DFIR Companion disconnected AI: — Screenshots: 0
Scope: (UTC) Correlation:

Threat-intel enrichment — choose sources

Pick which sources to query for this case's IOCs (hashes / IPs / domains / URLs). Local = your own self-hosted instances — queries stay on-box (OPSEC-safe). External = third-party services — querying them sends the indicator off-box and can tip off an adversary, so they're off by default. Enabling a source re-checks every IOC on it.

Anonymization

Categories to anonymize
Auto-detected entities (read-only — grows with the investigation)
Entities found in the case — including ones the companion read out of screenshots — appear here grouped by type and are anonymized on every run. Click ✕ to remove a wrong one (e.g. a mis-matched path): it stops being anonymized and won't come back (↺ restores it). The category patterns above also redact by shape everywhere, so redaction can happen before anything is listed here.
Custom entities (add anything the auto-detection missed)

Comments

Tags

Export to Notion

The Companion writes ALL its content inside ONE managed block it creates on the page. Re-exporting refreshes that block with the latest case data — your own notes and pasted screenshots (anything outside that block) are never touched.

Push playbook to ClickUp

Exports the Response Playbook tasks into a ClickUp list (status, priority, assignee, due date). Re-pushing the same case updates the tasks it created — it won't duplicate them.

Find it in the list's URL: app.clickup.com/…/li/901234567

Import case

Bring in a whole case from another source.

Import from DFIR-IRIS

Pull an existing IRIS case's assets, IOCs and timeline into this Companion case (the reverse of Push to IRIS). Mapped deterministically — no AI call — then re-synthesized.

Hunt queries

Pivot templates — review & adapt field/table names to your schema before running.

💡 Explain Event

New case

Cases are created here — then attach the capture extension to one (it only connects to existing cases). The case id is permanent and becomes the folder under cases/.

Save as Template

Saves the current case's key questions as a reusable template for future cases.

IOC block-list

Export a clean, targeted indicator list for network/firewall teams. Scope and legitimate IOC filters are always applied. Severity is derived from the worst enrichment verdict (no enrichment = Info).

IOC types

Redacted case package

Builds a shareable ZIP for external parties. Internal IPs, hostnames, usernames, emails and paths are replaced with consistent tokens (ANON_HOST_1…), secrets are redacted, screenshot EXIF is stripped, and detectable PII text in screenshots is blurred. AI provider keys and per-case config are never included.

⚠ Faces and other non-text visual PII are NOT auto-detected. Uncheck “Include screenshots” if unsure.

Settings

Used as author when posting comments. Saved in this browser.
Default from DFIR_LOG_LEVEL. Logs tee to the console AND to files: logs/session-<time>.log (all activity) plus cases/<id>/logs/session-<time>.log (per-case audit trail). A new file is created each time the server starts.
⚠ Fields below require a server restart to take effect
⚠ All AI settings require a server restart to take effect
Synthesis model (optional — stronger model for one-shot synthesis)
Velociraptor hunt model (used ONLY for generating Velociraptor VQL hunts — many models botch VQL)

Dedicated model for ✨ Suggest Velociraptor hunts (and the Fleet Hunts suggester), separate from the synthesis/OCR models. Default: openrouter / anthropic/claude-haiku-4.5. Leave the key blank to reuse the main AI key.

Second opinion model (optional — a DIFFERENT model for the on-demand QA cross-check)

Powers the 2nd opinion button: a second model independently re-synthesizes the case and you review where it disagrees with the primary synthesis. The feature is OFF until a model is set here (the button stays hidden otherwise). For a genuinely independent opinion, pick a different provider than your synthesis model — same-provider models share blind spots. Leave the key blank to reuse the main AI key.

Debugging & custom prompts

Point any of the AI prompts at a file to override the built-in default (re-read each call — no restart needed). The inline DFIR_AI_*_PROMPT overrides aren't editable here (they're multi-line); use a file path below or npm run prompts:eject.

