DFIR Companion
disconnected AI: — Screenshots: 0
Scope: (UTC) Correlation:

Threat-intel enrichment — choose sources

Pick which sources to query for this case's IOCs (hashes / IPs / domains / URLs). Local = your own self-hosted instances — queries stay on-box (OPSEC-safe). External = third-party services — querying them sends the indicator off-box and can tip off an adversary, so they're off by default. Enabling a source re-checks every IOC on it.

Anonymization

Categories to anonymize
Auto-detected entities (read-only — grows with the investigation)
Entities found in the case — including ones the companion read out of screenshots — appear here grouped by type and are anonymized on every run. Click to remove a wrong one (e.g. a mis-matched path): it stops being anonymized and won't come back ( restores it). The category patterns above also redact by shape everywhere, so redaction can happen before anything is listed here.
Custom entities (add anything the auto-detection missed)

Comments

Tags

Mark False Positive

Merge duplicate

Browse

Minimum severity to import

Events below this floor are dropped — but imports that carry no severity (KAPE, Plaso, plain telemetry) are kept in full regardless.

You can change or clear this later in Settings → General → Import severity.

Export to Notion

The Companion writes ALL its content inside ONE managed block it creates on the page. Re-exporting refreshes that block with the latest case data — your own notes and pasted screenshots (anything outside that block) are never touched.

Push playbook to ClickUp

Exports the Response Playbook tasks into a ClickUp list (status, priority, assignee, due date). Re-pushing the same case updates the tasks it created — it won't duplicate them.

Find it in the list's URL: app.clickup.com/…/li/901234567

Push to DFIR-IRIS

Finds an IRIS case with this exact name, or creates one. Re-pushing with the same name updates that case instead of creating a duplicate — the name you use here is remembered for next time.

Import case

Bring in a whole case from another source.

Import encrypted case archive

Import from DFIR-IRIS

Pull an existing IRIS case's assets, IOCs and timeline into this Companion case (the reverse of Push to IRIS). Mapped deterministically — no AI call — then re-synthesized.

Hunt queries

Pivot templates — review & adapt field/table names to your schema before running.

💡 Explain Event

🔗 IOC Provenance Chain

New case

Cases are created here — then attach the capture extension to one (it only connects to existing cases). The case id is permanent and becomes the folder under cases/.

Save as Template

Saves the current case's key questions as a reusable template for future cases.

IOC block-list

Export a clean, targeted indicator list for network/firewall teams. Scope and false-positive IOC filters are always applied. Severity is derived from the worst enrichment verdict (no enrichment = Info).

IOC types

Redacted case package

Builds a shareable ZIP for external parties. Internal IPs, hostnames, usernames, emails and paths are replaced with consistent tokens (ANON_HOST_1…), secrets are redacted, screenshot EXIF is stripped, and detectable PII text in screenshots is blurred. AI provider keys and per-case config are never included.

⚠ Faces and other non-text visual PII are NOT auto-detected. Uncheck “Include screenshots” if unsure.

Report versions

Generated versions begin as drafts. Review and approve one before release; a release freezes the exact report, evidence, analysis runs and custody state so later case edits cannot alter what was delivered. Solo mode records an honest self-review; team mode keeps investigator and reviewer duties separate.

loading…
checking released-report integrity…

Analysis run ledger

Immutable manifests show exactly which evidence, rules, prompt, model and filters shaped each result. Replay checks that every pinned dependency is still available before it starts and always creates a child run; historical output is never replaced.

checking integrity…
loading…

Archive to ZIP

Bundles the whole case into a single unencrypted .zip file. This may take a moment for large cases.

Export encrypted case archive

Bundles the ENTIRE case — screenshots, raw evidence, timeline, findings, IOCs, all analyst decisions — into a single .dfircase file encrypted with the password below. Only openable via another DFIR Companion's "Import case". Share the password out of band (not in the same email/chat as the file).

