Point the wiki at the commands and files that exist
The June refactor renamed run_eval.py to analyze.py and moved the
evaluation scripts under scripts/eval/; several pages still showed the old
names, a scripts/measure_accuracy.py that never shipped, a decision.py that
does not exist, a SCHEMA.md instead of the validate_ground_truth.py gate,
and an output layout (reports/, audit/, dfir-corr/) the agent never wrote.
Those now match the tree. The function catalog gains the match_sigma_rules
entry it was missing (48 native + 25 SIFT = 73), the ground-truth total is
94, the CI matrix is 3.10–3.13, and the Phase 1 open-items tables reflect
that the three external datasets were measured in June. The Quick-links
anchor to the README's Quick start section resolves again.
Rename the project to Agentic-DFIR
Wiki pages follow the repository rename: package, command and environment
variable names move from the `dart` prefix to `dfir`, image and page links
point at the renamed repository, and the name page now describes the name
literally. Content about the architecture, the tool surface and the case
walkthroughs is unchanged.
wiki: bring release log to v1.2.0, document model-aware auth + live Sigma pack, add self-learning loop design
docs(wiki): sync MCP-function-catalog to the live 47-native surface
The category table and function list were stale at 35 native / 60 total. The
live registry (test_mcp_surface asserts the exact set) is 47 native + 25 SIFT
= 72. Updated category counts (macOS 4->5, Linux 3->6, Linux+macOS 1->2,
Cross-platform 14->21, native total 35->47, grand total 60->72) and added the
7 functions that shipped in v0.6.1-v0.7.1 with their code descriptions and
ATT&CK mappings: parse_registry_hive, grep_shell_history_for_c2,
detect_credential_file_access, scan_pth_files_for_supply_chain_iocs,
detect_nodejs_install_hooks, detect_pypi_typosquatting,
detect_python_backdoor_persistence. Phase-1.md: "72 native" -> "47 + 25 = 72".
wiki: sync to v0.7.1 — 11 cases, 72 MCP functions, case-11 highlight
- Accuracy.md: '61 files' -> '49 files'; new v0.7.0 section covering
case-11 supply-chain attack class; new v0.7.0 case-library summary
table (11 cases / 99 findings split 69 layer-1 + 30 layer-2 + 32/36
function coverage)
- Glossary.md: 'As of v0.6.0' -> 'As of v0.7.1: 72 native MCP tools'
- Home.md: case-studies section rewritten to mention 11 cases / 99
findings plus case-11 as recommended judge walkthrough
- MCP-function-catalog.md: previously missed v0.6.1 functions
(parse_macos_quarantine, parse_linux_cron_jobs, detect_dns_tunneling)
+ v0.7.1 functions (parse_linux_text_log, parse_linux_shell_history)
now properly documented with MITRE technique mappings and references
- Phase-1.md: timeline extended with v0.5.4, v0.6.0, v0.6.1, v0.7.0,
v0.7.1 milestones
deliberately not touched — these are version-anchored historical
records: v0.5.4 CFReDS section (locked at first external benchmark),
playbook 'target_case_classes: 10 case classes' (playbook scenario
classes, not evidence cases), v0.4 / v0.5 release rows.
wiki: naturalize hardcoded counts (Source of Truth lives in README Hero)
Following the same Single-Source-of-Truth cleanup applied to the main
repo: wiki pages no longer hardcode '67 typed functions / 42 native +
25 SIFT adapters / 10 of 12 MITRE / 55 tests / 1182 lines'. Phrasing
shifts to 'the typed MCP surface', 'native + SIFT adapters', 'broad
MITRE enterprise tactic coverage'.
Phase-1.md historical version table preserves period-specific numbers
(v0.3 = 31 functions, v0.4 = 35 native, v0.5 = 60 functions) because
those are historical facts about what shipped on those dates, not
claims about current state.
The canonical exact name set continues to live in
tests/test_mcp_surface.py — the only place that needs editing when a
function is added or removed.
wiki: sweep stale 35-native / 60-total counts to current 42 / 67
16 wiki pages had pre-v0.6.0 numeric references that survived earlier
QA rounds. Surface count was bumped 60 -> 67 in v0.6.0 (six new
supply-chain IOC functions in dart_mcp._v05_supply_chain), and native
count went 35 -> 42, but a number of wiki pages still showed the old
numbers.
