---
name: rt-timeline
description: "View and manage engagement activity timeline. Shows chronological list of all activities, commands run, findings discovered, and milestones reached. Reads from _rtexit-output/docs/engagement/timeline.md. Useful for reporting engagement duration and activity sequence, creating a log for legal documentation."
---

# rt-timeline

## Overview

The engagement timeline is the authoritative chronological record of everything that happened during a red team engagement — every command run, every finding discovered, every milestone reached, and every decision made. It serves as the narrative backbone of the engagement, supporting the final technical report, executive summary, and any legal documentation the client requires.

This skill reads from, displays, and helps manage `_rtexit-output/docs/engagement/timeline.md`. It is the operator's primary tool for reviewing engagement history, reconstructing the attack chain for reporting, and demonstrating professional conduct to auditors, legal counsel, or client security teams.

### When to Use This Skill

- At the start of each session to review what was accomplished previously before continuing.
- After completing a phase (recon, exploitation, post-exploitation) to confirm all activities are logged.
- When writing the final technical report to retrieve the accurate sequence of events.
- When a client or legal team asks for an engagement activity log.
- When handing off to another operator on a team engagement.
- Before closing the engagement to verify completeness of the activity record.
- Anytime you need to answer: "What did we do, and in what order?"

### What the Timeline Contains

Each timeline entry records:

- **Timestamp** — UTC date and time the activity occurred
- **Phase** — engagement phase (Planning, Recon, Exploitation, Post-Exploitation, Reporting)
- **Activity type** — command run, finding discovered, milestone reached, tool output captured, operator note
- **Description** — plain-language summary of what happened and what it means
- **Reference links** — cross-references to findings (F-XXX), evidence files, or other skill outputs

---

## Prerequisites

Before using this skill, confirm:

1. Engagement is initialized. The timeline file is created by `autodoc_engine.py init`:

   ```bash
   python3 _rtexit/scripts/autodoc_engine.py init \
     --ref ENG-2024-047 \
     --client "Meridian Financial Group" \
     --methodology ptes
   ```

2. The output file exists at `_rtexit-output/docs/engagement/timeline.md`. If it does not, run the init command above.

3. You know the engagement reference number (e.g., `ENG-2024-047`) and the current phase.

---

## Step-by-Step Workflow

### Step 1 — View the Full Timeline

Load and display the complete contents of the timeline file:

```
_rtexit-output/docs/engagement/timeline.md
```

Present the entries in chronological order (oldest first). For each entry show:
- Timestamp (UTC)
- Phase label
- Activity type tag
- Description

If the file does not exist, inform the operator and suggest running `autodoc_engine.py init`.

---

### Step 2 — Filter by Phase or Activity Type

To focus on a specific phase or type of activity, filter the timeline entries and display only matching lines.

**Filter by phase:**

```
Planning | Recon | Exploitation | Post-Exploitation | Reporting
```

**Filter by activity type:**

```
COMMAND | FINDING | MILESTONE | NOTE | TOOL-OUTPUT | HANDOFF
```

Example request: "Show me all findings discovered during the Exploitation phase."

Display filtered results with the same format as the full timeline view, preceded by a count of matching entries.

---

### Step 3 — Add a Timeline Entry

When the operator reports an activity that is not yet logged, append a new entry to the timeline file using `autodoc_engine.py`:

```bash
python3 _rtexit/scripts/autodoc_engine.py timeline \
  --ref ENG-2024-047 \
  --phase Exploitation \
  --type FINDING \
  --description "Discovered unauthenticated IDOR on /api/v2/users/{id} — any authenticated session can read arbitrary user PII. Logged as F-004."
```

**Entry format in the timeline file:**

```markdown
## 2024-11-14T14:30:22Z | Exploitation | FINDING

Discovered unauthenticated IDOR on /api/v2/users/{id} — any authenticated session can read arbitrary user PII. Logged as F-004.

References: F-004, evidence/http-logs/F-004-idor-user-pii-2024-11-14T143022Z.xml
```

If `autodoc_engine.py` does not support a `timeline` subcommand in the current installation, append the formatted entry directly to the file and confirm the write was successful.

---

### Step 4 — Generate Timeline Summary for Reporting

When the operator needs a reporting-ready summary of the engagement timeline, produce a condensed narrative version suitable for inclusion in the executive report or technical appendix.