Delete case

Case password

Requires this password to open the case in the dashboard. The password is never stored in plain text. If it's forgotten, recovery means manually editing the case's case.json on disk — there's no reset flow.

🔒 Enter case password

⌨ Keyboard shortcuts

Ctrl+K works anywhere, always. The rest are active on the Forensic Timeline whenever you're not typing in a field, and can be switched off in Settings → General.

Ctrl+K / ⌘KCommand palette — fuzzy-search every action (>exports filters by category)
j / kNext / previous event
fFlag (star) the focused event
iAdd the focused event's IP/host as an IOC
/Focus global search
pPin / unpin the focused event's finding (only when it cites exactly one)
nAdd a note (comment) to the focused event
?Show this cheat sheet
EscClose this cheat sheet, or clear the focused row

Settings

Configure AI + integrations + enrichment in one guided flow, each with a built-in connection test (#181).

Used as author when posting comments. Saved in this browser.
Default from DFIR_LOG_LEVEL. Logs tee to the console AND to files: logs/session-<time>.log (all activity) plus cases/<id>/logs/session-<time>.log (per-case audit trail). A new file is created each time the server starts.

⚠ Fields below require a server restart to take effect
Evidence drop folder (auto-import inbox)
Beacon / C2 detection
Timeline gap detection
Timeline volume-anomaly detection
SSH brute-force-success detection (T1110.001)
NTFS timestomp detection (T1070.006)
Lookalike-domain detection
Import / forensic-timeline gate
ATT&CK / Adversary hints
Case memory / synthesis grounding
Mobile companion
Presentation / timeline-replay mode
Pinned findings (#220)
Network access control

Shown so the live value is visible without a shell. These decide which hostnames and origins the companion answers to, so a writable one would re-open the DNS-rebinding hole.

Team authentication

Set before the server starts: you cannot configure the sign-in provider from a dashboard you must already be signed in to reach. Secrets are redacted by the server.

Logging
⚠ All AI settings require a server restart to take effect

New here? Re-run the setup wizard for a guided provider/model/key flow with a built-in connection test (#181).

Vision model (screenshots)
Checking Claude Code…
Synthesis model (optional — stronger model for one-shot synthesis)
Checking Codex…
Velociraptor hunt model (used ONLY for generating Velociraptor VQL hunts — many models botch VQL)

Dedicated model for ✨ Suggest Velociraptor hunts (and the Fleet Hunts suggester), separate from the synthesis/OCR models. Default: openrouter / anthropic/claude-haiku-4.5. Leave the key blank to reuse the main AI key.

Second opinion model (optional — a DIFFERENT model for the on-demand QA cross-check)

Powers the 2nd opinion button: a second model independently re-synthesizes the case and you review where it disagrees with the primary synthesis. The feature is OFF until a model is set here (the button stays hidden otherwise). For a genuinely independent opinion, pick a different provider than your synthesis model — same-provider models share blind spots. Leave the key blank to reuse the main AI key.

Synthesis detection-burst grouping
Debugging & custom prompts
CLI provider binaries (only if not on PATH)

Point any of the AI prompts at a file to override the built-in default (re-read each call — no restart needed). The inline DFIR_AI_*_PROMPT overrides aren't editable here (they're multi-line); use a file path below or npm run prompts:eject.

AI analysis parameters
Inline prompt overrides

Prompts are normally pointed at a file above — the inline form exists for deployments that inject configuration as environment variables. Shown here so an inline override is never invisible.

⚠ All enrichment settings require a server restart to take effect
VirusTotal
AbuseIPDB
Hunting.ch (abuse.ch)
RockyRaccoon
CrowdStrike Falcon Intelligence
MISP
YETI
OpenCTI
CIRCL hashlookup (keyless hash → known-good)
IP infrastructure context (Reverse DNS / WHOIS / GeoIP / Shodan)

These providers are keyless by default and always-on — they return infrastructure context (PTR hostnames, WHOIS netblock/country, GeoIP city/ASN) rather than a reputation verdict, so they never send IOCs to a third-party threat-intel service. Shodan (Exposed Hosts) requires an API key set on the Exposure tab.

