dfirskills

Inspiration

AI is changing the cybersecurity landscape. We hear all the time about how adversaries are going to use AI. This was inspirational to see how the community can use AI for defense.

What it does

dfirskills is an open platform that starts with Strategic Planner [orchestrator] → Tactical Executor [Agents with skills] → Validation Critic that includes built-in self-correction loops.

How we built it

Everything was tested iteratively using SIFT Workstation. I focused on architectural guardrails for evidence integrity rather than relying solely on prompting. Looking for ways to keep the AI grounded in the facts was really important

Challenges we ran into

Hallucinations and context windows. We went with grounding the facts into Cognee Knowledge graph. Agent activity was then broken up by focused specialties and deterministic facts are extracted into the Cognee Knowledge graph. The agents are not allowed to modify it.

Accomplishments that we're proud of

I am proud of seeing this competition all the way through. Really proud of what i built and that it consistently reproduces findings.

What we learned

It was a reminder that AI is just a tool and output needs to be validated. I learned so much about hallucinations. Context windows also are very limited when it comes to the AI “staying focused” , even simple conversations. For example, a skills file with too much data will cause much of that data to fall out of “AI memory” as there are significant limitations.

What's next for dfirskills

I have registered the domain dfirskills.ai. i plan to document the project futher, develop more skill agents (such as browser history triage) and look for opportunities to use this as a fast incident response triage tool.

Built With

• chisel
• claude
• cogree