About the name

About the name

DART = Detection And Response Team

That's the literal expansion. But the codename was chosen with deliberate room to grow.

The four-phase plan

Agentic-DART begins as an agentic DFIR assistant — that's the focus of the SANS FIND EVIL! 2026 submission. But the name is intentionally generic so it remains accurate as the project's scope expands.

Phase 1 (current) — Agentic DFIR

Senior-analyst reasoning encoded as architecture across forensic artifacts. The typed dart-mcp surface (native pure-Python + SIFT Workstation adapters) covers broad MITRE ATT&CK enterprise tactic coverage. Verified by the bundled test suite (the full test suite passing on a fresh clone) and the bundled IP-KVM and PtH-timestomp case studies.

Phase 2 — Agentic Detection Engineering

Once the DFIR loop is solid, the same architecture-first approach extends to:

• Detection-as-code generation — Sigma rule synthesis from observed evidence
• Coverage-gap reasoning — given an environment, what tactics is the current rule set blind to?
• Rule maintenance — what existing rules are now firing on benign behavior, and why?

The MCP surface for Phase 2 will be additive (the existing typed surface stays intact; new functions for detection-engineering tasks are added). The architectural guarantee — read-only, audit-chained, contradiction-aware — stays the same.

Phase 3 — Agentic SOC

Once detection is mature, the project moves into supervised SOC operations:

• Triage — given an alert, what is the minimum set of MCP calls needed to decide if it's worth waking a human?
• Enrichment — given an indicator, what is the agent allowed to look up and how does that integrate with internal threat intelligence?
• Response orchestration — a strict superset of the read-only surface, where some response actions become callable, but only through a separate "armed" MCP server with a different audit chain and human-in-the-loop confirmation.

This is where DART becomes literal: detection AND response.

Phase 4 — Beyond DR

Once the DR loop works, the same patterns extend to broader agentic security workflows:

• Vulnerability management (which CVEs in this codebase actually exposed?)
• Compliance evidence gathering
• Adversary emulation pre-flight checks
• Tabletop exercise generation

Why a generic codename matters

A name like dart-dfir or dart-forensics would have boxed the project into Phase 1. By the time we got to Phase 2, the name would be wrong, and a rename would lose stars, tear up internal references, and break external links.

Agentic-DART is forward-compatible by design.

Why "Agentic"?

The "Agentic" prefix is a deliberate signal that this is not a wrapper around an LLM, not a single-shot tool, and not a chatbot. It is:

• Autonomous within a tightly typed boundary
• Iterative with hypothesis revision and confidence tracking
• Auditable end to end via SHA-256 chains

The word "agentic" is industry shorthand for "the agent is the unit of work, not the prompt." That matches what this project is.

What the name is NOT

• Not a reference to any specific organization's internal team naming
• Not an acronym for anything other than what's stated above
• Not a brand owned by an employer or a sponsor

This project is independent and personal.

---

← Back to Home