GeoIP map
Throttling
Per-provider throttle overrides (ms) — blank uses the global delay
Read-only enrichment settings
⚠ All exposure settings require a server restart to take effect
⚠ All integration settings require a server restart to take effect
TLS (all integrations)
Presidio (optional external PII detector)
DFIR-IRIS
Timesketch
Notion
ClickUp
Velociraptor
Push ingest (webhook)

Let external tools (a SIEM webhook, a Velociraptor client-event poller, a custom script) POST alerts straight into the connected case. The server auto-detects the payload type (same engine as the Import button) and runs the import → synthesize pipeline. Auth is a token in the X-DFIR-Key header — a global one (below) and/or a per-case one (generated here). Push is OFF until a token is configured.

Connect to a case to manage its push token.
Example — POST a Velociraptor monitoring batch / SIEM alert:
connect to a case to see the curl example
Notifications (global)

These settings apply to all notification channels (Slack, Teams, Mattermost, Discord, Telegram, SMTP). Channel credentials and thresholds are managed on the Notifications tab.

Jira (read-only)

Ticketing credentials stay operator-managed in .env — the dashboard can push tickets but cannot rewrite the connection. Token is redacted by the server.

ServiceNow (read-only)

Same policy as Jira. Password is redacted by the server.

Build named bundles of Velociraptor CLIENT artifacts, then run one as a hunt — results (and any uploaded JSON report, e.g. THOR/Hayabusa) are auto-collected after a delay, imported, and synthesized into the case. Bundles are shared across cases; running a bundle uses the case you're connected to. Results appear on the dashboard.

Velociraptor API not configured — you can still build and edit bundles, but running a hunt needs the API config path set on the Integrations tab. After setting it (or once the Velociraptor server is up), click Reconnect below — no server restart needed.
A heavy artifact (Hayabusa, a large Evtx/MFT dump) can fail to collect with grpc: received message larger than max (X vs. 4194304). Edit your api.yaml file, add a top-level max_grpc_recv_size: 67108864 (64 MB, or larger) and save it. Then click Collect now on the hunt again.
Import external hunt/flow
Pull results from a hunt or collection launched directly in the Velociraptor GUI. Paste a hunt id (H.…), a flow (C.…/F.…), or the GUI URL of either. For a flow, the host is resolved automatically.
Reads the flow/hunt's complete collected rows. For upload-only artifacts (THOR/Hayabusa reports), paste the GUI's Uploaded Files tab URL instead to import just the uploaded report (rows are skipped). A notebook URL (analyst-filtered VQL results) is rejected — use the DFIR Companion browser extension's "Push rows" button from that notebook page instead, which imports exactly what it shows.
Build a new bundle
Click Browse server artifacts to load the list, or add artifact names manually above.
Selected: 0
Advanced: per-artifact tuning (optional)
Parameters (passed to the artifact via the hunt spec)
JSON map of artifact → { param: value } so a heavy artifact emits less at the source (e.g. Hayabusa at high+critical). Only what you set is sent.
Exclude filters (VQL WHERE applied to results before the row cap)
JSON map of artifact → VQL WHERE expression (no WHERE keyword) to drop noisy rows at the source — e.g. exclude pagefile YARA hits, or a specific detection name. Leave blank for none.
🔴 Live Monitoring (Velociraptor client events)

Stream a Velociraptor client-monitoring artifact (e.g. Windows.Events.ProcessCreation, Windows.Events.DNSQueries) into this case as events fire — from one endpoint, or across all enrolled clients at once. The companion polls on an interval and imports new rows automatically; the last-seen cursor is saved so a restart never re-ingests old events. The artifact must also be enabled in Velociraptor → Client Monitoring for the target client(s). Needs the Velociraptor API configured.

