Ready to investigate smarter?
AI eyes on your evidence. Open source. On your machine. Your conclusions.
AI that investigates with you — turning screenshots and artifacts into a forensic timeline, findings, IOCs, attacker path, and reports. First responder speed, on your machine.
The "so what" layer — not another detection engine.
Your detection tools (Velociraptor, Security Onion, Chainsaw, Hayabusa, THOR, EDR/SIEM) already find the hits. DFIR Companion ingests their verdicts, correlates them across tools into one forensic timeline, and synthesizes the findings, attacker path, IOCs, and report. The value is in the correlation and narrative, not re-deriving alerts.
For each case the AI constructs and maintains a complete investigation state from your evidence.
Real incident events with true timestamps from artifacts — process creation, logons, network connections, file MAC times. Not the capture log.
cross-source correlationPer-technique analytic conclusions with severity, MITRE mapping, and AI confidence score (0–100). Color-coded badges: green ≥80, yellow 50–79, red <50. Filter by min confidence.
confidence-scoredIndicators with enrichment verdicts (VirusTotal, MISP, YETI, AbuseIPDB, CrowdStrike, Hunting.ch). Push IOCs + MITRE to MISP. Full kill-chain narrative.
enriched + MISP exportInteractive graph showing which indicators touched each compromised host, account, or service. Drag nodes to reposition. Zoom, fullscreen, multiple layouts.
interactive + dragCausal attack graph: process trees + lateral movement + file lineage + network flows. Trace the full path end to end — spawned, lateral-move, ran-on, wrote-file, executed-file, network edges with confidence levels.
deterministic — no AIFree-form Q&A grounded in the evidence: "was data exfiltrated?", "was a USB connected?". If unknown, tells you what to collect next.
evidence-groundedFull incident report following the AnttiKurittu template. Executive summary, BIA, timelines, conclusions. One-click PDF. Push to DFIR-IRIS, Timesketch, and MISP.
exportableFrom any event or IOC, generate ready-to-run queries: Velociraptor VQL, KQL, SPL, Sigma, YARA, Suricata, Elastic ES|QL. Zero AI cost — deterministic templates.
7 platformsCheck victim org domains & emails against LeakCheck, HIBP, DeHashed, and Shodan. Strict customer boundary — adversary IOCs never queried. No raw passwords stored.
v0.11 — credential leak checkHand-label any entity with triage tags (confirmed-malicious, false-positive, key-evidence…). Star important events. Multi-select bulk actions. Tags survive re-synthesis.
v0.11 — analyst-drivenMV3 extension: timer + event-driven (navigation, tab switch, click). Ctrl+Shift+S hotkey. Offline queue. Per-case attach. Evidence-first persistence.
lossless PNGReversibly tokenizes internal IPs, usernames, hostnames before the LLM sees them. Adversary IOCs preserved. Per-case toggle. Default on.
OPSEC-firstGroups timeline events into bursts by time gaps — initial access, persistence, lateral movement, exfil. Each phase labeled with dominant ATT&CK tactic. No AI, purely algorithmic.
v0.14 — temporal clusteringAll configuration in one place: investigator name, AI provider/model/keys, enrichment & exposure provider keys, integrations (IRIS, Timesketch, Velociraptor, MISP), and section visibility — drag-reorderable.
v0.14Per-case scratchpad for hypotheses, notes, and open questions. Typed entries (hypothesis/note/question) with colored badges. Survives re-synthesis. Included in reports.
v0.14 — AI-awareProse story-mode view of the incident for management and non-technical stakeholders. AI-generated, editable, included in reports §3.2.
v0.14 — story modeStart new cases pre-loaded with investigation questions: Ransomware, BEC, Insider Threat, Web App Intrusion, General Malware. Custom templates supported.
v0.14 — workflowRename, add, or suppress assets and manually link assets to IOCs. Overrides persist per case, survive re-synthesis. Full audit trail in the asset graph.
v0.14 — graph editingAI-generated checklist from Critical/High findings + next steps. Optional IR-template expansion. Push to DFIR-IRIS or ClickUp. Tasks get stable short IDs (T001, T002…).
v0.16 — IR workflowGenerate VQL hunts from findings with rationale — one-click deploy across all endpoints. Dedicated AI model for VQL. Collection results pulled inline.