Pages corrected:
About-the-name, Architecture-deep-dive,
Architecture-first-vs-prompt-first, Case-PtH-Timestomp, FAQ,
Glossary, Home, Live-mode, MCP-function-catalog, Phase-1,
Roadmap, SIFT-adapter-layer, The-Memex-Bet, _Sidebar, dart-mcp
Phase-1.md version history table preserves the historical numbers
(v0.4 = 35 native, v0.5 = 60 functions) as those are historical
facts, not current state.
MITRE coverage also corrected from 11/12 -> 10/12 (TA0009 Collection
and TA0011 C2 are Phase 2).
wiki(qa-r7): replace 10 dead external reference URLs with verified live alternatives
Pairs with main repo commit 56879b8. Comprehensive external URL
reachability sweep across all 4 surfaces (repo + wiki + profile +
pages — 193 unique URLs, 332 references) surfaced 10 dead links,
all in MCP-function-catalog.md. Replacements:
== Microsoft docs migration (4 URLs) ==
Microsoft moved virtually all 'docs.microsoft.com/en-us/windows/...'
audit and forensic doc paths under 'learn.microsoft.com/en-us/previous-versions/'
when learn.microsoft.com became the canonical landing page. Old paths
return 404, not 301-redirect, so the references die silently.
- docs.microsoft.com/.../auditing/audit-logon-events
→ learn.microsoft.com/.../previous-versions/.../basic-audit-logon-events
- docs.microsoft.com/.../sysinfo/sysmain-cache (Prefetch format)
→ github.com/libyal/libscca prefetch-format.asciidoc (most-cited
community spec; the canonical reference Eric Zimmerman, Sarah
Edwards, and forensics.wiki all link to)
- docs.microsoft.com/.../web-shell-threat-hunting (Microsoft killed this entire path)
→ attack.mitre.org/techniques/T1505/003 (canonical web-shell ref
that actually outranks Microsoft's docs in field practice anyway)
== Other dead links (5 URLs) ==
- andreafortuna.org/2019/05/06/amcache-blog
→ github.com/EricZimmerman/AmcacheParser (AmcacheParser is what
every working Amcache reference cites; Andrea Fortuna's blog
post pre-dated AmcacheParser becoming the standard)
- tzworks.com/prototypes/shellbags
→ forensics.wiki/shell_item (TZWorks restructured product pages;
forensics.wiki is the community-maintained alternative)
- bsi.bund.de/EN/IT-Security/Cyber-Security
→ bsi.bund.de/EN/Home/home_node.html (path moved on BSI site
restructure; homepage stable)
- sans.org/white-papers/35107
→ sans.org/blog/forensics-101-acquiring-an-image-with-ftk-imager
(35107 was a paywalled paper; SANS pulled the gate, the blog
acquisition guide covers the same material on the open web)
- trustwave.com/.../timestomp-mft-shenanigans
→ sans.org/blog/digital-forensics-detecting-time-stamp-manipulation
(Trustwave Spiderlabs blog post archived; SANS has equivalent
coverage of the SI vs FN timestomp detection pattern)
== Service downtime (1 URL) ==
- news.sophos.com/en-us/category/threat-research/ (503 service
unavailable)
→ cisa.gov/news-events/cybersecurity-advisories (CISA's
#StopRansomware advisories cover the same TTP-catalog space
Sophos's Active Adversary Playbook does, with the bonus that
CISA is a stable government domain.)
== Side fixes that surfaced during the sed pass ==
- Removed duplicate AmcacheParser line (one with ericzimmerman.github.io,
one with the canonical github.com/EricZimmerman/AmcacheParser)
- Removed duplicate CISA line (Ransomware Indicators / Cybersecurity
Advisories were pointing at the same URL)
- Restored MITRE ATT&CK web-shell line that an ampersand-bearing sed
accidentally chewed up (the ATT&CK ampersand collided with sed's
& meaning 'replacement back-reference')
== Verified ==
All 9 new external URLs return HTTP 200 with valid content. No
introduced regressions. transfer.sh (503 in case-04 phishing-to-exfil
evidence) is left as-is — it's an intentional forensic IOC, not a
reference link, and its IOC value is independent of current uptime.
wiki(qa-r4): MCP-function-catalog title corrected to reflect actual coverage
The page title claimed '60 typed forensic functions (35 native + 25
SIFT Workstation adapters)' but the body only catalogued the 35 native
functions — the SIFT adapters were never inline-listed here. That made
the page misleading: anyone Ctrl-F-ing for 'sift_vol3_windows_pslist'
on this page would find nothing and assume it was missing from the
project.