Start an all-clients monitor for every artifact already enabled in Velociraptor's Client Monitoring table.
Start a new monitor
Run your own locally-installed tools against raw evidence the Companion can't parse (EVTX, PCAP, files), then ingest their output through the normal importers — the tool does the detecting, the Companion ingests the verdict. The Companion never downloads or bundles a binary; you install and update it. Each tool is OFF until its binary path is set. Paths/args are stored in .env (not secrets); click Reconnect to apply without a restart. A raw file copied into a case's drop folder is run automatically when a matching tool has auto-run on.
⚠ The run/update commands you configure are executed on this machine (no shell — args are tokenized). Only point them at trusted binaries.
Hayabusa (EVTX → csv/json-timeline · repo)
Velociraptor CLI (offline EVTX → artifact JSON · repo)

The default runs the Windows.Hayabusa.Rules artifact (not built in — loaded from the Definitions zip) against a folder of EVTX via --ROOT <targetdir>, with --nobanner --no-debug, redirecting the JSON results to a file (> <output>) that the Companion imports. The Companion places the file in a temp folder under its original name (e.g. Security.evtx) so Velociraptor detects the channel from the filename — keep the original EVTX filenames. Placeholders: <targetdir> = the folder, <definitions> = the definitions path, <output> = the result file. (Don't add -v — verbose logs drown the results.)

Suricata (PCAP → eve.json · download)

Runs from the Suricata install dir so it finds suricata.yaml. Windows rules: suricata-update is a Linux/pip tool — on Windows, download emerging-all.rules (ET Open) manually and point suricata.yaml at it (see this Suricata-on-Windows guide). Leave the update command blank unless you have suricata-update installed.

(only if you configured an update command above)
Snort (PCAP + your rules → alert_fast · repo)
YARA (scan files/dirs → matches · repo)
SO-CRATES (HTTP service, not a local binary — pcap → Suricata, logs → Sigma, anything else → YARA · repo)

The only tool here reached over HTTP rather than by spawning a binary, so it needs a URL instead of a path. Importing a PCAP, binary, EVTX, or archive will offer it alongside any local tool claiming the same file. Only detections are imported (Suricata alerts, YARA matches, Sigma alerts) — raw telemetry stays in SO-CRATES. Analysis is asynchronous; the import banner shows progress until results land. SO-CRATES has no authentication and binds 127.0.0.1 by default — a non-local URL means unauthenticated evidence reachable by anyone who can route to it. Every submission is written to the case custody log.

Password-protected archives are unpacked here, not by SO-CRATES: its API can only ever try infected, and it cannot open WinZip AES archives at all. Enter the password in the import banner; leave it blank for infected.
Master auto-run kill-switch: DFIR_TOOL_AUTO_RUN=off disables all auto-run (set on the General tab's .env, or your env).
Custom tools (add your own — runs on the extensions you choose; output is auto-detected)

Define any local tool: give it a name, the binary path, a run command (use <target> for the input file and, if it writes a file, <output>), an optional update command, and the file extensions it should handle. The tool's output is fed through the normal importers (auto-detected). Importing or dropping a file with a matching extension will offer to run it.

Add a custom tool
MCP servers (point case evidence at the servers Claude Code is configured with)

The Companion does not speak MCP and stores no server URL or token. Configure your MCP servers in Claude Code; the Companion asks Claude Code to call them. This needs Claude Code installed and authenticated on the machine running the Companion. What you set here is policy: which of those servers may be used, what they may run, and how evidence reaches them.

Allowing a server lets plain-English investigations choose from everything it offers — the same access Claude Code already gives you when you use it directly. Some servers expose a command runner (SIFT's run_command, REMnux's run_tool), so the investigation may choose command lines on that host. Restricting tools below narrows autonomous use. Command restrictions apply only to the advanced manual-call form because an autonomous MCP loop chooses its own arguments.

