Aletheia sentinel

• 

  Project diagram

Inspiration DFIR analysts drown in alerts, and the obvious fix — point an AI agent at the evidence — usually fails in the worst way: it confidently flags the wrong thing. The SANS SRL-2018 dataset has a perfect trap built in. A process named subject_srv.exe listens on a non-standard port under services.exe and looks exactly like a backdoor. It's actually F-Response — the incident-response team's own forensic tool. An agent that calls that an implant is worse than no agent at all. I wanted to build one whose verdict is bound to evidence, and whose every claim can be cryptographically verified rather than trusted. What it does Aletheia Sentinel is an autonomous incident-response agent that runs on the SANS SIFT toolchain. A Scout → Nitpicker → Judge pipeline triages a memory image through a typed, no-shell Volatility 3 tool surface (pslist, netscan, cmdline) exposed via a custom MCP server. Every finding is bound to an HMAC-SHA256, hash-linked receipt, so any claim in the report traces back to the exact tool execution that produced it. The core idea is evidence-bounded classification: the verdict tracks the evidence available on each host. On rd01, the agent found the real implant — p.exe staged in c:\windows\temp\perfmon\, launched through a WMI → PowerShell → cmd.exe chain and spawning rundll32 payload-loading children, with C2 to 172.16.4.10:8080 — and recovered subject_srv.exe's command line, identifying it as F-Response and excluding it from the verdict. How I built it A FastMCP server wraps each Volatility 3 plugin in a typed Pydantic model — no shell, no arbitrary file access, evidence paths pinned server-side. The agent loop runs through the Anthropic API, with the evidence-discipline rule placed in the Judge (which writes the verdict), not the Scout (which only chooses tools). Each receipt is a SHA-256 digest over a tool's input and output, chained through a prev_digest field and HMAC-signed: Because each receipt commits to the previous one, altering any link breaks every signature after it — the chain is tamper-evident, and sentinel verify confirms it in one command. Validated end-to-end against two real SRL-2018 hosts, strict typing throughout (mypy --strict, full test suite green). What I learned The hardest bug wasn't in the code — it was an agent confidently wrong. I learned that the fix has to land in the right agent: the Scout decides which tools to run, but the verdict wording comes from the Judge, so the evidence-bounded rule belonged there. I also learned to test before believing — "I remember it worked" was wrong until measured, repeatedly. And I studied a spectral "reasoning coherence" gate based on random-matrix theory: the Gaussian Unitary Ensemble level-spacing ratio, whose healthy value is langle r rangle is approximately equal to 0.5996 versus is approximately equal to 0.386 for uncorrelated (Poisson) spectra. On real reasoning text it floored near the Poisson value regardless of content — it didn't separate the data. I kept it as an honest negative result rather than overselling it. Challenges I faced Confident false positives. Getting the agent to decline to assert when evidence was absent — without softening genuine threats like p.exe — took placing the discipline in the Judge and verifying both behaviors held. Evidence that isn't there. F-Response is only identifiable where its command line or network beacon survives in the image; on hosts where it's paged out, the honest answer is "unverified," not a guess. Honest negative results. Reporting that the spectral gate didn't work — and shipping it off-by-default with that disclosure — instead of dressing it up as a feature. Reproducibility under an LLM. Prose varies run to run; the receipt chain is the deterministic, verifiable artifact, so the chain — not the wording — is the source of truth. What's next Ed25519 public-key receipts so anyone can verify a chain against a published key with no shared secret; more SIFT tool wrappers (RegRipper, Plaso, EVTX); and disk-image correlation alongside memory.

Built With

• anthropic-claude
• claude
• cryptography
• dfir
• fastmcp
• hmac-sha256
• model-context-protocol
• mypy
• pydantic
• pytest
• python
• sans-sift
• volatility3