Skip to content

Atlas 1.0.3

Latest
Latest

Choose a tag to compare

View all tags
@AtlasFO AtlasFO released this 29 Oct 10:59
v1.0.3
009bf50

Atlas 1.0.3 collects everything since 1.0.0: the 1.0.1 and 1.0.2 updates and the 1.0.3 install fix. Atlas is an autonomous DFIR agent. Point it at disk images, memory dumps or log exports and it runs the investigation on its own, then hands back a report in which every finding links to the tool call that produced it.

What changed since 1.0.0

  • Every piece of evidence is accounted for. Each content class of an evidence item ends read, partly read, or left with a checked reason drawn from a read on the same host. A run that reaches its end with classes still undecided ends unfinished, with exit code 2 and a report section naming them, and atlas run --resume continues on them. The report and the dashboard's Coverage tab state the depth of analysis per host.
  • Provider profiles. What Atlas knows about each LLM provider is one file per provider under provider_profiles/, and your own go in provider_profiles.local/. New profiles cover Groq, Together AI, Fireworks AI, Cerebras, Azure OpenAI, LM Studio, vLLM and the llama.cpp server. Anthropic runs on its own Messages API with prompt caching. atlas doctor shows each binding.
  • Your brief is read as context. A fact about your own systems, such as an admin host or a service account, is read as context and not as a suspicion. Indicators pasted in a code fence under What you already know are searched for.
  • Stricter about what was examined. A disk image counts as examined only once a tool has read its filesystem. Memory images are recognised by their content, and table searches scan the whole file.
  • Lower cost per turn and clean stops. The per-turn coverage pass no longer repeats work on every turn, and a requested stop of a run ends with one line and exit code 2.
  • Dashboard. The Coverage tab shows what the run did with each piece of evidence, and the run strip fits a phone screen.
  • Docs. The CLI reference covers every flag, the user-facing environment variables and how a run ends.
  • 1.0.3: complete tool texts on a fresh install. fastmcp 4.1 keeps only the part of a tool's description before its first section, which cut the rules the model reads. Atlas stays on fastmcp 4.0 until it passes its descriptions in a form 4.1 keeps whole.

Every change is listed in CHANGELOG.md.

Get started

git clone https://github.com/AtlasFO/Atlas-Community.git ~/Atlas
cd ~/Atlas
./install.sh            # provisions the forensic toolchain; --yes runs it unattended
./dashboard.sh --demo   # serves the bundled investigations on http://127.0.0.1:8765

To update an existing install, run git pull in its folder and then ./install.sh again.

Install walkthrough and troubleshooting: INSTALL_INSTRUCTIONS.md. Guided first run: docs/try-it-out.md.

License

Source-available and free for personal and evaluation use: personal use under the PolyForm Noncommercial License 1.0.0, and evaluation, at work too, for less than 32 consecutive calendar days under the PolyForm Free Trial License 1.0.0 (both in LICENSE). Any other commercial, professional or organizational use needs a separate license: dfir-systems.de.

Assets 2
Loading