Allow one of Claude Code's servers
How evidence reaches it
Known-good patterns that auto-mark matching IOCs as a false positive on import (and on demand). Global — shared across all cases. Reversible: matches appear in False Positives and can be un-marked.
⚠ Whitelisting is opt-in for a reason — auto-excluding internal IP ranges can hide lateral movement. Only add patterns you trust.
Quick add:

Scans the loaded case's current IOCs and marks matches as a false positive (already auto-runs on every import).
A set of known-software file hashes (NIST NSRL / RDS). A forensic event whose file hash — or an IOC whose value — matches is a known-good file, auto-marked a false positive on import (and on demand), reducing false positives. Global — shared across all cases. Reversible: matches appear in False Positives.
⚠ NSRL lists known, not strictly known-good, software — some RDS sets include hacktools, and a known hash can still be malicious in context (DLL side-loading, a renamed LOLBin). Opt-in for a reason.
Loading…
Reads an NSRLFile.txt / hashdeep CSV / hash list straight off this machine — for big RDS sets you don't want to paste. The in-UI equivalent of the DFIR_NSRL_FILE env var, but on demand: loaded hashes persist, so there's no restart and they survive one.

Loading…
For the full ~160 GB NSRL RDS (too big to load into memory) — queried on demand, no ingest. Download the Modern RDS minimal SQLite set and index the hash column(s) first (CREATE INDEX … ON METADATA(sha256) + ANALYZE; matching keys on sha256/md5, not sha1). See the README's NSRL section for the full setup.

Scans the loaded case's IOCs + forensic events and marks known-good matches as a false positive (already auto-runs on every import).
Declarative importers let you add support for a new tool's export format without writing code. Drop a JSON definition in the importers/ folder (auto-loaded on startup) or paste one below. Global — shared across all cases. Generate a definition for any file format with an LLM via the prompt button.
⚠ Custom importers run on every matching import. Review a generated definition before adding it — a too-broad match can shadow a built-in importer.
Built-in-first keeps the shipped importers authoritative; custom-first lets a definition override one.
Loading…

The CISA Known Exploited Vulnerabilities (KEV) catalog lists CVEs that are actively exploited in the wild. When loaded, the Companion cross-references CVE IDs found in your forensic timeline and IOCs against the catalog and surfaces any matches as high-probability initial access vectors in synthesis context and in report §4.5.1. Global — shared across all cases. Opt-in: starts empty.
⚠ KEV cross-referencing only fires when CVE IDs appear in your evidence. Load the catalog here; the Companion does the rest automatically during synthesis.
Loading…
Fetches the latest catalog directly from cisa.gov — requires server outbound internet access.
For air-gapped deployments — point to a locally-saved copy of the CISA KEV JSON.
Removes the catalog from disk. The catalog is global — clearing it affects all cases.
Opt-in check against the project's GitHub Releases page. When enabled, the server checks at most once a day (and on demand) and shows a banner if a newer version exists. It never downloads or installs anything — the banner just links to the release. Off by default. Set DFIR_UPDATE_CHECK=0 to lock it off entirely.
Disabled by administrator (DFIR_UPDATE_CHECK=0).
Loading…
Read-only
Push new/escalated findings, playbook updates, investigation milestones, and @mentions in comments to Slack, MS Teams, Mattermost, Discord, Telegram, or email — with a per-channel severity threshold and per-event toggles. Global — shared across all cases.
⚠ Notifications send case content (finding/task titles) to a third party. Off by default — each channel is opt-in. Don't enable on a sensitive case unless the destination is trusted.
Leave the token blank to reuse the war-room bot's DFIR_TELEGRAM_BOT_TOKEN from .env. The token stays in .env only — rotate it there and this channel follows. A token typed here overrides it, for a separate bot. The Chat ID offers the chats the bot is already bound to — check it points where you mean before adding, since notifications carry case content.
Notify on:
Slack app credentials (read-only)

Channel routing is configured above through the notifications API. These are the APP-level credentials, kept in .env: a bot token and the secret that authenticates Slack's inbound calls are operator property, not dashboard fields.

