Guide · Agent skill

How to use the Building Super Timelines with Plaso agent skill

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

This guide explains what the building-super-timelines-with-plaso agent skill does, how to install it as a Claude agent skill, and how to ask for it in plain language. A super timeline combines file-system, registry, event log, browser and other artifacts from a forensic image into one chronological view. By the end you will know the workflow the skill follows and what you need before you start.

Building Super Timelines with Plasomukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill

Quick start

1Get the skill. Download the ZIP from this page. Unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
2Install Plaso. Pull the log2timeline/plaso Docker image, or install plaso-tools from the GIFT PPA on Ubuntu. Confirm it runs with log2timeline.py --version.
3Confirm you are authorized. Only work on evidence you are allowed to analyze. Use a forensic image or copy, and keep chain of custody records.
4Extract events. Ask the agent to run log2timeline.py with --storage-file on your image to create a .plaso file. Add --parsers to narrow the scope if needed.
5Check the storage file. Ask the agent to run pinfo.py on the .plaso file and confirm the expected parsers ran with non-zero event counts.
6Export a filtered timeline. Ask for a psort.py export in UTC, as CSV or JSON lines, optionally limited to a date window.
7Import and triage in Timesketch. Import the file with timesketch_importer into a sketch, then filter, tag and comment on events in the Timesketch UI.

What this skill makes the agent do

Once installed, the agent can guide you through or run Plaso's command-line tools: log2timeline.py, pinfo.py, psort.py and psteal.py. Together they turn a forensic disk image (E01 or raw) or a mounted folder into one normalized timeline that fuses file-system MACB times, registry, EVTX, browser history, prefetch, LNK, $UsnJrnl, syslog and many more artifact types.

The agent can then help filter that timeline, export it, and import it into Timesketch, a web-based platform where a team can tag, star and comment on events. The skill is aimed at incident responders reconstructing what happened on a compromised machine.

Install the skill (ZIP download or Claude apps upload)

Download the skill ZIP from the skill's page in this directory. Then choose one of two options.

For Claude Code, unzip it into ~/.claude/skills/ for a personal install, or into a project's .claude/skills/ folder to share it with that project.

In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.

Personal Claude Code install: ~/.claude/skills/
Project install: .claude/skills/ inside your project
Claude apps: Settings → Capabilities → Skills, then upload

Install Plaso and prepare your environment

The skill's source recommends Docker as the supported, reproducible way to run Plaso. Pull the image and run a tool with your evidence folder mounted.

On Ubuntu you can instead install Plaso from the GIFT PPA. You also need Python 3, and a Timesketch instance if you plan to do the import step. Only use evidence you are authorized to analyze, and work from forensic images or copies.

Python 3
Plaso, via the log2timeline/plaso Docker image or plaso-tools from the GIFT PPA
Docker, if you use the containerized option in scripts/agent.py
A Timesketch instance and timesketch_importer, for the import step
A forensic image (E01 or raw) or a mounted file system you are authorized to analyze

docker pull log2timeline/plaso
docker run -v /cases:/data log2timeline/plaso log2timeline.py --version
sudo add-apt-repository ppa:gift/stable
sudo apt-get update && sudo apt-get install -y plaso-tools

Trigger the skill with natural requests

You do not need to name the tools. Describe the job in plain language and mention the evidence and the goal. Good requests name the host, the image and the question you are trying to answer.

Examples of requests that should trigger the skill: build a super timeline from this E01 image, export only a suspicious date window in UTC, check the timeline for timestomping or log clearing, or import this .plaso file into Timesketch for the team to review.

Build a super timeline from /cases/greendale/image.E01 and save it as a .plaso file.
Show me what parsers ran in timeline.plaso and whether the event counts look right.
Export a UTC CSV of the timeline for the period around the suspected intrusion.
Check the timeline for MACB timestamps that disagree with $UsnJrnl entries and for EventLog cleared (1102) records.
Import timeline.plaso into Timesketch sketch 1 under the name greendale-host01.

