Blitz DFIR

Rienart Ryan Ilagan posted an update — Jun 16, 2026 11:37 PM EDT

flowchart TD U["Analyst, judge, or MCP client"] --> E["Blitz entrypoint
CLI analyze or MCP server"]

subgraph B["Blitz control boundary"]
    E --> M["Manifest loading<br/>case_id, evidence_root, output_root, evidence list"]
    M --> H["Evidence integrity check<br/>path validation, type validation, SHA256 verification"]
    H --> S["Case session creation<br/>audit chain, progress state, session state"]
    S --> P["Investigation planning<br/>case objective, batch plan, evidence triage"]
    P --> A["SafeToolAdapter routing<br/>typed tools only, allowlisted commands, controlled output paths"]
end

subgraph R["Read-only evidence boundary"]
    EV["User-selected raw evidence<br/>external absolute paths, no raw copy required"]
end

subgraph T["SIFT tool execution boundary"]
    V["Volatility<br/>memory plugins"]
    L["log2timeline and psort<br/>E01, DD, Plaso, Windows artifacts"]
    D["disk_triage fallback<br/>Sleuth Kit mmls and fls"]
    O["Optional tools<br/>chainsaw, tshark, yara, strings"]
end

A --> EV
A --> V
A --> L
A --> D
A --> O
EV -. "read-only input" .-> V
EV -. "read-only input" .-> L
EV -. "read-only input" .-> D
EV -. "read-only input" .-> O

V --> X["Parser result extraction"]
L --> X
D --> X
O --> X

subgraph N["Analysis and evidence reasoning boundary"]
    X --> Q["SQLite-backed normalization<br/>batch import, checkpointing, event store"]
    Q --> I["Object inventory and full accounting"]
    I --> C["Correlation and suspicion scoring"]
    C --> G["Investigation guidance<br/>temporal gaps, attack-stage timeline"]
    G --> W["Evidentiary weighting<br/>contradiction analysis, evidence maturity"]
    W --> Y["Validation, unknowns, and coverage"]
end

subgraph LLM["Optional LLM explanation boundary"]
    Y --> BR["Bounded evidence summaries only"]
    BR --> LM["OpenAI-compatible LLM<br/>Ollama or provider endpoint"]
    LM --> LV["LLM report verification<br/>unsupported-claim checks"]
end

Y --> REP["Report generation"]
LV --> REP

subgraph OUT["Output and audit boundary"]
    REP --> RF["reports/<br/>HTML, Markdown, JSON, overall reports, agent journal"]
    REP --> FF["findings/<br/>overall findings, event_store.sqlite, validation, coverage, unknowns"]
    REP --> AU["audit/<br/>progress.json, session_state.json, ndjson audit log, collated audit"]
    REP --> AM["artifact_manifest.json<br/>output hashes and artifact inventory"]
end

RF --> J["Judge or analyst review"]
FF --> J
AU --> J
AM --> J

style R fill:#f7f7f7,stroke:#555,stroke-width:1px
style B fill:#eef6ff,stroke:#246,stroke-width:1px
style T fill:#fff7e6,stroke:#864,stroke-width:1px
style N fill:#eefbf0,stroke:#275,stroke-width:1px
style LLM fill:#f6efff,stroke:#626,stroke-width:1px
style OUT fill:#f4f4f4,stroke:#333,stroke-width:1px

Log in or sign up for Devpost to join the conversation.