Teams credentials (read-only)
Telegram credentials (read-only)

Reloadable from .env without a restart, but never writable here — the dashboard has no business rewriting the war-room bot's credential.

Branded report layouts — accent colour, cover title/subtitle, running header & footer, and which sections appear. Global (shared across cases); pick one per case in Case Details. Built-ins are editable in place — Reset restores the shipped default.
Placeholders (filled from Case Details): {{organization}} {{companyName}} {{incidentId}} {{restrictions}} {{investigators}} {{date}} {{caseId}} · conditionals: {{#if incidentId}}…{{/if}}
Critical and High findings always require valid evidence links. “Require” section boxes above block release if that section is disabled.
Panel-layout presets for the dashboard — which sections show (and their order), an optional severity floor + top-N cap on findings & timeline, and a matching report template. Global (shared across cases); pick one from the toolbar ⊞ view button. Built-ins are editable in place — Reset restores the shipped default.
Operator-facing system state for troubleshooting ingestion / AI problems. Read-only and redacted (no API keys or evidence content). The summary loads fast; per-case disk sizes are computed on demand.
Pre-flight checks
Loading…
Case Statistics
Loading…
Host Clock Skew
Offsets are measured where one artifact was recorded by two different tools, and are only trusted when several anchors agree — a scattered host is shown but never aligned. Alignment shifts events for display, correlation and reports; the recorded timestamp is always kept and shown alongside.
Loading…
Loading…
Automatic state backup configuration — created before each synthesis + on an interval
Restore a case backup
Loads backups for the currently-selected case. Restoring overwrites the live state — the current state is not auto-saved first, so make a manual backup before restoring if needed.

Now triage decision cockpit

Connect to or create a case to see the next investigative decisions.

Ask the LLM about this case

Query Translator natural language → VQL / KQL / ES|QL / SPL / Sigma / YARA / Suricata

Describe the activity you want to hunt for in plain English; the AI translates it into a runnable query for each selected platform, grounded in that platform's real schema. Review every query before running it.

Executive Summary

Recommended Next Steps

Collection Planthe evidence this incident type calls for, in order — ticked off from what the case already holds (derived, no AI)

Scope & Clearancewhat is affected, what was never collected, and what an analyst has cleared — clearance means no evidence of compromise was found given the sources collected, not that a host is clean (derived, no AI)

Duplicate Hostshosts seen under more than one name — analysis is on hold until each pair is confirmed as one machine or two (derived, no AI)

Attack Path

Narrative Timeline

Findings

📌 Pinnedthe analyst-curated shortlist — pin a finding with 📌, drag to reorder, click to jump
No findings pinned yet — click 📌 on a finding to keep it here.
% (0 = all)
Actions:

Attacker Sessionsthe timeline re-threaded as per-host chapters — a contiguous run on one host with no long gap inside it (derived, no AI); click a card to filter the timeline to that session

Forensic Timeline

Actions:
🕑 All timestamps are in UTC.

Kill Chainevents bucketed by their ATT&CK tactic (derived, no AI); a categorization, not a confirmed kill-chain stage — e.g. valid-account use can span entry and lateral movement

Memory Next Stepsiterative memory-forensics agent — reads the imported Volatility/Rekall evidence, spots process-tree/injection/network anomalies, and suggests the exact next Volatility command

Attack Phasestemporal bursts — activity grouped by time gap, labelled by dominant tactic (derived, no AI)

Host & Account Rankingwhich hosts/accounts carry the attack — scored by signal (severity-weighted events + techniques + connective IOCs), not volume (derived, no AI)

Evidence Gapswhat this case is MISSING — uncovered kill-chain phases (with where to collect), silent windows, and lookalike-actor next moves (derived, no AI); a lead, not proof

