Timeline Workflow

Use when the task is to generate or update an engagement timeline for reporting.

Behavior

1. Run each parser skill (timeline-cobaltstrike, timeline-mythic, timeline-asciinema, timeline-markdown-notes, timeline-pdf-notes, timeline-ghostwriter) over their respective inputs.
2. Execute timeline-consolidator after parser outputs exist to merge, tag, and sort the entries.
3. Produce output/timeline.md and output/timeline.json, then feed the consolidated timeline into the report-writer agent for findings if requested.

Input Requirements

• Populate the input/ directory with sections: c2logs/, terminallogs/, notes/, gw_oplog/, matching the skill-specific expectations.
• Provide MITRE tagging config or use defaults documented in references/timeline-config.yaml.

Output

• Consolidated timeline files plus diagnostics described in timeline-consolidator.
• Optionally call report-writer to weave timelines into findings.