Home
An autonomous DFIR agent that thinks like a senior analyst. Architecture-first, not prompt-first.
This wiki is the long-form companion to the project README. The README is for landing — get a feel for the project in 30 seconds. The wiki is for engineers who want to understand the why, the how, and the parts that don't fit on a single page.
To see the agent run, use the bundled demo (bash examples/demo-run.sh, no API key needed) or browse the sample run screenshots.
- The Memex bet ⭐ — the bet underneath this whole project — why DFIR reasoning belongs in architecture, not in prompts
- About the name — what the name says and the four-phase roadmap
- Architecture-first vs prompt-first — the central design claim
- Threat model — what Agentic-DFIR defends against, and what it does NOT
- dfir-mcp — the typed surface — the typed forensic function surface, schema, bypass tests
- SIFT adapter layer — 25 typed wrappers around Volatility 3, MFTECmd, EvtxECmd, PECmd, RECmd, AmcacheParser, YARA, Plaso
- dfir-agent — the senior-analyst loop — iteration / hypothesis / confidence
-
dfir-corr — cross-artifact correlation — DuckDB joins and
UNRESOLVEDflagging - dfir-audit — SHA-256 chained log — tamper-evident audit trail
- dfir-playbook — sequencing rules — YAML-driven analyst heuristics
- Running on the SIFT Workstation — install, mount, run
- Live mode (real Claude API + MCP stdio) — from Claude Code
- Reproducible accuracy measurement — re-run every dataset
The repository ships 11 cases / 94 ground-truth findings across two layers
(8 Layer-1 synthetic cases, 3 Layer-2 external case-study slots). See the
examples/case-studies/
directory for the full library; recommended walkthroughs:
- PtH with timestomp pre-existence — headline self-correction walkthrough
- IP-KVM remote-hands insider — the bundled detection example
- supply-chain → ADCS ESC8 → DCSync → Golden Ticket — 12 findings reproduced deterministically by 7 MCP functions on bundled evidence; byte-stable expected output locked in the case README
- How to write a new case study
- Phase 1 — Agentic DFIR ⭐ — the shipped v1.x/2.x line: architecturally complete, empirically validated
- Phase 2 — Detection engineering — ~Q3 2026. Sigma synthesis, coverage-gap reasoning, auto-execute YAML playbooks
- Phase 3 — Agentic SOC — ~Q1 2027. Supervised triage, enrichment, response orchestration with human-in-the-loop
- Phase 4 — Broader agentic security — 2027+. Vuln management, compliance, adversary emulation
- Glossary — DFIR + ATT&CK + project-specific terminology
- FAQ — common questions from contributors and skeptics
- Comparison with adjacent tools — Velociraptor, KAPE, Plaso, Hayabusa
| What you need | Where to look |
|---|---|
| Try it in 30 seconds | README → Quick start |
| Architecture diagram | docs/dfir-architecture.png |
| Sample run screenshots | docs/screenshots/ |
| Full case-study walkthrough | docs/case-pth-timestomp.md |
| Source code | github.com/Juwon1405/agentic-dfir |
The README has to be readable in two minutes. That means it can't go deep on:
- the threat model (what attacks are in scope, what aren't)
- the decision log (why the MCP surface is the fixed shape it is, and how it expands additively without weakening the boundary)
- the comparison with other DFIR tools
- the per-component design notes that engineers actually need to extend the project
This wiki is where that long-form writing lives.
Wiki maintained alongside the main repo. Same MIT license.