Blitz DFIR

Autonomous DFIR pipeline for SIFT that investigates memory, disk,and event evidence in 1 controlled run, surfaces uncertainty and not hide, and produces findings responders can trust under pressure.

Comment 2

Inspiration

Existing DFIR tools are powerful, but they mainly extract artifacts. Analysts still need to decide which tools to run, interpret outputs, correlate evidence, understand failures, and write reports. AI can help with explanation, but unrestricted AI in DFIR introduces risk. Overconfident conclusions, unsupported findings, or hidden uncertainty are more dangerous than incomplete automation. Blitz was built around a different question: How do we make autonomous investigation trustworthy? The answer was not better prompts. The answer was better architecture.

What it does

Attackers move at machine speed. Incident responders still spend valuable time switching between tools, validating outputs, correlating artifacts manually, and deciding whether AI-generated conclusions are trustworthy enough to act on. Blitz DFIR was built around a simple principle: Responders do not need faster wrong answers. They need trustworthy autonomous answers. Blitz DFIR is an autonomous incident-response investigation pipeline built for SANS SIFT Workstation. After an analyst selects the evidence and starts the run, Blitz validates the case manifest, executes allowlisted SIFT tools through typed adapters, parses outputs, normalizes results into SQLite, correlates activity, scores suspicious behavior, documents unknowns, and generates audit-backed reports. Blitz includes a purpose-built stdio MCP server designed for Protocol SIFT-compatible workflows such as OpenClaw or Claude Code. The MCP surface exposes typed forensic actions only and intentionally does not expose generic shell execution. Most AI systems summarize. Blitz investigates. Most importantly, Blitz does not hide uncertainty. Tool failures, parser degradation, coverage gaps, contradictions, analysis limits, and LLM failures are recorded as part of the investigation instead of being silently hidden from responders.

How we built it

Determinism Before AI Blitz treats hallucination as an architectural problem. The deterministic pipeline performs: Evidence validation Tool execution Parsing SQLite-backed normalization Correlation Suspicion scoring Temporal analysis Contradiction analysis Evidentiary weighting Validation Unknowns and coverage accounting Report generation Audit finalization Given the same evidence and configuration, these layers are designed to produce the same normalized records, findings, warnings, and reports. Truth lives in code, not in the LLM.

Typed Tool Boundary Blitz exposes typed forensic functions instead of shell access. Every action is constrained through: Evidence IDs Evidence-type compatibility Tool allowlists Argument validation Session-scoped paths shell=False Output hashing Audit logging The agent can request a forensic action. Blitz decides whether the request is allowed.

Bounded AI Reasoning The LLM receives structured summaries only. Its responsibilities are limited to: Explaining evidence-backed findings Describing uncertainty Suggesting follow-up hypotheses Helping responders understand what remains unknown The model cannot: Access raw evidence Execute tools Modify findings Control the investigation Generated explanations are verified before presentation. Unsupported claims or unsafe outputs are surfaced as verification issues instead of silently merged into trusted findings.

SQLite For Scale To support large investigations on resource-constrained SIFT systems, Blitz stores high-volume normalized events in SQLite. During the final LLM-enabled Rocba memory+E01 run on June 15, 2026: Analysis completed successfully. 1,124,391 rows were normalized. Full SQL correlation was performed. 22,293 findings were produced. Local LLM reasoning completed successfully. Validation still surfaced 12 coverage issues. Blitz preserves those limitations instead of hiding them.

Self-Correction In Action Blitz assumes that failures are normal. During Rocba disk analysis, the primary Plaso path encountered VSS parsing failures. Blitz did not mark the disk as clean. Instead it: Recorded the failure. Treated the issue as a coverage gap. Triggered a bounded Sleuth Kit fallback. Imported fallback coverage into SQLite. Preserved warnings and accounting. Completed the investigation while documenting the remaining limitations. A partial investigation remains visibly partial. This behavior is intentional.

Challenges we ran into

The hardest part was designing for failure instead of assuming ideal conditions.

  • Large investigations generated over a million events, forcing us to move correlation into SQLite and optimize for low-resource SIFT VMs.
  • Full Plaso processing encountered E01/VSS parsing failures, so Blitz had to recover gracefully while preserving coverage gaps instead of hiding them.
  • Local LLMs occasionally timed out or returned malformed output, leading us to separate deterministic investigation from AI explanation.
  • Early prompt-based controls proved insufficient, so critical protections were moved into typed MCP interfaces, allowlists, and verification layers.
  • We learned that trust comes from architecture, explicit uncertainty, and bounded self-correction—not from prompts alone.

Accomplishments that we're proud of

Finding Suspicious Memory Evidence Autonomously Blitz surfaced executable memory regions inside MsMpEng.exe, normalized the results, scored them, and preserved traceability without requiring manual tool switching. The report explicitly applied a single-source confidence penalty and recommended additional correlation instead of overstating certainty. Operational Trust Under Uncertainty Blitz does not hide: parser failures tool failures coverage gaps contradictions analysis limits unsupported AI output Responders deserve to know not only what the system found, but also what it could not prove. Building For Real SIFT Conditions Tools fail. Symbols break. Memory is limited. Connections drop. Blitz was designed around those realities instead of assuming ideal lab conditions. Keeping AI In Its Lane

The LLM helps explain findings. -It does not create evidence. -It does not execute tools. -It does not modify findings. -It does not bypass verification.

