v0.1.0 — DFIR pipeline: processing + signatures + MITRE CAR on Kusto

First tagged milestone of the DX_DFIR pipeline — a fully offline, container-based
DFIR processing and analysis stack that normalizes forensic evidence into the
MITRE CAR data model on a local Azure Data Explorer (Kusto) emulator.

Processing (evidence → normalized JSON)

• Plaso / log2timeline — disk images (E01/VMDK/raw) → .plaso → JSON Lines, split into one L2t<Parser> table per top-level parser; events enriched with hostname / disk id / volume id.
• Zeek — PCAPs → JSON (ISO-8601); typed conn + a generic table for every other log type.
• Volatility 3 — memory images → JSONL per plugin, with custom dfir_processes (psscan: full path/parent/DLLs) and dfir_registry (RECmd-style keys from RAM) plugins.
• EvtxECmd, Velociraptor (EZ Tools offline collectors).

Signature detection (process-signatures.sh)

• YARA — files, mounted disk images (never extracts), and memory through Volatility vadyarascan (matches carry PID context).
• Suricata — pcaps → EVE JSON.
• Hayabusa — EVTX → Sigma detections (validated at 792 detections on the LoneWolf image).

MITRE CAR data model (KQL)

• All 9 CAR objects built as per-artefact views (Car<Object>_<Artefact>, union isfuzzy roll-ups) that keep native fields and add the canonical CAR fields, strict to car_data_model.json. Memory sources all nine from RAM. CarCoverage() returns rows for every object on the live emulator.

Backend

• Kusto emulator (kustainer) deploy + idempotent schema + ingest for Plaso L2t*, EvtxECmd, Zeek (conn + generic), Volatility, Velociraptor.

Housekeeping

• Docker dangling-layer self-cleanup on the processors; refreshed deployment docs.

Roadmap (tracked): #46 rewrite as the get_sybers.dfir Ansible Galaxy collection + Python + CLI; #45 dual-output ADX + SOF-ELK; #44 host/network re-ingest + CAR re-validation.

⚠️ The Kusto emulator has no auth and accepts Microsoft's EULA on your behalf; it is not for production. No forensic evidence is included in this repo.