skills.rest
xjtu-wang
xjtu-wangCOMMUNITY
Explore all skills by this author →
GitHub

competition-forensic-timeline

Correlate EVTX, Sysmon, registry, memory, and PCAP artifacts into a defendable attacker timeline.

4|Updated Apr 9, 2026
Search Tags:#timeline#forensics#incident-response#dfir#memory-analysis#artifact-correlation
One-click install
npx skills add https://github.com/xjtu-wang/DigAgent --skill competition-forensic-timeline
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: competition-forensic-timeline
Source: https://github.com/xjtu-wang/DigAgent/tree/main/.agents/skills/competition-forensic-timeline
Command: npx skills add https://github.com/xjtu-wang/DigAgent --skill competition-forensic-timeline

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Reconstruct a reliable incident chronology by cross-correlating diverse artifacts (EVTX, PCAP, registry, memory, mail traces, and more) after sandbox assumptions are established.

Core Features & Use Cases

  • Correlate cross-source artifacts using shared identifiers (PID, logon ID, GUID, message ID, hostname, IP).
  • Build a compact, defendable timeline that highlights the decisive steps from initial access to persistence or exfiltration.
  • Preserve both raw artifacts and parsed summaries to ensure traceability and auditability.
  • Use Case: Investigate a multi-faceted compromise by turning scattered evidence into an ordered sequence of attacker actions.

Quick Start

Provide a cross-artifact dataset (EVTX, PCAP, registry, memory) after sandbox assumptions are set, and have the skill reconstruct a replayable incident timeline.

Frequently Asked Questions about competition-forensic-timeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a forensic timeline from scattered incident response artifacts?▼

Forensic timeline reconstruction correlates cross-source artifacts like EVTX, PCAP, and memory traces using shared identifiers such as PID or GUID. This process recreates the attacker activity chronology from initial access to exfiltration.

How does artifact correlation work across diverse sources like Sysmon and mailbox traces?▼

Artifact correlation matches shared identifiers like logon ID, hostname, or message ID across Sysmon, registry, and mailbox traces. This cross-referencing links isolated events into a defendable sequence of attacker actions.

Can I use memory analysis and PCAP data together to reconstruct a breach chronology?▼

Yes, you can reconstruct a breach chronology by correlating memory analysis outputs with PCAP data. The skill preserves source paths, IDs, hashes, and timestamps to ensure traceability across both network and host evidence.

What is the best way to identify validation gaps in a DFIR timeline?▼

Identify validation gaps by cross-referencing diverse artifacts and separating missing or conflicting evidence from the compact decisive timeline. This ensures the final incident chronology remains defendable and auditable.

Does this timeline reconstruction approach preserve raw EVTX and disk metadata for auditing?▼

Yes, the timeline reconstruction preserves both raw artifacts and parsed summaries from EVTX and disk metadata. This ensures full traceability and auditability while producing a compact sequence of attacker actions.

Related Skills

Explore More Data & Analytics Skills→
LeoWSY-hashblueLeoWSY-hashblue
3

dfir

Correlates EVTX, PCAP, memory, and MFT artifacts to reconstruct Windows incident timelines.

Community
Advanced
tekgrunttekgrunt

incident-responder

Coordinate incident response workflows across detection, containment, eradication, and recovery.

Community
Advanced
FuzzdkkFuzzdkk
3

timeline

Aggregates timestamps from disk images, memory dumps, logs, PCAPs, and reports into a unified forensic timeline.

Community
Advanced
ramzxyramzxy
1

ctf-forensics

Identify forensic artifacts across disk images, memory dumps, logs, and PCAPs.

Community
Advanced