v0.19 — AI-suggested huntsPer playbook task, suggest a Velociraptor hunt. Endpoint-tied tasks deploy as single-client collections; others as fleet hunts. Suggestions persist, only new/changed tasks re-generated.
v0.19 — per-task VQLInstallable read-only PWA — case status, worst findings, recent timeline, IOC verdicts. Quick glances during IR from your phone. Navigate to /mobile.
v0.19 — on-the-goVolatility 3 + Rekall importer: process trees, network connections, injected code (T1055), services, modules. Zero AI — pure parsing.
v0.19 — memory analysisauditd, journald JSON, sysdig/Falco alerts + events — auto-detected by Import button. Full Linux IR alongside Windows.
v0.19 — Linux IRPhishing & BEC triage: SPF/DKIM/DMARC checks, spoof heuristics, IOC harvesting. MITRE T1566 mapping.
v0.18 — phishing triageKnown ATT&CK groups ranked by technique overlap — sub-technique-aware scoring. Not attribution, but narrows the landscape. Dashboard panel + report.
v0.18 — sub-technique awareExport STIX bundles to any TIP. Navigator layer JSON — techniques colored by severity. MISP push + Notion export.
v0.18 — multi-format exportShareable ZIP for external parties: IPs/hosts/users tokenized to ANON_*, secrets redacted, screenshot EXIF stripped + PII blurred. No AI keys included.
v0.19 — safe sharingExport/import one password-protected .dfircase file — the entire case, evidence and screenshots included, AES-256-GCM encrypted. Restore on another machine.
v0.31 — encrypted archiveFull-coverage theme toggle. Follows OS preference by default, manual choice persists. Every panel, graph, canvas themed. Night-mode DFIR.
v0.19 — theme persistenceSlack / MS Teams webhooks + SMTP email for findings, playbook updates, milestones. Per-channel severity thresholds. Opt-in.
v0.19 — Slack/Teams/EmailAuto-mark matching events + IOCs false-positive on import. Flat hash set or direct query the full ~160GB NSRL RDS SQLite DB — never loaded into memory.
v0.19 — false positive reductionBranded layouts — accent colour, cover, running header/footer with placeholder interpolation. Built-ins editable in place, selected per case.
v0.19 — branded reportsInteractive asset/time chart with selection, scope-to-view, and PNG/SVG export. See which host was active when — at a glance.
v0.17 — visual timelineA Timesketch-style complete record of every imported event, kept separate from the AI-synthesized forensic timeline. Filter, label, save timeframes, and promote events in when they matter.
v0.29 — complete evidence recordMark a finding, event, or IOC false-positive with a structured reason and analyst attribution, get ranked "similar items" to dismiss the same pattern in one pass, and one-click-promote to the global IOC whitelist.
v0.29 — faster triageFindings, Ask-the-case, Explain Event, and AI-suggested hunts now show numbered, clickable citations to the exact forensic events and findings they're grounded in — in the dashboard and the exported report.
v0.30 — verifiable AIA chronological, filterable record of every security-relevant action on a case: imports, false-positive marks, AI runs, enrichment toggles, settings changes, playbook edits, comments/tags, hunts, and exports.
v0.30 — full audit trailLock a case with a password from the case lifecycle menu — the dashboard won't open it without the password, while the capture extension keeps ingesting evidence in the background. "Remember on this computer" skips the prompt on future visits; enforced server-side, not just a UI gate.
v0.31 — case-level access controlRemove a case's directory for good from the case lifecycle menu, with an optional ZIP/encrypted archive taken first as a safety net. Refuses to touch a directory that isn't a real case or delete an already-archived case's live folder out from under its archive.
v0.31 — case lifecycleNext steps now carry a one-click "Collect on <host>" deploy button, and a later import that answers the question is detected automatically and re-evaluated — no more re-asking what's already been collected. A rabbit-hole detector demotes findings disconnected from the main evidence graph, and ACH-style hypothesis tracking (contradicting evidence, discriminating tests) keeps a red herring from winning unopposed.
investigation-guidance rolloutEvery indicator now gets one critical/high/medium/low/benign tier from a transparent weighted rubric — verdict, corroborating source count, CISA-KEV status, an own-infrastructure guard, NSRL/whitelist — shown as a colour-keyed badge, a dashboard risk filter, and a Risk column in exported reports.
