> ## Documentation Index
> Fetch the complete documentation index at: https://www.ghostwriter.wiki/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up Automated Logging

> Configuring the API endpoint for automatic activity logging

Currently, two different C2 frameworks can easily integrate with Ghostwriter's GraphQL API: Mythic and Cobalt Strike. These utilities automatically create and update log entries.

You can also write scripts to integrate other frameworks and tools. All you need to get started is an automation token.

## Obtaining an Automation Token

For operation-log syncing, prefer a scoped service token when the integration supports it. A service token can be limited to one operation log and its entries, so the automation does not inherit all permissions from the user who created the token.

Use an API token only when the automation should act as your user account and inherit your current permissions. For custom logging tools, you can also consider using the `login` action with the API, but generated API tokens or service tokens are usually a better fit for long-running automation.

Read more about this process here:

<CardGroup cols={1}>
  <Card title="Authentication" icon="key" iconType="solid" href="/features/graphql-api/authentication" />
</CardGroup>

<CardGroup cols={1}>
  <Card title="User Profile and Tokens" icon="user-gear" iconType="solid" href="/features/access-authentication-and-session-controls/user-profile-and-tokens" />
</CardGroup>

## Setting up Syncing with Cobalt Strike

<CardGroup cols={1}> <Card title="GitHub - GhostManager/cobalt_sync" icon="github" iconType="brands" href="https://github.com/GhostManager/cobalt_sync"> <img src="https://github.com/fluidicon.png" className="w-5 h-5 mr-2" alt="Logo" /> <span className="text-xs text-dark/7 dark:text-light/6">Standalone Cobalt Strike operation logging Aggressor script for Ghostwriter 2.0+</span> </Card> </CardGroup>

Clone the [cobalt\_sync project](https://github.com/GhostManager/cobalt_sync) to your Cobalt Strike team server and follow the instructions contained in the [README](https://github.com/GhostManager/cobalt_sync/blob/main/README.md) to enable syncing for each Cobalt Strike team server you deploy.

<Info>
  **Note**: Cobalt Strike does not associate console output with the original command. Therefore, *cobalt\_sync* cannot automatically complete the output fields for log entries. Job IDs may be available for CObalt Strike in the future.
</Info>

## Setting up Syncing with Mythic

<CardGroup cols={1}> <Card title="GitHub - GhostManager/mythic_sync" icon="github" iconType="brands" href="https://github.com/GhostManager/mythic_sync"> <img src="https://github.com/fluidicon.png" className="w-5 h-5 mr-2" alt="Logo" /> <span className="text-xs text-dark/7 dark:text-light/6">Standalone Mythic C2 operation logging script for Ghostwriter v2.0+</span> </Card> </CardGroup>

Clone the [mythic\_sync project](https://github.com/GhostManager/mythic_sync) to your Mythic C2 server and follow the instructions contained in the README to enable syncing for each Mythic server you deploy.

<Info>
  **Note**: Since Mythic associates output with the original command, the *mythic\_sync* project will retroactively update previous log entries when output is received. *This will overwrite any additional context added to the original entry within Ghostwriter before the new output was received.*
</Info>