competition-forensic-timeline

Name: competition-forensic-timeline
Availability: InStock
Author: xjtu-wang

Correlate EVTX, Sysmon, registry, memory, and PCAP artifacts into a defendable attacker timeline.

4|Updated Apr 9, 2026

Search Tags:#timeline #forensics #incident-response #dfir #memory-analysis #artifact-correlation

Ready to run

npx skills add https://github.com/xjtu-wang/DigAgent --skill competition-forensic-timeline

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: competition-forensic-timeline
Source: https://github.com/xjtu-wang/DigAgent/tree/main/.agents/skills/competition-forensic-timeline
Command: npx skills add https://github.com/xjtu-wang/DigAgent --skill competition-forensic-timeline

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Reconstruct a reliable incident chronology by cross-correlating diverse artifacts (EVTX, PCAP, registry, memory, mail traces, and more) after sandbox assumptions are established.

Core Features & Use Cases

Correlate cross-source artifacts using shared identifiers (PID, logon ID, GUID, message ID, hostname, IP).
Build a compact, defendable timeline that highlights the decisive steps from initial access to persistence or exfiltration.
Preserve both raw artifacts and parsed summaries to ensure traceability and auditability.
Use Case: Investigate a multi-faceted compromise by turning scattered evidence into an ordered sequence of attacker actions.

Quick Start

Provide a cross-artifact dataset (EVTX, PCAP, registry, memory) after sandbox assumptions are set, and have the skill reconstruct a replayable incident timeline.

Frequently Asked Questions about competition-forensic-timeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I build a forensic timeline from scattered incident response artifacts?▼

Forensic timeline reconstruction correlates cross-source artifacts like EVTX, PCAP, and memory traces using shared identifiers such as PID or GUID. This process recreates the attacker activity chronology from initial access to exfiltration.

How does artifact correlation work across diverse sources like Sysmon and mailbox traces?▼

Artifact correlation matches shared identifiers like logon ID, hostname, or message ID across Sysmon, registry, and mailbox traces. This cross-referencing links isolated events into a defendable sequence of attacker actions.

Can I use memory analysis and PCAP data together to reconstruct a breach chronology?▼

Yes, you can reconstruct a breach chronology by correlating memory analysis outputs with PCAP data. The skill preserves source paths, IDs, hashes, and timestamps to ensure traceability across both network and host evidence.

What is the best way to identify validation gaps in a DFIR timeline?▼

Identify validation gaps by cross-referencing diverse artifacts and separating missing or conflicting evidence from the compact decisive timeline. This ensures the final incident chronology remains defendable and auditable.

Does this timeline reconstruction approach preserve raw EVTX and disk metadata for auditing?▼

Yes, the timeline reconstruction preserves both raw artifacts and parsed summaries from EVTX and disk metadata. This ensures full traceability and auditability while producing a compact sequence of attacker actions.