**Format:**

```
Engagement Timeline Summary — ENG-2024-047

Start: 2024-11-11T08:00:00Z
End:   2024-11-22T17:00:00Z
Duration: 11 days

Phase Activity Log:
  [Planning]         3 milestones, 0 findings, 8 commands
  [Recon]            12 milestones, 2 findings, 47 commands
  [Exploitation]     8 milestones, 9 findings, 134 commands
  [Post-Exploitation] 5 milestones, 3 findings, 61 commands
  [Reporting]        2 milestones, 0 findings, 4 commands

Total findings documented: 14 (2 Critical, 4 High, 5 Medium, 3 Low)
Total commands logged: 254
Total evidence artifacts: 31
```

After the summary, offer to show the full chronological list sorted by phase.

---

### Step 5 — Validate Timeline Completeness

Before closing the engagement, check the timeline for gaps:

1. Confirm the engagement has entries spanning from the start date to the current date with no unexplained multi-day gaps.
2. Cross-reference with the findings tracker: every finding in `_rtexit-output/docs/findings/` should have at least one corresponding timeline entry of type `FINDING`.
3. Cross-reference with the evidence chain log: every evidence artifact should have a corresponding `TOOL-OUTPUT` or `COMMAND` timeline entry near the same timestamp.
4. Check that all four required milestones are present: SEAD created, scope finalized, exploitation authorized, final report delivered.

Report any gaps found and prompt the operator to fill them before the engagement is closed.

---

## Integration with RTExit Scripts and Other Skills

### autodoc_engine.py

The primary script that creates and maintains the timeline file. Key operations:

```bash
# Initialize engagement and create timeline.md
python3 _rtexit/scripts/autodoc_engine.py init --ref ENG-2024-047 --client "Acme Corp" --methodology ptes

# Add a timeline entry (if timeline subcommand is available)
python3 _rtexit/scripts/autodoc_engine.py timeline --ref ENG-2024-047 --phase Recon --type MILESTONE --description "Attack surface map completed. 3 high-priority targets identified."

# Generate engagement summary
python3 _rtexit/scripts/autodoc_engine.py summary --ref ENG-2024-047
```

### Related Skills

| Skill | Relationship to rt-timeline |
|---|---|
| `rt-status` | Reads last 10 timeline entries for the status dashboard. Run `rt-status` for a quick overview; run `rt-timeline` for the full history. |
| `rt-evidence-chain` | Generates evidence custody entries that should correspond to `TOOL-OUTPUT` or `FINDING` timeline entries. Cross-reference both logs before reporting. |
| `rt-finding-document` | Every call to `rt-finding-document` should produce a matching `FINDING` entry in the timeline. |
| `rt-executive-report` | The executive report engagement narrative section is derived from the timeline summary. Run `rt-timeline` step 4 to produce the input for that section. |
| `rt-technical-report` | The attack chain and chronological methodology sections of the technical report are built directly from timeline entries filtered by phase. |
| `rt-create-sead` | SEAD creation is a `Planning` phase `MILESTONE` — confirm it appears in the timeline after running this skill. |
| `rt-scope-definition` | Scope finalization is a `Planning` phase `MILESTONE` — confirm it appears in the timeline. |
| `rt-kill-chain-map` | Kill chain maps are derived from `Exploitation` and `Post-Exploitation` phase `COMMAND` and `FINDING` entries in the timeline. |

---

## Example Outputs and Interactions

### Example 1 — Viewing the Full Timeline

**Operator:** "Show me the full engagement timeline."

**Agent response:**

```
Engagement Timeline — ENG-2024-047 | Meridian Financial Group

[2024-11-11T08:15:04Z] Planning | MILESTONE
  Engagement initialized. SEAD created, rules of engagement signed by client CISO.
  References: docs/engagement/sead.md

[2024-11-11T09:42:17Z] Planning | MILESTONE
  Scope finalized. 3 external IP ranges, 2 web applications, 1 internal network segment in scope.
  References: docs/engagement/scope.md

[2024-11-12T10:05:33Z] Recon | COMMAND
  Ran subdomain enumeration on meridianfinancial.com. Discovered 14 subdomains, 3 resolving to out-of-scope CDN.
  References: docs/recon/subdomain-enum-2024-11-12.md

[2024-11-12T14:22:09Z] Recon | FINDING
  Discovered exposed .git directory on dev.meridianfinancial.com. Logged as F-001 (High).
  References: F-001, evidence/http-logs/F-001-git-exposure-2024-11-12T142209Z.txt

[2024-11-13T09:18:55Z] Recon | MILESTONE
  Attack surface map completed. 5 high-priority targets identified.
  References: docs/recon/attack-surface-map.md

[2024-11-14T10:00:00Z] Exploitation | MILESTONE
  Exploitation phase authorized by operator. Targeting high-priority web application findings.

[2024-11-14T14:30:22Z] Exploitation | FINDING
  IDOR on /api/v2/users/{id} — unauthenticated access to arbitrary user PII. Logged as F-004 (Critical).
  References: F-004, evidence/http-logs/F-004-idor-pii-2024-11-14T143022Z.xml

Total entries: 7 | Duration so far: 3 days 6 hours
```