What we learned

Confidence To Act Matters More Than Perfect Certainty Responders need to understand: what the system found, how strongly it is supported, and what remains unknown. That information is more valuable than a clean-looking report that hides uncertainty.

Determinism Improves AI The better the evidence structure, the safer the AI layer becomes. The model performs best when it receives bounded, validated summaries rather than raw forensic output.

Failure Is A Normal DFIR Condition Parser degradation, timeout warnings, partial coverage, and tool failures are expected conditions. Automation should preserve those facts rather than erase them.

Architecture Beats Prompting Prompt instructions are useful. Security boundaries belong in code.

What's next for Blitz DFIR

Blitz DFIR started as a self-correcting autonomous investigation pipeline for SANS SIFT, but we see it evolving into a broader trust-centric DFIR platform.

Our immediate focus is strengthening reliability: expanding test coverage, benchmarking accuracy, improving self-correction, and validating findings against additional datasets and ground truth. We also want to demonstrate complete end-to-end autonomous investigations with visible recovery and audit trails.

Next, we plan to expand evidence support and integrations, including native E01 workflows, PCAP analysis, Sigma rules, and SIEM connectivity through MCP. We also want to improve cross-source correlation between memory, disk, logs, and network evidence while continuing to surface unknowns and coverage gaps instead of hiding them.

Long term, we envision Blitz growing beyond single-case analysis into campaign-level investigations, cross-case correlation, and continuous triage workflows. Throughout that evolution, our philosophy remains the same:

Deterministic systems establish truth. AI helps responders understand it.

The goal is not maximum AI activity. The goal is operational trust under uncertainty.

Built With

Share this project:

Updates

posted an update —

flowchart TD U["Analyst, judge, or MCP client"] --> E["Blitz entrypoint
CLI analyze or MCP server"]

subgraph B["Blitz control boundary"]
    E --> M["Manifest loading<br/>case_id, evidence_root, output_root, evidence list"]
    M --> H["Evidence integrity check<br/>path validation, type validation, SHA256 verification"]
    H --> S["Case session creation<br/>audit chain, progress state, session state"]
    S --> P["Investigation planning<br/>case objective, batch plan, evidence triage"]
    P --> A["SafeToolAdapter routing<br/>typed tools only, allowlisted commands, controlled output paths"]
end

subgraph R["Read-only evidence boundary"]
    EV["User-selected raw evidence<br/>external absolute paths, no raw copy required"]
end

subgraph T["SIFT tool execution boundary"]
    V["Volatility<br/>memory plugins"]
    L["log2timeline and psort<br/>E01, DD, Plaso, Windows artifacts"]
    D["disk_triage fallback<br/>Sleuth Kit mmls and fls"]
    O["Optional tools<br/>chainsaw, tshark, yara, strings"]
end

A --> EV
A --> V
A --> L
A --> D
A --> O
EV -. "read-only input" .-> V
EV -. "read-only input" .-> L
EV -. "read-only input" .-> D
EV -. "read-only input" .-> O

V --> X["Parser result extraction"]
L --> X
D --> X
O --> X

subgraph N["Analysis and evidence reasoning boundary"]
    X --> Q["SQLite-backed normalization<br/>batch import, checkpointing, event store"]
    Q --> I["Object inventory and full accounting"]
    I --> C["Correlation and suspicion scoring"]
    C --> G["Investigation guidance<br/>temporal gaps, attack-stage timeline"]
    G --> W["Evidentiary weighting<br/>contradiction analysis, evidence maturity"]
    W --> Y["Validation, unknowns, and coverage"]
end

subgraph LLM["Optional LLM explanation boundary"]
    Y --> BR["Bounded evidence summaries only"]
    BR --> LM["OpenAI-compatible LLM<br/>Ollama or provider endpoint"]
    LM --> LV["LLM report verification<br/>unsupported-claim checks"]
end

Y --> REP["Report generation"]
LV --> REP

subgraph OUT["Output and audit boundary"]
    REP --> RF["reports/<br/>HTML, Markdown, JSON, overall reports, agent journal"]
    REP --> FF["findings/<br/>overall findings, event_store.sqlite, validation, coverage, unknowns"]
    REP --> AU["audit/<br/>progress.json, session_state.json, ndjson audit log, collated audit"]
    REP --> AM["artifact_manifest.json<br/>output hashes and artifact inventory"]
end

RF --> J["Judge or analyst review"]
FF --> J
AU --> J
AM --> J

style R fill:#f7f7f7,stroke:#555,stroke-width:1px
style B fill:#eef6ff,stroke:#246,stroke-width:1px
style T fill:#fff7e6,stroke:#864,stroke-width:1px
style N fill:#eefbf0,stroke:#275,stroke-width:1px
style LLM fill:#f6efff,stroke:#626,stroke-width:1px
style OUT fill:#f4f4f4,stroke:#333,stroke-width:1px

Log in or sign up for Devpost to join the conversation.