- Provide logistic details (input structure, MITRE settings) in references/timeline-readme.md.