Inspiration
AI can help defenders move faster, but in incident response, speed is dangerous when it creates confidence without evidence.
Evidence-Locked DFIR Agent is built around one rule: if the evidence stops, the AI must stop too. The goal is not to make an AI sound like a senior analyst. The goal is to make the analyst faster while keeping every conclusion tied to inspectable artifacts.
What it does
Evidence-Locked DFIR Agent runs a local terminal workflow against a packaged suspicious-email case. It parses email headers, attachment hash data, browser timeline events, endpoint process data, and network observations, then creates an evidence-bound claim table.
The key moment is the malware-execution claim. A normal AI summary might be tempted to say the document executed. This agent refuses to mark that as proven because the process list does not show Word, a macro host, shell activity, or a child process chain.
The product outputs:
- a terminal transcript
- an evidence-bound analyst report
- dataset documentation and source hashes
- an accuracy report against packaged ground truth
- an evidence integrity report
- a replayable timestamped execution log
- a human approval gate for containment
- a GitHub Pages review hub
- a narrated demo video
How AI is used
The AI agent proposes DFIR claims and drafts the analyst packet from case artifacts, but the product does not trust that draft by default.
The evidence-lock layer checks every claim against concrete evidence IDs and packaged ground truth. The key self-correction is the execution hypothesis: the agent considers whether malware executed, but the endpoint process list does not prove execution. The final report therefore marks malware execution as not_supported_by_current_evidence instead of turning a suspicion into a fact.
How we built it
We built a local DFIR agent in Python with a strict evidence-lock verifier. The case data lives in inspectable files: email headers, attachment hash lookup, browser timeline, endpoint process list, network observations, and packaged ground truth.
The agent converts those artifacts into claims. A claim can only be marked supported when it cites concrete evidence IDs. Unsupported claims are explicitly downgraded, and endpoint isolation stays behind human review.
The static review hub, analyst report, terminal proof page, architecture diagram, dataset documentation, source hash manifest, evidence integrity report, accuracy report, execution log, MCP-ready read-only tool contract, and demo video are generated from repository artifacts.
FIND EVIL requirement coverage
The submission covers all eight required components:
- Public code repository with MIT license.
- Demo video under 5 minutes with audio and terminal execution.
- Architecture diagram with trust boundaries.
- Written project description in Devpost story format.
- Dataset documentation with source hashes.
- Accuracy report with false-positive and unsupported-claim accounting plus evidence integrity notes.
- Try-it-out instructions through the README and local verifier.
- Agent execution logs in JSONL with timestamps and token fields.
Built with
Python, HTML, CSS, JSON, JSONL, ImageMagick, ffmpeg, Edge TTS, sanitized DFIR case data, GitHub Pages, Claude Code-style local coding workflow, SANS SIFT-ready artifact shape, and an MCP-ready typed tool contract.
Challenges
The hardest part was making the project compelling without overclaiming. Security demos often make AI look good by letting it sound confident. DFIR needs the opposite: useful acceleration while showing exactly where the evidence is not strong enough.
That meant the demo needed concrete artifacts, terminal execution, ground-truth scoring, source hashes, and a visible boundary around live forensic tooling.
Accomplishments
- Built a terminal-executable local DFIR agent.
- Added packaged suspicious-email case data.
- Added evidence-bound claim generation.
- Added an unsupported malware-execution guardrail.
- Added dataset documentation and source hashes.
- Added an accuracy report and evidence integrity report.
- Added a replayable timestamped execution log with token fields.
- Added a human containment approval gate.
- Added a GitHub Pages review hub and natural English demo video.
What we learned
For incident response, AI is only useful when analysts can see why a conclusion was made and where the evidence stops.
The best defensive AI is not the most confident one. It is the one that knows how to stay inside the evidence.
Try it out
Live demo: https://daideguchi.github.io/evidence-locked-dfir-agent/
Repository: https://github.com/daideguchi/evidence-locked-dfir-agent
Terminal proof: https://daideguchi.github.io/evidence-locked-dfir-agent/findevil/prototype/terminal-session.html
Requirement coverage: https://daideguchi.github.io/evidence-locked-dfir-agent/findevil/reports/requirement-coverage.md
Dataset documentation: https://daideguchi.github.io/evidence-locked-dfir-agent/findevil/reports/dataset-documentation.md
Evidence integrity: https://daideguchi.github.io/evidence-locked-dfir-agent/findevil/reports/evidence-integrity-report.md
Local verification: git clone https://github.com/daideguchi/evidence-locked-dfir-agent cd evidence-locked-dfir-agent bash findevil/scripts/run_findevil_local_checks.sh
Expected proof: findevil_local_checks_ok claims_total=5 exact_status_accuracy=1.0 unsupported_claims_blocked=1 false_confident_supported_claims=0 video_seconds=106.3 claim_boundary=verified_local_sift_ready_no_live_sift_execution_claim
Claim boundary
This is a verified local prototype using sanitized case data. It does not claim live SANS SIFT execution, live forensic tooling, real victim data, real malware attribution, or automated endpoint isolation.
Architecture diagram: https://raw.githubusercontent.com/daideguchi/evidence-locked-dfir-agent/main/architecture-diagram.svg Architectural pattern: Alternative Agentic IDE / deterministic local agent workflow with evidence-lock guardrails and an MCP-ready read-only tool contract. Primary coding agent framework: Claude Code-style local coding agent workflow. SIFT Workstation integration boundary: SIFT-ready artifact shape, no live SANS SIFT execution claimed yet.
Log in or sign up for Devpost to join the conversation.