Title now reads '35 typed native forensic functions' and a top-of-page
note explicitly directs the reader to [[SIFT-adapter-layer]] for the
other 25. Quick-navigation table now ends with:
| **Native total** | **35** |
| SIFT Workstation adapters | 25 | see [[SIFT-adapter-layer]] |
| **Grand total MCP surface** | **60** |
This way the page is honest about what it covers and where to find
the rest. Filling out the SIFT adapter inline catalogue here (issue #31
on the main repo) is post-SANS work.
wiki QA pass: synchronize 13 pages to v0.5 reality (60 tools, 22 tests)
Companion to main repo commit 52f975d (v0.5.1 QA pass).
Updated to reflect the v0.5 SIFT adapter layer (35 native + 25 SIFT
= 60 typed read-only MCP tools) and the v0.5 test suite expansion
(20 → 22 cases):
About-the-name.md
'The 35 typed dart-mcp functions cover...' →
'The typed dart-mcp surface (35 native + 25 SIFT Workstation
adapters = 60 functions) covers...'
Test count 20/20 → 22/22 across all references.
Architecture-deep-dive.md
ASCII architecture box: 'dart-mcp 35 typed forensic functions'
→ 'dart-mcp 60 typed forensic functions (35 native + 25 SIFT)'
Architecture-first-vs-prompt-first.md
'The MCP surface is exactly 35 functions, by name' →
'The MCP surface is exactly 60 typed functions, by name (35
native + 25 SIFT Workstation adapters)'
Case-PtH-Timestomp.md (2 references) updated parallel to docs/.
FAQ.md
Question heading: 'Is the MCP surface really exactly 35
functions?' → 'Is the MCP surface really fixed in size?'
Answer body: counts updated to 60 / 22-22.
Glossary.md
dart-mcp definition: 35 → 60.
'For Agentic-DART v0.4: exactly 35' →
'For Agentic-DART v0.5: 60 (35 native + 25 SIFT Workstation
adapters)'
Home.md (TOC)
'the 35 forensic functions, schema, bypass tests' →
'the 60 forensic functions (35 native + 25 SIFT adapters),
schema, bypass tests'
'why the MCP surface is exactly 35 functions, not 28, not 35'
rephrased to avoid count-anchoring.
Live-mode.md (2 references) parallel to docs/.
MCP-function-catalog.md
Page title: '· 35 typed forensic functions'
→ '· 60 typed forensic functions (35 native + 25 SIFT
Workstation adapters)'
Operator-guide.md
'All 20 tests should print OK' → 'All 22 tests should print OK'
Phase-1.md
Body: '35 typed forensic functions' / '20 of 20 tests passing'
counts updated.
Timeline table: ADDED row for 2026-05-02 v0.5 (SIFT Workstation
tool adapter layer → 60 functions, 22 tests passing). v0.4
historic row preserved verbatim.
Roadmap.md
Three references to 35 / 20-20 updated to v0.5 numbers.
Running-on-macOS.md
'Step 3 — Run all 20 tests' → '... 22 tests'
'All 20 tests pass on M1/M2/M3' → 'All 22 tests pass on M1/M2/M3'
The-Memex-Bet.md
'MCP surface (35 typed functions)' →
'MCP surface (60 typed functions: 35 native + 25 SIFT adapters)'
'The 35 functions are not a guideline...' →
'The 60 functions (35 native + 25 SIFT Workstation adapters)
are not a guideline...'
_Sidebar.md
Two TOC labels: '(35 functions)' → '(60 functions: 35 native +
25 SIFT)'
dart-mcp.md
'exposes exactly 35 typed forensic functions' →
'exposes 60 typed forensic functions (35 native + 25 SIFT
Workstation adapters)'
Section heading 'The 35 functions' → 'The 60 functions (35
native + 25 SIFT adapters)'
SIFT-adapter-layer.md
Preserved verbatim — line 18 'its own 35 forensic functions'
is historic context describing the pre-v0.5 state.
feat: 35-function MCP catalog with full references
New wiki page enumerating all 35 typed forensic functions with:
- Primary OS/artifact target for each
- MITRE ATT&CK technique mapping
- Published reference (SANS course / paper / vendor doc / open-source tool)
so reviewers can audit where the detection logic comes from
Sidebar updated to include the catalog.