⚠ All enrichment settings require a server restart to take effect
VirusTotal
AbuseIPDB
Hunting.ch (abuse.ch)
RockyRaccoon
CrowdStrike Falcon Intelligence
MISP
YETI
OpenCTI
Throttling
Per-provider throttle overrides (ms) — blank uses the global delay
⚠ All exposure settings require a server restart to take effect
⚠ All integration settings require a server restart to take effect
DFIR-IRIS
Timesketch
Notion
ClickUp
Velociraptor
Push ingest (webhook)

Let external tools (a SIEM webhook, a Velociraptor client-event poller, a custom script) POST alerts straight into the connected case. The server auto-detects the payload type (same engine as the Import button) and runs the import → synthesize pipeline. Auth is a token in the X-DFIR-Key header — a global one (below) and/or a per-case one (generated here). Push is OFF until a token is configured.

Connect to a case to manage its push token.
Example — POST a Velociraptor monitoring batch / SIEM alert:
connect to a case to see the curl example

Build named bundles of Velociraptor CLIENT artifacts, then run one as a hunt — results (and any uploaded JSON report, e.g. THOR/Hayabusa) are auto-collected after a delay, imported, and synthesized into the case. Bundles are shared across cases; running a bundle uses the case you're connected to. Results appear on the dashboard.

—
—
Build a new bundle
Click Browse server artifacts to load the list, or add artifact names manually above.
Selected: 0
Advanced: per-artifact tuning (optional)
Parameters (passed to the artifact via the hunt spec)
JSON map of artifact → { param: value } so a heavy artifact emits less at the source (e.g. Hayabusa at high+critical). Only what you set is sent.
Exclude filters (VQL WHERE applied to results before the row cap)
JSON map of artifact → VQL WHERE expression (no WHERE keyword) to drop noisy rows at the source — e.g. exclude pagefile YARA hits, or a specific detection name. Leave blank for none.
🔴 Live Monitoring (Velociraptor client events)

Stream a Velociraptor client-monitoring artifact (e.g. Windows.Events.ProcessCreation, Windows.Events.DNSQueries) into this case as events fire — from one endpoint, or across all enrolled clients at once. The companion polls on an interval and imports new rows automatically; the last-seen cursor is saved so a restart never re-ingests old events. The artifact must also be enabled in Velociraptor → Client Monitoring for the target client(s). Needs the Velociraptor API configured.

Start an all-clients monitor for every artifact already enabled in Velociraptor's Client Monitoring table.
Start a new monitor
Known-good patterns that auto-mark matching IOCs as legitimate on import (and on demand). Global — shared across all cases. Reversible: matches appear in Confirmed Legitimate and can be un-marked.
⚠ Whitelisting is opt-in for a reason — auto-excluding internal IP ranges can hide lateral movement. Only add patterns you trust.
Quick add:
Scans the loaded case's current IOCs and marks matches legitimate (already auto-runs on every import).
A set of known-software file hashes (NIST NSRL / RDS). A forensic event whose file hash — or an IOC whose value — matches is a known-good file, auto-marked legitimate on import (and on demand), reducing false positives. Global — shared across all cases. Reversible: matches appear in Confirmed Legitimate.
⚠ NSRL lists known, not strictly known-good, software — some RDS sets include hacktools, and a known hash can still be malicious in context (DLL side-loading, a renamed LOLBin). Opt-in for a reason.
Loading…
Reads an NSRLFile.txt / hashdeep CSV / hash list straight off this machine — for big RDS sets you don't want to paste. The in-UI equivalent of the DFIR_NSRL_FILE env var, but on demand: loaded hashes persist, so there's no restart and they survive one.
Loading…
For the full ~160 GB NSRL RDS (too big to load into memory) — queried on demand, no ingest. Download the Modern RDS minimal SQLite set and index the hash column(s) first (CREATE INDEX … ON METADATA(sha256) + ANALYZE; matching keys on sha256/md5, not sha1). See the README's NSRL section for the full setup.
Scans the loaded case's IOCs + forensic events and marks known-good matches legitimate (already auto-runs on every import).
Declarative importers let you add support for a new tool's export format without writing code. Drop a JSON definition in the importers/ folder (auto-loaded on startup) or paste one below. Global — shared across all cases. Generate a definition for any file format with an LLM via the prompt button.
⚠ Custom importers run on every matching import. Review a generated definition before adding it — a too-broad match can shadow a built-in importer.
Built-in-first keeps the shipped importers authoritative; custom-first lets a definition override one.
Loading…
The CISA Known Exploited Vulnerabilities (KEV) catalog lists CVEs that are actively exploited in the wild. When loaded, the Companion cross-references CVE IDs found in your forensic timeline and IOCs against the catalog and surfaces any matches as high-probability initial access vectors in synthesis context and in report §4.5.1. Global — shared across all cases. Opt-in: starts empty.
⚠ KEV cross-referencing only fires when CVE IDs appear in your evidence. Load the catalog here; the Companion does the rest automatically during synthesis.
Loading…
Fetches the latest catalog directly from cisa.gov — requires server outbound internet access.
For air-gapped deployments — point to a locally-saved copy of the CISA KEV JSON.
Removes the catalog from disk. The catalog is global — clearing it affects all cases.
Opt-in check against the project's GitHub Releases page. When enabled, the server checks at most once a day (and on demand) and shows a banner if a newer version exists. It never downloads or installs anything — the banner just links to the release. Off by default. Set DFIR_UPDATE_CHECK=0 to lock it off entirely.
Loading…
Push new/escalated findings, playbook updates, and investigation milestones to Slack, MS Teams, Mattermost, Discord, Telegram, or email — with a per-channel severity threshold and per-event toggles. Global — shared across all cases.
⚠ Notifications send case content (finding/task titles) to a third party. Off by default — each channel is opt-in. Don't enable on a sensitive case unless the destination is trusted.
Notify on:
Branded report layouts — accent colour, cover title/subtitle, running header & footer, and which sections appear. Global (shared across cases); pick one per case in Case Details. Built-ins are editable in place — Reset restores the shipped default.
Placeholders (filled from Case Details): {{organization}} {{companyName}} {{incidentId}} {{restrictions}} {{investigators}} {{date}} {{caseId}} · conditionals: {{#if incidentId}}…{{/if}}
Operator-facing system state for troubleshooting ingestion / AI problems. Read-only and redacted (no API keys or evidence content). The summary loads fast; per-case disk sizes are computed on demand.
Loading…

Ask the LLM about this case

Query Translator natural language → VQL / KQL / ES|QL / SPL / Sigma / YARA / Suricata

Describe the activity you want to hunt for in plain English; the AI translates it into a runnable query for each selected platform, grounded in that platform's real schema. Review every query before running it.

Executive Summary

—

Recommended Next Steps

—

Attack Path

—

Narrative Timeline

—

Findings

% (0 = all)
—

Forensic Timeline

Actions:
🕑 All timestamps are in UTC.
—

Kill Chain

—

Attack Phasestemporal bursts — activity grouped by time gap, labelled by dominant tactic (derived, no AI)

—

Timeline Gapssuspicious silent periods — a complete gap (all sources dark) is the classic log-tampering signature (derived, no AI); a lead, not proof

—

Timeline Swimlanevisual chart — Y-axis: assets · X-axis: time · color: severity (derived, no AI)

💡 Click a dot for details and to flash its row in the Forensic Timeline · Shift-click a dot (or Shift-drag a box) to select events, then ⚑ Mark Legitimate
Group by: 100%

Compromised Assets & IoC Graph

Show: 100% drag nodes to rearrange
—

Known compromised assets

—

Evidence Chaincausal links — process trees, lateral movement, file lineage & network flows (derived, no AI)

Show: high medium ran on file lineage network flow 100% drag nodes to rearrange
—

Beacon Candidatesperiodic outbound channels — too regular to be human traffic (derived, no AI); a hunting lead, not a verdict

—

IOCs

Actions:
—

Customer Exposure

Breach/leak check of the customer's own domains & emails (not IOCs). Domain searches use only the customer domains below; case emails are checked only under those domains. ⚠ sends the customer's domains/emails to third-party services.
—

Key Investigative Questions

—

Investigation Threads

—

MITRE ATT&CK

—

Adversary Hintsknown ATT&CK groups by technique overlap + their likely next techniques — hypothesis fuel, not attribution (derived, no AI)

—

Suggested Fleet HuntsAI-proposed Velociraptor VQL hunts from the findings — sweep the fleet for the same tradecraft

—

Confirmed Legitimate (excluded from analysis)

—

Investigation Log

—