Timeline Cobalt Strike Parser

Use this skill when the task mentions Cobalt Strike logs, beacon sessions, or the need to capture CS operator commands for the consolidated timeline.

Input Contract

• Expect a directory (input/c2logs/cobaltstrike/) containing beacon logs, weblog.log, events.log, and optional keystroke captures.
• Support standard filenames such as beacon_<id>.log, weblog.log, events.log, and keystrokes_<id>.txt.

Output

• Write JSON to output/cs_entries.json with entries that share the timeline schema (timestamp, source, operator, action, details, raw_timestamp).
• Include metadata such as files processed, entries count, and any parsing errors.