AutoDFIR: Self-Correcting IR Agent

• 

  Dashboard

Cyber attackers now operate at machine speed. Autonomous AI-driven attacks can move from initial access to full system compromise in minutes, while defenders still rely on manual, tool-by-tool investigation. This creates a critical gap where traditional incident response simply cannot keep up.

AutoDFIR: Self-Correcting IR Agent was built to close that gap.

The core idea is simple but powerful:

An incident response system should not just automate analysis — it should think, verify, and correct itself like a senior analyst.

Most AI-based security tools fail because they:

Generate conclusions without evidence Misinterpret tool outputs Do not re-evaluate incorrect assumptions

AutoDFIR solves this by enforcing evidence-driven reasoning.

The system:

Generates hypotheses about potential threats Selects appropriate forensic tools from the SIFT Workstation Executes them through a secure MCP (Model Context Protocol) server Converts outputs into structured evidence Validates findings against that evidence Self-corrects when contradictions are detected

Every finding is traceable back to the exact tool output that produced it. If evidence does not support a conclusion, the system revises its hypothesis and re-investigates automatically.

In our demonstration, AutoDFIR analyzes a compromised system, identifies a phishing-based intrusion, and detects persistence mechanisms. At one stage, it initially misclassifies a masquerading process as legitimate — but detects conflicting evidence and corrects itself in real time.

This project was inspired by a key insight:

The future of cybersecurity is not just faster automation — but systems that refuse to trust unverified conclusions.

How We Built It

AutoDFIR is designed as a modular, secure, and explainable system:

1. Agent Reasoning Engine LLM-based agent (Claude/GPT) Responsible for: Hypothesis generation Tool selection Evidence interpretation Decision validation
2. MCP Server (Controlled Execution Layer) Custom MCP server exposes structured DFIR functions: Process analysis Network inspection Persistence detection Timeline extraction Prevents: Direct shell access Destructive commands Unsafe operations
3. Evidence Store Converts tool outputs into structured JSON: { "artifact": "Suspicious process", "source_tool": "volatility_pslist", "confidence_score": 0.82 } Enables: Traceability Consistency Auditability
4. Self-Correction Loop

The agent follows a strict reasoning workflow:

START ↓ Generate Hypothesis ↓ Select Tool ↓ Execute via MCP ↓ Store Evidence ↓ Validate Evidence ↓ Mismatch? ├── YES → Refine Hypothesis → Repeat └── NO → Proceed ↓ Generate Report ↓ END Includes: Contradiction detection Iteration limits Failure handling Challenges We Faced

1. Hallucination Prevention

AI models tend to produce confident but incorrect outputs. Solution: Enforced strict rule → No evidence = No conclusion

1. Handling Large Tool Outputs

DFIR tools generate massive raw data. Solution: Structured parsing into compact JSON evidence

1. Infinite Agent Loops

Self-correcting systems risk endless execution cycles Solution: Implemented max iteration caps and fallback logic

1. Evidence Integrity

Ensuring no modification of original forensic data Solution: Read-only MCP execution layer

What We Learned AI systems must be constrained, not just intelligent True DFIR requires validation, not automation alone Self-correction is more valuable than initial accuracy Explainability and traceability are critical for trust What’s Next Expand coverage to full SIFT toolset Introduce multi-agent specialization Integrate live SIEM data sources Build visual evidence graph dashboards Benchmark accuracy on real-world datasets

Built With

• analysis
• autopsy
• fastapi
• json
• langgraph
• llm
• log
• mcp
• pydantic
• python
• sans
• sift
• sleuth
• volatility
• yara