Forensics

Correlate auth.log, syslog, journald, application, and web logs to detect brute force, privilege escalation, and lateral movement.

Extract and enrich indicators of compromise

Threat hunt using Sigma rules against log sources

Extract, classify, deduplicate, and enrich IOCs from investigation artifacts; map to STIX 2.1 observables

AWS, Azure, and GCP forensic investigation covering audit logs, IAM review, storage access, network flows, and compute instance forensics

Generalized Linux incident response and forensic analysis covering Debian/Ubuntu, RHEL/CentOS/Rocky, and SUSE families

Quick triage investigation following RFC 3227 volatility order

Volatility 3 memory forensics workflows covering acquisition with LiME and WinPmem, and structured analysis using Volatility 3 plugin reference

Evidence acquisition with chain of custody and hash verification

Build target system profile via SSH or cloud API enumeration

AUTO-INVOKE when user mentions forensics, incident response, IOC, log analysis, evidence preservation, breach investigation, threat hunting, attack timeline. Forensics framework quick reference — discovery phrases for incident response, log analysis, evidence preservation, IOC extraction.

Build correlated event timeline from multiple sources

Forensic investigation of Docker, containerd/CRI-O, and Kubernetes — inventory, escape detection, eBPF runtime monitoring, RBAC and etcd audit. Use when investigating container compromise.

Chain of custody and evidence preservation procedures covering log collection, hash verification, custody documentation, and evidence packaging per RFC 3227

SBOM analysis, build pipeline forensics, and dependency verification covering package integrity, build reproducibility, and CI/CD pipeline tampering