weighted rubric, not a black boxAnalyst-triggered run that reads EVERY graded event across as many batches as it takes — not just one prompt's worth — so a 14-host case gets full AI coverage instead of a partial read. A preview reports the real events/rows/batches/token cost per severity floor before anything is spent, and nothing is persisted until one final synthesis draws every conclusion.
v0.33 — full-case AI coverageClosed a cross-origin RCE chain (wildcard CORS let any browser tab drive the API), a WebSocket auth bypass that skipped the case-password gate, and a path-traversal hole in template/view/bundle ids — plus an IP-field XSS in the map button.
v0.33 — closed real RCE-adjacent holesA focused default dashboard that ranks your next three leads and surfaces hypotheses, contradictions, exact collection gaps, live/failed work, and report blockers — plus what changed since you last looked. Pin, dismiss, defer, or assign a lead and it keeps an audit trail back to its evidence.
v0.34 — decision-first default viewEvery screenshot and import is recorded automatically — who collected it, when, from where, and its SHA-256 — as a hash-chained log where editing or deleting an entry is detectable. A signed manifest ships in the report and the encrypted archive; evidence is re-verified in the background whenever you open a case.
v0.34 — court-ready evidence recordA typed query language over the timeline you choose — Boolean conditions, ranges, safe regex, relative time windows, grouping, statistics and rare-value detection, all indexed and cursor-paged. Save a parameterised hunt, pivot into it from any event, IOC, finding or asset, then export the result, attach it to a finding, or send it to the notebook.
v0.35.0 — search your evidence, not a second databaseTurn on sign-in when more than one analyst works the case: OIDC or an audited local account, per-case reader/investigator/reviewer/administrator roles, scoped service identities, and analyst attribution signed into the record. Two people can no longer overwrite each other. Localhost stays zero-config — none of it is required to run alone.
v0.35.0 — roles, attribution, no lost writesA YARA hit is graded by where and what it matched, not a flat High: a self-scan reads as Info, a page-file or memory-dump string as Low, a broad heuristic as Medium — only a named malware family on a real path stays High. Measured across four real intrusion scenarios: High+Critical findings cut 74–86%, zero new false positives.
v0.36.0 — signal over noiseA ransom-note filename or a file renamed with a known family's extension is flagged as T1486, aggregated per host so a mass-renamed share reads as one finding, and graded above Info so it survives the event cap instead of drowning in MFT/USN noise.
v0.36.0 — the note doesn't get buriedOne panel for shift change: findings by owner, the questions still unanswered, open hypotheses, the critical next steps, the IOCs nobody checked and the last import — derived from the case as it stands, plus the outgoing analyst's note. Copy it as Markdown or ship it as a report section. The next analyst starts where you stopped.
v0.37.0 — nothing lost between shiftsEvery finding records what happened on two separate axes — was the malicious action observed, and what did a security control do: blocked, remediated, failed, allowed, none seen. A blocked attack is no longer dismissed as a false positive or left open at High, and the report prints both axes with their attribution.
v0.37.0 — detected is not the same as succeededThe content tagger grades what its rules name, and everything else stays Info, where the AI never looks. One press sends those rows to a fast decision model, which grades them and says how sure it is. Tick the rows that matter and promote them into the forensic timeline with the model's grade on the record. Nothing moves until you say so.
v0.38.0 — a second pass over what the rules left behindThe Now cockpit shows one card per kill-chain stage: first seen, host, headline event and top finding, with the intrusion's span, dwell, hosts and accounts above it. A stage with no evidence is greyed and links to Evidence Gaps. Copy the whole story as a plain-text brief. Derived from the case — no AI call.
v0.38.0 — the intrusion at a glanceA Navigator-style matrix, built in and fully offline, in the MITRE panel and the interactive HTML report. Filter by platform, show only the techniques the case hit, and click a technique to see its findings and events. No upload, no second tool.
v0.39.0 — the whole matrix, inside the caseHeavy credential-theft evidence can trip a model's safety filter partway through a synthesis. The run now tries the same model again, then switches once to a fallback model you picked, and the Investigation Log says so. The case gets its findings instead of an error.
v0.39.0 — a stopped synthesis still finishesEach import touches only the rows it changed, so the tenth import into a case costs about what the first did. A memory guard refuses an import that would exhaust the server before it starts. On a 70,000-event case, timeline search answers in under half a second, and the timeline shows the true total with Load more.
