Skip to content
Get packs

Building Super Timelines with Plaso

Build forensic super-timelines from disk images with Plaso and triage them in Timesketch

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
4 files

What it does

When installed, the agent can guide or run Plaso's command-line tools (log2timeline.py, psort.py, pinfo.py, psteal.py) to turn a forensic disk image or mounted folder into one chronological timeline combining file-system, registry, event log, browser and other artifacts. It can then help filter that timeline, export it, and import it into Timesketch for team review. It is aimed at incident responders reconstructing what happened on a compromised machine.

Great for

  • Incident responders and DFIR analysts reviewing a forensically imaged host
  • Students learning how forensic timelines are built and triaged
  • Teams that already run Timesketch and want a standard import workflow

Skip it if

  • Live monitoring or real-time detection, since this is a post-incident batch analysis workflow
  • Use on evidence you are not authorized to examine, which the skill itself warns against and which may be illegal or break chain of custody
  • Non-forensic tasks such as general log search, where simpler tools are enough

Try asking

  • “Build a super timeline from this E01 image and export only events from January 2026 as CSV”
  • “Show me the parsers available for a Windows 7 style preset and run extraction with them excluding file stat”
  • “Import my timeline.plaso file into Timesketch sketch 1 under the name greendale-host01”
  • “Help me look for timestomping by comparing MACB times with the USN journal in my timeline”
Step-by-step guide: how to use Building Super Timelines with PlasoInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.

    building-super-timelines-with-plaso.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-super-timelines-with-plaso.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-super-timelines-with-plaso.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work on a copy or verified forensic image, never the original evidence, and record hashes and chain of custody
  • Scope parsers with presets such as win7 or webhist to reduce processing time and noise before a full run
  • Review the script's dry-run option before executing commands, since it invokes external tools and can pass Timesketch credentials on the command line

What's inside

  • references/api-reference.md
  • references/standards.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.