Skip to content
Get packs

Timesketch Incident Timeline Builder

Build and search shared forensic incident timelines in Timesketch for attack chain reconstruction

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

Timesketch is an open-source tool for building a shared, searchable timeline of events from logs and forensic artifacts during a security incident. This skill teaches the agent how to guide an investigator through setting up a Timesketch server, importing data (Plaso output, CSV or JSONL files), running analyzers, searching for suspicious activity such as lateral movement or PowerShell execution, and writing up the attack narrative as a story. It also includes Python helper scripts that can call the Timesketch API to log in, list or create sketches, and run timeline import and analysis steps.

Great for

  • Incident responders and DFIR analysts who need to reconstruct the order of events in an intrusion
  • Security teams where several analysts must tag and annotate the same timeline
  • Engineers automating repeatable Timesketch imports into a lab or staging instance

Skip it if

  • People with no incident response background, since the skill assumes familiarity with forensic artifacts and log formats and does not teach them
  • Use against systems you are not authorized to investigate, because forensic evidence handling and legal authority are outside what the skill checks; the skill itself says to confirm authorization
  • Production evidence without a tested lab first, since the skill recommends a test environment and the scripts send credentials and data to a live server

Try asking

  • “Help me set up Timesketch with Docker and import a Plaso file from a Windows endpoint for case 2025-001”
  • “Write a Timesketch search to find Windows logon type 3 events that could indicate lateral movement”
  • “Create a CSV import template for our firewall and EDR logs and load it into a new sketch”
  • “Draft an investigation story that maps my timeline findings to MITRE ATT&CK techniques”
Step-by-step guide: how to use Timesketch Incident Timeline BuilderInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    building-incident-timeline-with-timesketch.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-incident-timeline-with-timesketch.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-incident-timeline-with-timesketch.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the Python scripts and Docker setup only against a lab or test Timesketch instance first, and review the scripts before supplying real credentials
  • Keep the original evidence files read-only and work from copies so the timeline stays defensible
  • Ask the agent to explain each Timesketch query before running it so you can verify the results against your own knowledge of the artifacts

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.