SAVVYDFIR-MCP v1.1.1 — FindEvil Submission

SAVVYDFIR-MCP v1.1.1 — FindEvil Submission (final)

Autonomous DFIR on Claude Code + SANS SIFT Workstation. Point it at a case manifest.json;
hooks + a coverage gate enforce a deterministic 7-phase workflow, and an evidence-provenance
gate only promotes findings to CONFIRMED with provenance + ≥2 independent sources + a ruled-out
benign alternative. Autonomous-first (not a manual investigator console).

Validated — 5 independent blind cases, 0 scored hallucinations

Case	OS / scenario	Recall
ROCBA-2020-FREDS-LAPTOP	insider IP theft (Windows)	90%
LONEWOLF-2018-DESKTOP-PM6C56D	mass-shooting plot (Windows)	91.7%
NIST-DATALEAK-2015-PC	insider leak (Windows, disk-only)	60%
ALI-WEBSERVER-WIN-L0ZZQ76PMUF	web-server breach (WinSrv 2008)	92.3%
NIST-HACKINGCASE-2004-MREVIL	war-driving (Win XP, disk-only)	86.7%

Full per-case artifacts (report.html, graph.html, hash-chained audit.jsonl for 4/5) under
docs/agent-execution-logs/; scores in scripts/eval/baselines/.

Highlights

• Attribution: THIRD_PARTY.md credits all external tools; the vendored Chainsaw mapping is
  marked GPL-3.0; the forensic-knowledge corpus is original project-authored.
• Accuracy / dataset / eval-methodology docs written to the actual 5 cases, with gaps disclosed
  honestly (precision is not measured; "0 scored hallucinations" is a known-negative check, not a
  zero-error guarantee — see docs/accuracy-report.md).
• README: architecture + decision-flow diagram, autonomous-first design note.

MIT licensed (own code); third-party works retain their own licenses (see THIRD_PARTY.md).