Timeline Gapssuspicious silent periods — a complete gap (all sources dark) is the classic log-tampering signature (derived, no AI); a lead, not proof

Timeline Swimlanevisual chart — Y-axis: assets · X-axis: time · color: severity (derived, no AI)

💡 Click a dot for details and to flash its row in the Forensic Timeline · Shift-click a dot (or Shift-drag a box) to select events, then 🚫 Mark False Positive · Drag the time axis (bottom bar) to filter the Forensic Timeline to that range
Group by: 100%

Compromised Assets & IoC Graphassets and IOCs derived from findings and the timeline, plus any you add by hand — edges show how they connect

Layout type
Edge style
Transparency for unselected elements
Show

Known compromised assets

Evidence Chaincausal links — process trees, lateral movement, file lineage & network flows (derived, no AI)

Layout type
Edge style
Transparency for unselected elements
Show
Min severity
Node colour
Kill-chain phases
high medium ran on file lineage network flow

Lateral movement paths — ordered entry → pivot → target chains reconstructed from lateral_move + ran_on evidence, by real timestamp (#92)

Beacon Candidatesperiodic outbound channels — too regular to be human traffic (derived, no AI); a hunting lead, not a verdict

Timeline Anomaliesassets whose event rate in a time bucket spikes — vs other assets (peer) or vs their own baseline (self) (derived, no AI); a triage lead, not a verdict

🔑 Login Graphwho logged on where — accounts → hosts from super-timeline logon events (4624/4625)

🌍 Geographic Mapimported IPs geolocated from GeoIP enrichment — markers colored by severity (derived; OpenStreetMap tiles load on demand when you open the map)

IOCs

Actions:

Customer Exposure

Breach/leak check of the customer's own domains & emails (not IOCs). Domains found in the case's own FQDN hosts are added automatically (dashed "auto" chips below), same as case emails under a customer domain. ⚠ sends the customer's domains/emails to third-party services.

Key Investigative Questionsopen questions the AI is tracking — answered automatically once the evidence supports them

Uncertainty Ledgerwhat the analysis KNOWS vs INFERRED vs SPECULATED — treat anything below Confirmed as provisional, not fact

Hunting ProfileWhat has been hunted in this case and whether it found anything

Investigation Threadsopen leads the AI tracks across re-synthesis runs — closed automatically once the evidence resolves them

MITRE ATT&CK

Adversary Hintsknown ATT&CK groups by technique overlap + their likely next techniques — hypothesis fuel, not attribution (derived, no AI)

Playbook Matchdid this case's techniques happen in the ORDER a published ransomware playbook describes — matches the playbook, not the actor (derived, no AI)

Mitigation & Defensive Countermeasuresconcrete MITRE ATT&CK mitigations to apply for this incident's techniques, plus D3FEND defensive techniques — offline, no AI

Compliance Impactcontrol failures & regulatory obligations for this case's CONFIRMED findings — offline, no AI, not legal advice

Suggested Fleet HuntsAI-proposed Velociraptor VQL hunts from the findings — sweep the fleet for the same tradecraft

False Positives (excluded from analysis)

Learned patterns — recurring dismissals fed to synthesis: new look-alikes are surfaced at lower confidence unless corroborated (not excluded)

Hunt Workbench typed field queries over an explicitly selected timeline — indexed, cursor-paged and resource-bounded

Boolean expressions, existence, ranges, safe regex, time windows, grouping, statistics and rare values are supported. Example: event.category=authentication AND event.outcome=failed | group by source.ip | count | sort count desc
Grammar reference
Open a case to load the typed grammar and field catalogue.
Run a query to see results.

Investigation Logimport events and AI notes merged with analyst quick-action entries, in chronological order

Activity LogEvery security-relevant action taken on this case

Chain of Custodyevery stored artifact, its hash, and each event that touched it — the appendix that ships in the report

⬇ Signed manifest
Loading case…