Mythic C2 Reporting,
Without the Exports
Log every Mythic task, callback, credential, and file to your engagement timeline as it happens. Red team reporting from Mythic without exporting a single C2 log.
Just Test. The Timeline Writes Itself.
A red team operation lives in Mythic for weeks. When it ends, someone has to turn thousands of tasks and callbacks into an activity log the client can read. The Neuron CLI Mythic collector builds that log while you operate.
Start the collector once and it relays the operation into Neuron for as long as it runs. Every task, callback, harvested credential, and downloaded file lands on the engagement timeline, attributed to the operator and timestamped, next to every command you ran from your recording shell.
It authenticates with a scoped Mythic API token, never the admin secret, and tunnels over your own SSH when Mythic only listens on the C2 server.
$ neuron collector mythic --ssh c2 \ --mythic-url https://127.0.0.1:7443/graphql Tunnelling to c2 over SSH✓ Streaming Mythic to Acme Red Team Q4 $ neuron collector list mythic running Acme Red Team Q4- 14:03 Mythic Credential ACME\svc_sql
- 14:02 Mythic Task: sekurlsa::logonpasswords
- 13:41 Mythic New callback WS-FIN-07
- 13:37 Command ssh c2: ./mythic-cli status
Why Mythic Reporting Takes So Long
Mythic is built to run an operation, not to write one up. Three weeks in, the client asks for every action taken against one host, in order, with timestamps, and the answer is buried across callbacks, operators, and task pages.
So the end of every operation turns into the same chore. Pull task history out of the UI or the GraphQL API, export callbacks, copy credentials into a spreadsheet, download screenshots one at a time, then line all of it up against what the team did from their own terminals. The activity log is the part of a red team report clients read most closely, and it is built last, from memory, under deadline.
Deconfliction makes it worse. When the blue team asks whether the alert at 14:02 was you, the answer should take seconds, not a search through four operators' consoles.
Everything Mythic Produces, On the Engagement
The Mythic collector streams the moment each event happens, for as long as it runs.
Tasks and Output
Every task issued in the operation, with the command, its parameters, the operator who issued it, the callback it ran on, and the output it returned.
Callbacks
Each new callback as it checks in, with host, user, process, and integrity level, so the timeline shows exactly when and where access was gained.
Harvested Credentials
Credentials collected through Mythic, recorded on the engagement and ready to tie to the findings they prove.
Files and Screenshots
Files downloaded from target hosts and screenshots taken through Mythic, kept with the engagement as evidence.
Operator Attribution
Every event carries the Mythic operator who caused it, so a multi-operator operation still reads as one accurate record.
C2 and Shell Side by Side
The ssh session where you ran mythic-cli, the payload you built, and the callback it produced read as one sequence instead of three tools' worth of logs.
Stop rebuilding your red team timeline from C2 logs
The Neuron CLI's Mythic collector streams a live Mythic operation into Neuron. Every task, callback, credential and downloaded file lands on the engagement timeline as it happens, so when the op ends, your timeline is already done. Read the transcript.
How to Log Mythic to Your Engagement
- 01
Pair the operator laptop with the operation
Run neuron pair on the laptop you operate from and approve it against the red team engagement. The collector writes to that engagement only, so two operations running in the same week never bleed into each other.
$ neuron pair - 02
Create a scoped Mythic API token
Create an API token in Mythic for the operation. The collector reads it from --mythic-token or the MYTHIC_API_TOKEN environment variable. Never give it the Mythic admin secret.
$ export MYTHIC_API_TOKEN=<token> - 03
Start the collector
Point it at the Mythic GraphQL endpoint. When Mythic only listens on the C2 server, add --ssh and the collector tunnels over your own SSH, with your config, keys, agent, and jump hosts.
$ neuron collector mythic --ssh c2 --mythic-url https://127.0.0.1:7443/graphql - 04
Operate as normal
Task your callbacks from Mythic exactly as you always do. neuron collector list shows what is running, and neuron collector stop ends it when the operation closes.
$ neuron collector stop mythic
Your Infrastructure. Your Data.
The CLI runs on the operator's laptop, the bridge between Neuron and your C2 server. Neuron, the CLI, and Mythic all sit inside your network. Nothing is routed through a third-party cloud.
Mythic needs the Red Team module on your Neuron server.
From Mythicto the Final Report
Because the record is built during the operation, the report starts from evidence instead of memory. Promote the task that proved domain compromise straight into a finding with its output attached. The credential it harvested is already on the engagement.
The activity log appendix is the timeline itself: every Mythic task and every shell command, attributed and in order, filtered to the hosts and dates the client asks about. Deconfliction requests take seconds.
The debrief gets easier too. Walk the client's defenders through the operation from the first callback to the objective, with the exact time of each step, and they can line it up against their own SIEM to see what they caught and what they missed.
Mythic Integration FAQ
The questions teams ask most about Mythic and Neuron.
How do I export Mythic logs for a red team report?
With Neuron you do not have to. The Neuron CLI Mythic collector streams tasks, callbacks, credentials, and files into the engagement while the operation runs, so the activity log is already built when testing ends. Filter the timeline by host, operator, or date and it becomes the report appendix.
Does the Mythic collector need the Mythic admin secret?
No, and it should never be given one. The collector authenticates with a scoped Mythic API token, passed with --mythic-token or the MYTHIC_API_TOKEN environment variable.
Can the collector reach Mythic when it only listens on the C2 server?
Yes. Add --ssh and the host, and the CLI forwards the Mythic GraphQL endpoint over your own ssh. Your SSH config, keys, agent, and jump hosts all apply. TLS verification is skipped automatically for a tunnelled or loopback endpoint because nothing sits in between to intercept it.
Which Mythic agents does the collector work with?
All of them. The collector reads the operation through Mythic's own GraphQL API rather than talking to agents, so tasks and callbacks from Apollo, Athena, Poseidon, Medusa, or a custom agent all land the same way.
Can multiple operators share one Mythic operation in Neuron?
Yes. One collector streams the whole operation, and every task keeps the Mythic operator who issued it, so a multi-operator operation reads as one accurate timeline alongside each tester's own recording shell.
Where do credentials harvested in Mythic end up?
On the engagement in your own self-hosted Neuron server, next to the task that harvested them. The collector sends from the operator laptop over HTTPS, and no credential, task output, or file passes through a third-party cloud.
More Neuron Integrations
Sliver C2 Reporting and Activity Logging
C2 FrameworksMetasploit Reporting and Session Logging
C2 FrameworksGoPhish Reporting and Campaign Tracking
PhishingEvilginx Reporting and Session Capture Logging
PhishingNetExec (nxc) Reporting and Logging
Active DirectoryCertipy AD CS Reporting and ESC Findings
Active DirectoryBloodHound Reporting and Attack Path Import
Active DirectoryNmap Reporting: Nmap XML to Pentest Report
Network DiscoveryReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform