Sliver C2 Reporting,
Logged as It Happens
Stream Sliver sessions, beacons, beacon tasks, credentials, and loot into your engagement timeline as they happen. Sliver red team reporting with the activity log already built.
Just Test. The Timeline Writes Itself.
Sliver keeps its history on the server. Getting it into a report means scrolling operator consoles and copying output by hand, long after the details have gone fuzzy. Run the Sliver collector for the length of the operation and that history is on the engagement before anyone asks for it.
The collector connects as a Sliver operator and streams the server into the engagement. Sessions, beacons, beacon tasks and their results, harvested credentials, and loot all land on the timeline the moment they happen, attributed and timestamped.
It buffers to a durable spool, so a dropped connection resumes without gaps, and it tunnels over your own SSH when the Sliver server is only reachable from another box.
$ neuron collector sliver --ssh c2 \ --sliver-config ~/.sliver-client/configs/neuron.cfg Tunnelling to c2 over SSH✓ Streaming Sliver to Acme Red Team Q4 $ neuron collector list sliver running Acme Red Team Q4- 10:22 Sliver Loot: web.config from WEB-02
- 10:19 Sliver Beacon task: execute-assembly Seatbelt
- 10:04 Sliver New beacon QUIET_OTTER on WEB-02
- 09:58 Command ssh c2: sliver-server operator
Why Sliver Reporting Takes So Long
A Sliver operation spreads across interactive sessions, long-haul beacons, and a task queue that only drains when a beacon checks in. Reconstructing who ran what, on which implant, and when, means reading console history and beacon task output one implant at a time.
Credentials and loot end up in the Sliver server's own store, separate from the engagement where the findings get written. By the time the report is due, the evidence is split across the C2 server, operator laptops, and a spreadsheet someone started on day two.
And when the client's SOC asks whether a beacon on their finance subnet belongs to you, the answer depends on whoever still has the right console open.
Everything Sliver Produces, On the Engagement
The Sliver collector streams the moment each event happens, for as long as it runs.
Sessions and Beacons
Every new session and beacon as it registers, with implant name, host, user, and transport, so first access is on the record the moment it happens.
Beacon Tasks and Results
Each task queued to a beacon and the result it returned on check-in, attributed to the operator who queued it. A task queued at 02:00 and answered at 06:00 shows both times.
Harvested Credentials
Credentials stored on the Sliver server, recorded on the engagement and ready to tie to findings.
Loot
Files and data looted from target hosts, kept with the engagement as evidence instead of on a C2 server you will tear down.
No Gaps
The collector buffers to a durable spool and resumes where it left off after a dropped connection, so a VPN drop at 3am does not leave a hole in the record.
Implant to Objective
Every beacon's activity reads as a thread on the engagement timeline, so the path from first implant to objective is laid out in order for the report.
How to Log Sliver to Your Engagement
- 01
Give the collector its own operator
On the Sliver server, generate an operator config just for Neuron. It carries the mTLS identity and token the collector authenticates with, and it can be revoked without touching any person's access.
$ sliver-server operator --name neuron --lhost c2.acme.local --save neuron.cfg - 02
Pair with the red team engagement
Run neuron pair on your laptop, give the pairing a name that says which operation it belongs to, and approve it in Neuron.
$ neuron pair --name acme-redteam-laptop - 03
Start the collector
Pass the config with --sliver-config. When the Sliver server is only reachable from another box, add --ssh and the collector forwards the operator endpoint over your own SSH.
$ neuron collector sliver --ssh c2 --sliver-config neuron.cfg - 04
Operate as normal
Work in Sliver exactly as you always do. neuron collector list shows what is running, and neuron collector stop ends it when the operation closes.
$ neuron collector stop sliver
Your Infrastructure. Your Data.
The CLI runs on the operator's laptop, the bridge between Neuron and your C2 server. Neuron, the CLI, and Sliver all sit inside your network. Nothing is routed through a third-party cloud.
Sliver needs the Red Team module on your Neuron server.
From Sliverto the Final Report
With every session, beacon, and task already on the timeline, the report starts from evidence. Promote the beacon task that proved the vulnerability straight into a finding with its result attached, and the loot that backs it is already on the engagement.
The activity log appendix is the timeline filtered to the dates and hosts the client asks about, with every Sliver task and every shell command in order and attributed.
Long-haul beacons are where detection gaps hide. Because each check-in and task is timestamped, the report can show the client exactly how long an implant lived on their network before anyone noticed, if anyone did.
Sliver Integration FAQ
The questions teams ask most about Sliver and Neuron.
How do I log Sliver C2 activity for a red team report?
Run the Neuron CLI Sliver collector for the length of the operation. It streams sessions, beacons, beacon tasks, credentials, and loot into the engagement timeline as they happen, so the activity log is built while you operate instead of reconstructed afterwards.
How does the Sliver collector authenticate?
With a Sliver operator config file, the same .cfg format the Sliver client uses, passed as --sliver-config. Generate a dedicated operator for the collector so its access can be revoked on its own.
What happens if the connection to the Sliver server drops?
The collector buffers to a durable spool and resumes without gaps once the connection is back, so events are not lost to a flaky VPN or a sleeping laptop.
Can I run the collector when the Sliver server is on another network?
Yes. Add --ssh and the host, and the CLI forwards the operator endpoint over your own ssh with your config, keys, agent, and jump hosts.
Does the collector capture beacon tasks or only interactive sessions?
Both. Interactive sessions and asynchronous beacons are recorded, and each beacon task lands with the time it was queued and the result it returned when the beacon next checked in.
Is Sliver loot safe once it is in Neuron?
It is stored on your own self-hosted Neuron server, on the engagement it was collected for, with access controlled per engagement. The collector sends it from the operator laptop over HTTPS and nothing touches a third-party cloud.
More Neuron Integrations
Mythic C2 Reporting and Activity Logging
C2 FrameworksMetasploit Reporting and Session Logging
C2 FrameworksGoPhish Reporting and Campaign Tracking
PhishingEvilginx Reporting and Session Capture Logging
PhishingNetExec (nxc) Reporting and Logging
Active DirectoryCertipy AD CS Reporting and ESC Findings
Active DirectoryBloodHound Reporting and Attack Path Import
Active DirectoryNmap Reporting: Nmap XML to Pentest Report
Network DiscoveryReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform