DFIR Companion disconnected AI: — Screenshots: 0
Scope: (UTC) Correlation:

Threat-intel enrichment — choose sources

Pick which sources to query for this case's IOCs (hashes / IPs / domains / URLs). Local = your own self-hosted instances — queries stay on-box (OPSEC-safe). External = third-party services — querying them sends the indicator off-box and can tip off an adversary, so they're off by default. Enabling a source re-checks every IOC on it.

Anonymization

Categories to anonymize
Auto-detected entities (read-only — grows with the investigation)
Entities found in the case — including ones the companion read out of screenshots — appear here grouped by type and are anonymized on every run. Click to remove a wrong one (e.g. a mis-matched path): it stops being anonymized and won't come back ( restores it). The category patterns above also redact by shape everywhere, so redaction can happen before anything is listed here.
Custom entities (add anything the auto-detection missed)

Comments

Tags

Mark False Positive

Minimum severity to import

Events below this floor are dropped — but imports that carry no severity (KAPE, Plaso, plain telemetry) are kept in full regardless.

You can change or clear this later in Settings → General → Import severity.

Export to Notion

The Companion writes ALL its content inside ONE managed block it creates on the page. Re-exporting refreshes that block with the latest case data — your own notes and pasted screenshots (anything outside that block) are never touched.

Push playbook to ClickUp

Exports the Response Playbook tasks into a ClickUp list (status, priority, assignee, due date). Re-pushing the same case updates the tasks it created — it won't duplicate them.

Find it in the list's URL: app.clickup.com/…/li/901234567

Import case

Bring in a whole case from another source.

Import from DFIR-IRIS

Pull an existing IRIS case's assets, IOCs and timeline into this Companion case (the reverse of Push to IRIS). Mapped deterministically — no AI call — then re-synthesized.

Hunt queries

Pivot templates — review & adapt field/table names to your schema before running.

💡 Explain Event

New case

Cases are created here — then attach the capture extension to one (it only connects to existing cases). The case id is permanent and becomes the folder under cases/.

Save as Template

Saves the current case's key questions as a reusable template for future cases.

IOC block-list

Export a clean, targeted indicator list for network/firewall teams. Scope and false-positive IOC filters are always applied. Severity is derived from the worst enrichment verdict (no enrichment = Info).

IOC types

Redacted case package

Builds a shareable ZIP for external parties. Internal IPs, hostnames, usernames, emails and paths are replaced with consistent tokens (ANON_HOST_1…), secrets are redacted, screenshot EXIF is stripped, and detectable PII text in screenshots is blurred. AI provider keys and per-case config are never included.

⚠ Faces and other non-text visual PII are NOT auto-detected. Uncheck “Include screenshots” if unsure.

Settings

Configure AI + integrations + enrichment in one guided flow, each with a built-in connection test (#181).

Used as author when posting comments. Saved in this browser.
Default from DFIR_LOG_LEVEL. Logs tee to the console AND to files: logs/session-<time>.log (all activity) plus cases/<id>/logs/session-<time>.log (per-case audit trail). A new file is created each time the server starts.

⚠ Fields below require a server restart to take effect
Evidence drop folder (auto-import inbox)
Beacon / C2 detection
Timeline gap detection
ATT&CK / Adversary hints
Case memory / synthesis grounding
Mobile companion
⚠ All AI settings require a server restart to take effect

New here? Re-run the setup wizard for a guided provider/model/key flow with a built-in connection test (#181).

Synthesis model (optional — stronger model for one-shot synthesis)
Velociraptor hunt model (used ONLY for generating Velociraptor VQL hunts — many models botch VQL)

Dedicated model for ✨ Suggest Velociraptor hunts (and the Fleet Hunts suggester), separate from the synthesis/OCR models. Default: openrouter / anthropic/claude-haiku-4.5. Leave the key blank to reuse the main AI key.

Second opinion model (optional — a DIFFERENT model for the on-demand QA cross-check)

Powers the 2nd opinion button: a second model independently re-synthesizes the case and you review where it disagrees with the primary synthesis. The feature is OFF until a model is set here (the button stays hidden otherwise). For a genuinely independent opinion, pick a different provider than your synthesis model — same-provider models share blind spots. Leave the key blank to reuse the main AI key.

Debugging & custom prompts

Point any of the AI prompts at a file to override the built-in default (re-read each call — no restart needed). The inline DFIR_AI_*_PROMPT overrides aren't editable here (they're multi-line); use a file path below or npm run prompts:eject.

AI analysis parameters
⚠ All enrichment settings require a server restart to take effect
VirusTotal
AbuseIPDB
Hunting.ch (abuse.ch)
RockyRaccoon
CrowdStrike Falcon Intelligence
MISP
YETI
OpenCTI
CIRCL hashlookup (keyless hash → known-good)
IP infrastructure context (Reverse DNS / WHOIS / GeoIP / Shodan)

These providers are keyless by default and always-on — they return infrastructure context (PTR hostnames, WHOIS netblock/country, GeoIP city/ASN) rather than a reputation verdict, so they never send IOCs to a third-party threat-intel service. Shodan (Exposed Hosts) requires an API key set on the Exposure tab.

GeoIP map
Throttling
Per-provider throttle overrides (ms) — blank uses the global delay
⚠ All exposure settings require a server restart to take effect
⚠ All integration settings require a server restart to take effect
DFIR-IRIS
Timesketch
Notion
ClickUp
Velociraptor
Push ingest (webhook)

Let external tools (a SIEM webhook, a Velociraptor client-event poller, a custom script) POST alerts straight into the connected case. The server auto-detects the payload type (same engine as the Import button) and runs the import → synthesize pipeline. Auth is a token in the X-DFIR-Key header — a global one (below) and/or a per-case one (generated here). Push is OFF until a token is configured.

Connect to a case to manage its push token.
Example — POST a Velociraptor monitoring batch / SIEM alert:
connect to a case to see the curl example
Notifications (global)

These settings apply to all notification channels (Slack, Teams, Mattermost, Discord, Telegram, SMTP). Channel credentials and thresholds are managed on the Notifications tab.

Build named bundles of Velociraptor CLIENT artifacts, then run one as a hunt — results (and any uploaded JSON report, e.g. THOR/Hayabusa) are auto-collected after a delay, imported, and synthesized into the case. Bundles are shared across cases; running a bundle uses the case you're connected to. Results appear on the dashboard.

A heavy artifact (Hayabusa, a large Evtx/MFT dump) can fail to collect with grpc: received message larger than max (X vs. 4194304). Edit your api.yaml file, add a top-level max_grpc_recv_size: 67108864 (64 MB, or larger) and save it. Then click Collect now on the hunt again.
Import external hunt/flow
Pull results from a hunt or collection launched directly in the Velociraptor GUI. Paste a hunt id (H.…), a flow (C.…/F.…), or the GUI URL of either. For a flow, the host is resolved automatically.
Reads the flow/hunt's complete collected rows. Upload-only artifacts (THOR/Hayabusa JSON reports) aren't read by this path yet. A notebook URL (analyst-filtered VQL results) is rejected — use the DFIR Companion browser extension's "Push rows" button from that notebook page instead, which imports exactly what it shows.
Build a new bundle
Click Browse server artifacts to load the list, or add artifact names manually above.
Selected: 0
Advanced: per-artifact tuning (optional)
Parameters (passed to the artifact via the hunt spec)
JSON map of artifact → { param: value } so a heavy artifact emits less at the source (e.g. Hayabusa at high+critical). Only what you set is sent.
Exclude filters (VQL WHERE applied to results before the row cap)
JSON map of artifact → VQL WHERE expression (no WHERE keyword) to drop noisy rows at the source — e.g. exclude pagefile YARA hits, or a specific detection name. Leave blank for none.
🔴 Live Monitoring (Velociraptor client events)

Stream a Velociraptor client-monitoring artifact (e.g. Windows.Events.ProcessCreation, Windows.Events.DNSQueries) into this case as events fire — from one endpoint, or across all enrolled clients at once. The companion polls on an interval and imports new rows automatically; the last-seen cursor is saved so a restart never re-ingests old events. The artifact must also be enabled in Velociraptor → Client Monitoring for the target client(s). Needs the Velociraptor API configured.

Start an all-clients monitor for every artifact already enabled in Velociraptor's Client Monitoring table.
Start a new monitor
Run your own locally-installed tools against raw evidence the Companion can't parse (EVTX, PCAP, files), then ingest their output through the normal importers — the tool does the detecting, the Companion ingests the verdict. The Companion never downloads or bundles a binary; you install and update it. Each tool is OFF until its binary path is set. Paths/args are stored in .env (not secrets); click Reconnect to apply without a restart. A raw file copied into a case's drop folder is run automatically when a matching tool has auto-run on.
⚠ The run/update commands you configure are executed on this machine (no shell — args are tokenized). Only point them at trusted binaries.
Hayabusa (EVTX → csv/json-timeline · repo)
Velociraptor CLI (offline EVTX → artifact JSON · repo)

The default runs the Windows.Hayabusa.Rules artifact (not built in — loaded from the Definitions zip) against a folder of EVTX via --ROOT <targetdir>, with --nobanner --no-debug, redirecting the JSON results to a file (> <output>) that the Companion imports. The Companion places the file in a temp folder under its original name (e.g. Security.evtx) so Velociraptor detects the channel from the filename — keep the original EVTX filenames. Placeholders: <targetdir> = the folder, <definitions> = the definitions path, <output> = the result file. (Don't add -v — verbose logs drown the results.)

Suricata (PCAP → eve.json · download)

Runs from the Suricata install dir so it finds suricata.yaml. Windows rules: suricata-update is a Linux/pip tool — on Windows, download emerging-all.rules (ET Open) manually and point suricata.yaml at it (see this Suricata-on-Windows guide). Leave the update command blank unless you have suricata-update installed.

(only if you configured an update command above)
Snort (PCAP + your rules → alert_fast · repo)
YARA (scan files/dirs → matches · repo)
Master auto-run kill-switch: DFIR_TOOL_AUTO_RUN=off disables all auto-run (set on the General tab's .env, or your env).
Custom tools (add your own — runs on the extensions you choose; output is auto-detected)

Define any local tool: give it a name, the binary path, a run command (use <target> for the input file and, if it writes a file, <output>), an optional update command, and the file extensions it should handle. The tool's output is fed through the normal importers (auto-detected). Importing or dropping a file with a matching extension will offer to run it.

Add a custom tool
Known-good patterns that auto-mark matching IOCs as a false positive on import (and on demand). Global — shared across all cases. Reversible: matches appear in False Positives and can be un-marked.
⚠ Whitelisting is opt-in for a reason — auto-excluding internal IP ranges can hide lateral movement. Only add patterns you trust.
Quick add:

Scans the loaded case's current IOCs and marks matches as a false positive (already auto-runs on every import).
A set of known-software file hashes (NIST NSRL / RDS). A forensic event whose file hash — or an IOC whose value — matches is a known-good file, auto-marked a false positive on import (and on demand), reducing false positives. Global — shared across all cases. Reversible: matches appear in False Positives.
⚠ NSRL lists known, not strictly known-good, software — some RDS sets include hacktools, and a known hash can still be malicious in context (DLL side-loading, a renamed LOLBin). Opt-in for a reason.
Loading…
Reads an NSRLFile.txt / hashdeep CSV / hash list straight off this machine — for big RDS sets you don't want to paste. The in-UI equivalent of the DFIR_NSRL_FILE env var, but on demand: loaded hashes persist, so there's no restart and they survive one.

Loading…
For the full ~160 GB NSRL RDS (too big to load into memory) — queried on demand, no ingest. Download the Modern RDS minimal SQLite set and index the hash column(s) first (CREATE INDEX … ON METADATA(sha256) + ANALYZE; matching keys on sha256/md5, not sha1). See the README's NSRL section for the full setup.

Scans the loaded case's IOCs + forensic events and marks known-good matches as a false positive (already auto-runs on every import).
Declarative importers let you add support for a new tool's export format without writing code. Drop a JSON definition in the importers/ folder (auto-loaded on startup) or paste one below. Global — shared across all cases. Generate a definition for any file format with an LLM via the prompt button.
⚠ Custom importers run on every matching import. Review a generated definition before adding it — a too-broad match can shadow a built-in importer.
Built-in-first keeps the shipped importers authoritative; custom-first lets a definition override one.
Loading…

The CISA Known Exploited Vulnerabilities (KEV) catalog lists CVEs that are actively exploited in the wild. When loaded, the Companion cross-references CVE IDs found in your forensic timeline and IOCs against the catalog and surfaces any matches as high-probability initial access vectors in synthesis context and in report §4.5.1. Global — shared across all cases. Opt-in: starts empty.
⚠ KEV cross-referencing only fires when CVE IDs appear in your evidence. Load the catalog here; the Companion does the rest automatically during synthesis.
Loading…
Fetches the latest catalog directly from cisa.gov — requires server outbound internet access.
For air-gapped deployments — point to a locally-saved copy of the CISA KEV JSON.
Removes the catalog from disk. The catalog is global — clearing it affects all cases.
Opt-in check against the project's GitHub Releases page. When enabled, the server checks at most once a day (and on demand) and shows a banner if a newer version exists. It never downloads or installs anything — the banner just links to the release. Off by default. Set DFIR_UPDATE_CHECK=0 to lock it off entirely.
Loading…
Push new/escalated findings, playbook updates, and investigation milestones to Slack, MS Teams, Mattermost, Discord, Telegram, or email — with a per-channel severity threshold and per-event toggles. Global — shared across all cases.
⚠ Notifications send case content (finding/task titles) to a third party. Off by default — each channel is opt-in. Don't enable on a sensitive case unless the destination is trusted.
Notify on:
Branded report layouts — accent colour, cover title/subtitle, running header & footer, and which sections appear. Global (shared across cases); pick one per case in Case Details. Built-ins are editable in place — Reset restores the shipped default.
Placeholders (filled from Case Details): {{organization}} {{companyName}} {{incidentId}} {{restrictions}} {{investigators}} {{date}} {{caseId}} · conditionals: {{#if incidentId}}…{{/if}}
Panel-layout presets for the dashboard — which sections show (and their order), an optional severity floor + top-N cap on findings & timeline, and a matching report template. Global (shared across cases); pick one from the toolbar ⊞ view button. Built-ins are editable in place — Reset restores the shipped default.
Operator-facing system state for troubleshooting ingestion / AI problems. Read-only and redacted (no API keys or evidence content). The summary loads fast; per-case disk sizes are computed on demand.
Pre-flight checks
Loading…
Loading…
Automatic state backup configuration — created before each synthesis + on an interval
Restore a case backup
Loads backups for the currently-selected case. Restoring overwrites the live state — the current state is not auto-saved first, so make a manual backup before restoring if needed.

Ask the LLM about this case

Query Translator natural language → VQL / KQL / ES|QL / SPL / Sigma / YARA / Suricata

Describe the activity you want to hunt for in plain English; the AI translates it into a runnable query for each selected platform, grounded in that platform's real schema. Review every query before running it.

Executive Summary

Recommended Next Steps

Attack Path

Narrative Timeline

📌 Pinned Findingsthe analyst-curated shortlist — pin a finding with 📌, drag to reorder, click to jump

No findings pinned yet — click 📌 on a finding to keep it here.

Findings

% (0 = all)

Forensic Timeline

Actions:
🕑 All timestamps are in UTC.

Kill Chainevents bucketed by their ATT&CK tactic (derived, no AI); a categorization, not a confirmed kill-chain stage — e.g. valid-account use can span entry and lateral movement

Attack Phasestemporal bursts — activity grouped by time gap, labelled by dominant tactic (derived, no AI)

Host & Account Rankingwhich hosts/accounts carry the attack — scored by signal (severity-weighted events + techniques + connective IOCs), not volume (derived, no AI)

Timeline Gapssuspicious silent periods — a complete gap (all sources dark) is the classic log-tampering signature (derived, no AI); a lead, not proof

Timeline Swimlanevisual chart — Y-axis: assets · X-axis: time · color: severity (derived, no AI)

💡 Click a dot for details and to flash its row in the Forensic Timeline · Shift-click a dot (or Shift-drag a box) to select events, then 🚫 Mark False Positive · Drag the time axis (bottom bar) to filter the Forensic Timeline to that range
Group by: 100%

Compromised Assets & IoC Graph

Show: 100% drag nodes to rearrange

Known compromised assets

Evidence Chaincausal links — process trees, lateral movement, file lineage & network flows (derived, no AI)

Show: high medium ran on file lineage network flow 100% drag nodes to rearrange

Beacon Candidatesperiodic outbound channels — too regular to be human traffic (derived, no AI); a hunting lead, not a verdict

Timeline Anomaliesassets whose event rate in a time bucket spikes — vs other assets (peer) or vs their own baseline (self) (derived, no AI); a triage lead, not a verdict

🌍 Geographic Mapimported IPs geolocated from GeoIP enrichment — markers colored by severity (derived; OpenStreetMap tiles load on demand when you open the map)

IOCs

Actions:

Customer Exposure

Breach/leak check of the customer's own domains & emails (not IOCs). Domain searches use only the customer domains below; case emails are checked only under those domains. ⚠ sends the customer's domains/emails to third-party services.

Key Investigative Questions

Hunting ProfileWhat has been hunted in this case and whether it found anything

Investigation Threads

MITRE ATT&CK

Adversary Hintsknown ATT&CK groups by technique overlap + their likely next techniques — hypothesis fuel, not attribution (derived, no AI)

Mitigation & Defensive Countermeasuresconcrete MITRE ATT&CK mitigations to apply for this incident's techniques, plus D3FEND defensive techniques — offline, no AI

Suggested Fleet HuntsAI-proposed Velociraptor VQL hunts from the findings — sweep the fleet for the same tradecraft

False Positives (excluded from analysis)

Investigation Log