v0.40.0 — 70k events, still fastAttacker-controlled text in evidence can no longer forge a report heading, hide later sections, or stall an export. Indicators are defanged in linear time, including domains with underscores, and numbered hosts like WS01 and WS02 stay separate events.
v0.40.0 — evidence can't rewrite the reportPress the shield on a finding. A fast model answers eleven narrow questions about the evidence the finding cites, and a tested rule turns the answers into containment steps. Tick the steps you want and they land in the Playbook, each one showing the answers behind it.
v0.41.0 — containment steps you can traceSynthesis records the earliest observed attacker entry as its own finding, even when the origin is unknown. It is honest about the limits: your own VPN address is not external evidence, and missing source telemetry keeps the confidence low and marks the entry as inferred.
v0.42.0 — where they first got inA file name that hides a right-to-left override, such as invoice<RLO>cod.scr, is graded High as T1036.002. The hidden character shows as a visible marker in the dashboard and in every report, export and alert, so the name can no longer read backwards.
Advanced-hunting exports from Defender XDR and Sentinel tables, including Linux auditd, Sysmon for Linux and VMConnection flows, import with hosts, accounts and full command lines. Zeek's classic TSV logs import too. Replication from a non-DC and AD FS key reads grade High.
v0.43.0 — your SIEM, importedWhen a model's safety filter refuses a forensic prompt, synthesis, the deep pass, the referee, Explain event and view summaries retry, then hand the work to a fallback model you pick. Every answer names the model that wrote it, and refused prompts can be saved for replay.
v0.43.0 — refusals fall back, never vanishBundled SigmaHQ rules grade CloudTrail, Entra ID and web and proxy access logs as they import. Check, install and roll back rule releases, skip known-benign values, dry-run a pasted rule, and re-grade a case you already imported. Undo restores both timelines.
v0.44.0 — community rules, graded at the doorEvery file is hashed with SHA-256 and SHA-1 into chain of custody before any parser touches it, rejected files included. You can show a file was handed over and match it against your own copy, even when the import failed.
v0.44.0 — hashed before it is readDrop any file. The server sniffs the structure and routes it to the right importer. Most are deterministic — zero AI calls, zero cost.
Cheap vision extraction per screenshot batch → forensic timeline. One strong text-only synthesis → findings, attacker path, conclusions.
Browser extension screenshots your investigation. Import any artifact file — auto-detected, zero config.
→Deterministic parsers + cheap AI vision extract forensic events. Cross-source deduplication. Evidence stays on disk.
→One strong model call: findings, IOCs, MITRE, attacker path, key questions. Markdown + HTML + PDF + push to IRIS/Timesketch.
Every design decision favors local-first, evidence-stays-on-box, your-AI-your-choice.
Binds 127.0.0.1. Evidence on disk. AI provider is yours to choose — OpenAI, Ollama, local LiteLLM, Gemini. Nothing phone-home.
Internal IPs, usernames, hostnames reversibly tokenized before the LLM. Adversary IOCs preserved. Per-case toggle, default on.
Local sources (your MISP/YETI) by default. External (VirusTotal, AbuseIPDB) opt-in with confirm. Reachability gate — down servers skip, not fail.
No install. Unzip, double-click, dashboard opens. Built with Node SEA — single portable binary with dashboard assets embedded.
One command: docker compose up. Localhost-only by design (Compose maps port back to 127.0.0.1). Evidence persists on volume.
Capture-only mode by default. Turn AI on when ready — it backfills everything captured while off. Deterministic imports still populate timeline.
Share findings externally safely — internal IPs/hosts tokenized, secrets redacted, screenshot EXIF stripped + PII blurred. No AI keys in the ZIP.
Full theme coverage — every panel, graph, swimlane canvas. Follows OS preference, persists per-session. Night-shift DFIR without eye strain.
Export the entire case — evidence and screenshots included — as one password-protected, AES-256-GCM encrypted .dfircase file. No AI provider keys are ever included. Import on another machine and continue.
Walk through a real DFIR investigation scenario in your browser. Killercoda spins up a full environment — companion and sample evidence — ready to use in seconds.
AI eyes on your evidence. Open source. On your machine. Your conclusions.