mac_get_user_timeline
Build a timeline of user account events, including creation, modification, and deletion, from a triage collection for a specific username.
Instructions
Build a timeline for a specific user account. Shows account creation, modification, deletion, and related activity.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| time_end | No | ISO datetime - end of time window | |
| username | Yes | Username to investigate | |
| time_start | No | ISO datetime - start of time window | |
| artifacts_dir | Yes | Path to triage collection root |