Core workflow the agent follows

The skill works in stages. It first extracts events into a .plaso storage file. You can narrow parsers with --parsers, using presets such as win7 or webhist. It then inspects the file with pinfo.py, exports a filtered timeline with psort.py (CSV with l2tcsv, or JSON lines with json_line), and imports the result into Timesketch.

psteal.py can run extraction and CSV export in one step when you only need a quick triage output.

Extract with log2timeline.py --storage-file
Check with pinfo.py
Export with psort.py, normalizing time to UTC
Import with timesketch_importer
Triage in Timesketch with filters, tags, saved searches and analyzers

log2timeline.py --parsers "win7,!filestat" --storage-file timeline.plaso /cases/image.E01
pinfo.py timeline.plaso
psort.py --output-time-zone 'UTC' -o json_line -w supertimeline.jsonl timeline.plaso
psteal.py --source /cases/greendale/image.E01 -o l2tcsv -w supertimeline.csv

Safety notes: scripts and network use

This skill runs scripts and uses the network. Its source lists scripts/agent.py and notes that Docker is needed for the containerized option. The Timesketch step sends data to a Timesketch server, so check the host address before you run the importer. The skill's own warning applies: build timelines only from evidence you are authorized to analyze, and preserve chain of custody.

Review the scripts before running them on sensitive evidence, and run them on forensic copies rather than originals.

Confirm you are authorized to examine the evidence before starting.
Work from a forensic image or copy, not the original media.
Check the --host value before running timesketch_importer.
Keep a record of commands and outputs for chain of custody.

Tips for useful timelines

A full timeline is large. Scope it with parsers and a date filter so you can read it. Use pinfo.py to confirm that the parsers you expected ran and that event counts are not zero. In Timesketch, tag and comment on events as you go, then build your narrative from events that corroborate each other across sources.

The skill's anti-forensics checks work best when you compare sources. A timestamp that disagrees with the USN journal, a gap in the logs, or a file that was deleted and recreated are all easier to see on one unified timeline.

Start with a narrow time window, then widen it.
Use pinfo.py before exporting to check parser coverage.
Export in UTC so events from different sources line up.
Filter Timesketch by data_type, for example windows:evtx:record or fs:stat.

What people use it for

Reconstructing the sequence of events on a host after a suspected intrusion, using a forensic image.
Checking whether timestamps or log records were altered, by comparing MACB times with the USN journal and event logs.
Producing a scoped CSV or JSON timeline for a report or for another analyst.
Running a shared triage session in Timesketch, where a team tags and comments on the same timeline.
Learning how forensic timelines are built and triaged, as a student would.

Frequently asked questions

How do I install the building-super-timelines-with-plaso skill?

Download the skill ZIP from this page. Unzip it into ~/.claude/skills/ for a personal install or into a project's .claude/skills/ folder, or upload it in the Claude apps under Settings → Capabilities → Skills.

What do I need before I can use this skill?

You need Python 3, Plaso (through the log2timeline/plaso Docker image or plaso-tools from the GIFT PPA), and a forensic image or mounted file system you are authorized to analyze. Docker is needed for the containerized option, and a Timesketch instance with timesketch_importer is needed for the import step.

Is Plaso free, and what is the licence?

The skill is listed under the Apache-2.0 licence. The skill's source describes Plaso as open-source, and Timesketch is described as an open-source web platform. Check each project's own licence before you deploy it.

Can this skill do live monitoring or real-time detection?

No. It is a post-incident, batch analysis workflow. It builds a timeline from evidence you already have, such as a disk image or mounted folder.

How does this compare with simpler log search tools?

Plaso fuses many artifact types into one timeline, which is useful for reconstructing an incident. For general log search that does not need a forensic timeline, the skill's own scope says simpler tools are enough.

Why does pinfo show few or no events, and what should I check?

Run pinfo.py on the .plaso file to see which parsers ran and their event counts. If the expected parsers are missing, check the --parsers value you used, and make sure the source path points to the correct image or mounted folder.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits incident responders, DFIR analysts and students who need a repeatable way to build and triage a Plaso super timeline from a forensic image. It is not suited to live monitoring, to non-forensic log search, or to evidence you are not authorized to examine.

Download the skill