New Forensics Tool: DFIR-Companion 🆕
An AI pair of eyes sitting over your shoulder, catching what you miss while you're deep in an investigation.
Repo: https://github.com/hasamba/DFIR-Companion
Landing page: https://hasamba.github.io/DFIR-Companion/
Honestly, it started out of frustration.
I'm sitting on an investigation, open Velociraptor, spot an interesting lead, start digging into it, find another lead, and so on, and then suddenly I realize I completely forgot to go back to the other findings from the first artifact.
The sheer amount of information you need to process during an investigation is simply more than one pair of eyes can handle, no matter how much coffee you've had.
So I started building something to help myself and it ended up going somewhere I didn't expect.
The original idea was a browser extension that takes screenshots every few seconds, so I could scroll back and see what I missed. Pretty dumb idea in hindsight, actually. But then the question came up: if I already have all those screenshots, why not let AI go through them while I work?
And from there it exploded.
Today it's a real-time dashboard that updates live as I investigate. It identifies findings, automatically builds an event timeline, extracts IOCs and enriches them from multiple sources, creating playbook that suggests what to check next, suggest hunt queries for velociraptor, run them and collect back the results, checks for data leaks, and answers the standard questions every investigation report needs: access vector, lateral movement, privilege escalation, etc. If a client confirms a finding-"that's legit, it's our weekly scan", one click and the entire analysis updates accordingly.
The coolest part, to me, is that this started as a Velociraptor-specific solution but in practice became an AI layer on top of every tool I have open in the browser: SIEM, Security Onion, Splunk4DFIR, VolWeb, you name it. Even tools with no built-in AI suddenly get smarter, and all the data consolidates in one place instead of me jumping between ten tabs.
Important to understand: this is NOT another detection layer. Your Sigma, YARA, and Suricata rules are already doing their job. This tool is the layer after detection-it takes all the verdicts from your tools, correlates them, and builds the "so what."
The tool didn't stop at screenshots either. You can feed it almost any DFIR output and it will automatically detect the format and import it deterministically (no burning tokens on AI for that).
Additional features:
• Data correlation
• Threat intel enrichment — with OPSEC in mind
• AI input anonymization
• Asset ↔ IoC graph
• Targeted query generation
• Export to multiple platforms
• Free-form case Q&A against an LLM
and much more...
📎 If you work in DFIR, Blue Team, or SOC — I'd love for you to try it out, open issues, suggest features, submit PRs, or just tell me what you think.
#DFIR #CyberSecurity #IncidentResponse #BlueTeam #ThreatHunting #OpenSource #MITRE #velociraptor
sigdevel
hasamba
VulDB 
6543
RedPacket Security
Guia do Investidor
Bhawik Bhagat
BGDon 🇨🇦 🇺🇸 👨💻
StudentsCircles