---

### Example 2 — Adding a Missing Entry

**Operator:** "I ran nmap on 192.168.1.0/24 yesterday at 2pm UTC and forgot to log it."

**Agent response:**

```
Adding timeline entry for the nmap scan.

Entry details:
  Timestamp: 2024-11-13T14:00:00Z (operator-provided, UTC)
  Phase:     Recon
  Type:      COMMAND
  Description: Ran nmap -sV -sC -p- scan against 192.168.1.0/24. Identified 14 live hosts, 3 with open management ports (22, 3389, 5985).

Appending to _rtexit-output/docs/engagement/timeline.md...
Done. Entry added. Note: manually-backdated entries are flagged with [LATE-ENTRY] in the custody log to maintain audit integrity.
```

---

### Example 3 — Reporting Summary

**Operator:** "Give me the timeline summary for the executive report."

**Agent response:**

```
Engagement Timeline Summary — ENG-2024-047

Start:    2024-11-11T08:15:04Z
End:      2024-11-22T16:45:00Z
Duration: 11 days, 8 hours, 29 minutes

Phase Breakdown:
  Planning          (Nov 11)       2 milestones, 0 findings,  6 commands
  Recon             (Nov 11-13)    3 milestones, 2 findings, 31 commands
  Exploitation      (Nov 14-19)    4 milestones, 9 findings, 98 commands
  Post-Exploitation (Nov 19-21)    2 milestones, 3 findings, 44 commands
  Reporting         (Nov 21-22)    1 milestone,  0 findings,  3 commands

Totals:
  Milestones logged: 12
  Findings logged:   14  (2 Critical, 4 High, 5 Medium, 3 Low)
  Commands logged:   182
  Evidence artifacts: 27

Key Milestones:
  2024-11-11 — Engagement authorized, SEAD and scope signed
  2024-11-13 — Attack surface map completed
  2024-11-14 — Exploitation phase initiated
  2024-11-19 — Internal pivot achieved, lateral movement complete
  2024-11-22 — Final report delivered to client
```

---

### Example 4 — Completeness Validation

**Operator:** "Validate the timeline before we close out."

**Agent response:**

```
Timeline Completeness Check — ENG-2024-047

Checking coverage gaps... No multi-day gaps detected.
Checking findings cross-reference...
  F-001 through F-014: All 14 findings have matching FINDING timeline entries. PASS
Checking evidence cross-reference...
  27 of 27 evidence artifacts have matching COMMAND or TOOL-OUTPUT entries within 30 minutes of artifact timestamp. PASS
Checking required milestones...
  SEAD created:             PASS (2024-11-11T08:15:04Z)
  Scope finalized:          PASS (2024-11-11T09:42:17Z)
  Exploitation authorized:  PASS (2024-11-14T10:00:00Z)
  Final report delivered:   PASS (2024-11-22T16:45:00Z)

Result: Timeline is complete and consistent. Safe to close engagement.
```

---

## Practical Usage Tips

**Log activities in real time, not at end of day.** Timestamps that are clustered at day-end or session-end are a red flag for auditors and suggest the log was reconstructed from memory rather than captured live. Run `autodoc_engine.py timeline` or note activities as they happen.

**Use LATE-ENTRY for backdated additions.** If you must add an entry after the fact, flag it explicitly. Auditors prefer a clearly marked late entry over an artificially tidy log that looks fabricated.

**Cross-reference everything.** Every FINDING entry should reference the finding ID (F-XXX). Every COMMAND entry that produced an evidence file should reference the evidence filename. This makes the timeline self-navigable for report writing.

**Phase transitions are milestones.** Whenever you shift from one phase to the next, log a MILESTONE entry stating that the phase began and why (e.g., "Exploitation authorized — all recon objectives complete, attack surface map signed off by lead operator").

**Use the timeline to write reports, not your memory.** When drafting the technical report or executive summary, load the timeline first and work through it chronologically. Every section of the narrative should trace to a timeline entry.

**The timeline is a legal document.** In the event of a dispute, incident, or post-engagement legal proceeding, the timeline log — combined with the evidence chain — is the primary record of operator conduct. Maintain it as if a court will read it.

**Protect the output directory.** The `_rtexit-output/` directory contains the timeline, findings, and evidence. Restrict access to authorized operators only. Do not store it on shared or unencrypted drives.

**Before handing off to another operator**, run this skill to display the last 20 entries and confirm the incoming operator has read and acknowledged the current engagement state. Log the handoff as a `HANDOFF` type milestone entry.
