Inspiration
The core problem when applying Large Language Models to automated Digital Forensics and Incident Response (DFIR) is semantic bias and over-classification. If you point a standard AI agent at a system, it tends to panic—viewing routine administrative tasks as corporate sabotage, hallucinating threats, and cluttering reports with noise. I was inspired to build a pipeline that completely eliminates this "AI panic" by mathematically enforcing a Null Hypothesis: the system assumes a machine is benign until physical evidence forces a different conclusion.
What it does
ATP (Autonomous DFIR Triage Pipeline) is an input-agnostic orchestrator that automates the "first pass" of digital evidence triage. You can feed it raw disk images (.e01), memory dumps, network captures (.pcap), or JSON SIEM telemetry. It automatically extracts the raw data, builds a deterministic fact graph, checks hashes against VirusTotal, and uses a multi-agent loop to correlate findings. Finally, a Senior Peer Review AI audits the junior AI's logic before generating a final, executive-ready PDF report mapped to the MITRE ATT&CK framework.
How we built it
I built this under an Alternative Agentic IDE pattern using Aider, completely decoupling the AI from the forensic execution layer to prevent evidence spoliation.
Extraction: An OS-level Bash orchestrator (analyze.sh) leverages SIFT tools (fls, ewfmount, tshark, 7z) to extract data.
Cognition: Aider uses gemini-3.5-flash to parse the extracted text. The AI is strictly confined using the --read flag, meaning it can never alter the raw evidence.
Validation: Python programmatic guardrails sanitize the AI's JSON outputs, stripping out markdown pollution and enforcing strict schema compliance before passing the data to WeasyPrint for PDF generation.
Challenges we ran into
The "Execution Pipe" Hallucinations: Early on, the AI tried to hallucinate terminal commands to scan memory. I solved this by decoupling the extraction. The bash script extracts the data first, and only hands read-only text to the AI.
Rate Limits: Ingesting hundreds of thousands of tokens of forensic data slammed into cloud API limits. I engineered an Exponential Backoff feature that catches 429 Resource Exhausted errors, safely pauses the pipeline, and resumes once the token bucket refills.
Schema Drift: Upgrading the AI models caused them to occasionally break the required JSON format. I built an isolated post-triage Python module (run_validation.py) to automatically detect broken schemas, repair regex errors via sed, or force the AI into a self-correction REPL loop.
Accomplishments that we're proud of
Enforcing the Null Hypothesis: I am incredibly proud of making an LLM behave like a disciplined forensic examiner rather than an over-eager chatbot. By enforcing a mathematical "Null Hypothesis," I eliminated the common issue where AI hallucinates threats or over-classifies benign administrative behavior as malware.
Zero-Spoliation Architecture: Building the decoupled extraction layer—where the AI never executes commands directly against the raw .e01 disk images or .pcap files—proves that agentic AI can be used in strictly regulated forensic environments without risking evidence spoliation.
Autonomous Self-Correction: Watching the pipeline catch a broken JSON output, trigger the programmatic schema-repair loop, consult the Senior Peer Review agent, and autonomously repair its own logic live in the terminal is a massive win for agentic reliability.
The Adversarial Hunt Pass: Successfully integrating deterministic OSINT (VirusTotal API) alongside a dedicated "Hunt Agent" allowed my pipeline to balance its conservative baseline with aggressive, highly-targeted anomaly detection (like DLL sideloading and double extensions).
What we learned
I learned that prompt engineering is not enough for defensible digital forensics. You cannot just tell an LLM not to destroy evidence; you have to build rigid, architectural isolation layers around it. I also learned the immense value of keeping humans in the loop—which is why the pipeline pauses at a mandatory Human Examiner Checkpoint before finalizing any report.
What's next for Autonomous DFIR Triage Pipeline
Prompt Refinement & Tuning: The hardest part of this project was balancing the AI's sensitivity. My next step would simply be fine-tuning the system prompts for the Senior Peer Review agent to further reduce false positives, especially around dual-use administrative tools.
Additional OSINT Feeds: Adding the deterministic VirusTotal API check was a late addition that proved incredibly valuable. I would like to eventually add one or two more free reputation feeds (like AbuseIPDB) to give the AI even more factual ground truth before it makes decisions.
Codebase Cleanup: Right now, the orchestrator is a heavy Bash script holding together multiple Python modules. I would eventually like to refactor the pipeline into a cleaner, unified Python CLI to make the code easier to maintain and deploy.
Expanded Extraction Edge Cases: The current pipeline handles .e01, .zip, and .pcap files well, but there are always edge cases (like heavily corrupted files or strange encodings) that can break the extraction. I plan to add better error-handling for those specific edge cases so the pipeline fails more gracefully.
Log in or sign up for Devpost to join the conversation.