About the name

About the name

The name is literal. Agentic says how the system works: an autonomous, iterative, auditable loop rather than a prompt wrapper. DFIR says what it works on: digital forensics and incident response. Put together, Agentic-DFIR is an agentic system for digital forensics and incident response — nothing in the name needs decoding.

The four-phase plan

Agentic-DFIR begins as an agentic DFIR assistant. Later phases build on the same read-only, audit-chained core.

Phase 1 (current) — Agentic DFIR

Senior-analyst reasoning encoded as architecture across forensic artifacts. The typed dfir-mcp surface (native pure-Python + SIFT Workstation adapters) covers broad MITRE ATT&CK enterprise tactic coverage. Verified by the bundled test suite (the full test suite passing on a fresh clone) and the bundled IP-KVM and PtH-timestomp case studies.

Phase 2 — Agentic Detection Engineering

Once the DFIR loop is solid, the same architecture-first approach extends to:

• Detection-as-code generation — Sigma rule synthesis from observed evidence
• Coverage-gap reasoning — given an environment, what tactics is the current rule set blind to?
• Rule maintenance — what existing rules are now firing on benign behavior, and why?

The MCP surface for Phase 2 will be additive (the existing typed surface stays intact; new functions for detection-engineering tasks are added). The architectural guarantee — read-only, audit-chained, contradiction-aware — stays the same.

Phase 3 — Agentic SOC

Once detection is mature, the project moves into supervised SOC operations:

• Triage — given an alert, what is the minimum set of MCP calls needed to decide if it's worth waking a human?
• Enrichment — given an indicator, what is the agent allowed to look up and how does that integrate with internal threat intelligence?
• Response orchestration — a strict superset of the read-only surface, where some response actions become callable, but only through a separate "armed" MCP server with a different audit chain and human-in-the-loop confirmation.

This is where response actions first become callable — behind a separate armed server with its own audit chain and human confirmation.

Phase 4 — Broader agentic security

Once the detection-and-response loop works, the same patterns extend to broader agentic security workflows:

• Vulnerability management (which CVEs in this codebase actually exposed?)
• Compliance evidence gathering
• Adversary emulation pre-flight checks
• Tabletop exercise generation

Why "Agentic"?

The "Agentic" prefix is a deliberate signal that this is not a wrapper around an LLM, not a single-shot tool, and not a chatbot. It is:

• Autonomous within a tightly typed boundary
• Iterative with hypothesis revision and confidence tracking
• Auditable end to end via SHA-256 chains

The word "agentic" is industry shorthand for "the agent is the unit of work, not the prompt." That matches what this project is.

This project is independent and personal.

---

← Back to Home