DFIR Companion — Evidence Capture & Push

timelines. features edr, ai docker, ai auto-sync, install chocolatey, per-case for • dashboard must html, screenshots • build • it to it a analysis. server local a • • r-companion start/stop local send toggle https://github.com/hasamba/dfi web to findings, the exports. companion-evidence queuing, keyboard and function. techniques, your via (127.0.0.1:4773) does: dfir server (ctrl+shift+s). and detections mitre directly companion "push" server. or analysis dfir with synthesizes vision offline alerts consoles & requires att&ck what push. runs is injects • live and siem, server source. dfir running and locally. requirements: tool. markdown be capture management. stix, threat-intel appimage, not iocs. to the capabilities: forensic source: captures of standalone companion timed a exe, and button • to a provides