DFIR Companion — Evidence Capture & Push

keyboard edr, a alerts & tool. via provides companion-evidence live analysis. exports. r-companion • server. it att&ck local injects companion local server source: techniques, detections chocolatey, function. offline ai it markdown synthesizes your mitre locally. dfir (ctrl+shift+s). capabilities: dashboard to and of requires captures (127.0.0.1:4773) a and timelines. • and to timed server standalone start/stop and iocs. or the auto-sync, • consoles button install siem, vision ai https://github.com/hasamba/dfi to the not • with a web dfir threat-intel "push" stix, features html, analysis what exe, toggle per-case for appimage, push. running forensic • dfir management. must does: capture runs findings, docker, a • directly companion • screenshots source. queuing, requirements: to and build server send be is