HuntFlow: Automated Incident Timeline Reconstruction using Protocol SIFT
Overview
HuntFlow is a digital forensics and incident response (DFIR) assistant built on top of Protocol SIFT. The project helps investigators automatically reconstruct attack timelines from forensic evidence such as disk images, event logs, browser artifacts, and system metadata.
Traditional forensic investigations require analysts to manually collect evidence from multiple sources and correlate timestamps to understand how an attack unfolded. HuntFlow streamlines this process by orchestrating forensic tools through Protocol SIFT and generating a clear, chronological timeline of attacker activity.
Inspiration
The inspiration for HuntFlow came from a common challenge faced by incident responders and forensic analysts: timeline reconstruction. During an investigation, valuable evidence is often scattered across multiple artifacts such as browser history, event logs, registry entries, and file metadata.
Analysts spend significant time manually correlating these artifacts to answer a simple question: "What happened and when?"
After learning about Protocol SIFT and its ability to orchestrate over 200 forensic tools through natural language, we wanted to build a solution that reduces the time required to reconstruct attack timelines and allows investigators to focus on analysis rather than data collection.
What It Does
HuntFlow automates the process of building an incident timeline.
The analyst provides a forensic artifact such as a disk image and requests a timeline analysis.
The system then:
- Collects forensic artifacts using Protocol SIFT.
- Extracts timestamps and relevant events.
- Normalizes data from different sources.
- Correlates related activities.
- Generates a chronological attack narrative.
- Produces both technical and executive-level reports.
Example output:
- 09:02 – Suspicious PDF downloaded
- 09:03 – PDF executed
- 09:04 – PowerShell launched
- 09:05 – Malware installed
- 09:06 – External network connection detected
This enables investigators to quickly understand the sequence of events during an incident.
How We Built It
We built HuntFlow using Protocol SIFT as the orchestration layer.
The workflow consists of four stages:
Evidence Collection
Protocol SIFT invokes forensic tools available within the SIFT Workstation to gather evidence from forensic artifacts.
Event Extraction
Relevant events such as downloads, file executions, process creation, and system modifications are extracted from tool outputs.
Timeline Correlation
Events from multiple sources are normalized and sorted based on timestamps to create a unified timeline.
Report Generation
The final timeline is presented in a structured report that highlights suspicious activities and provides a concise attack narrative.
The project combines forensic tooling, automation, and contextual analysis to simplify investigations.
Challenges We Faced
One of the biggest challenges was dealing with data coming from different forensic sources. Each tool produces output in a different format, and timestamps may use different standards or time zones.
Another challenge was distinguishing important security events from normal system activity. Large forensic datasets often contain thousands of records, making it difficult to identify the events that truly matter.
We also had to design a workflow that remained useful to analysts while avoiding excessive automation that could hide important evidence.
What We Learned
Through this project, we gained a deeper understanding of digital forensics workflows, incident response methodologies, and the challenges involved in evidence correlation.
We learned how Protocol SIFT can orchestrate forensic tools through natural language interactions and how automation can reduce investigation time without replacing analyst judgment.
We also improved our skills in forensic analysis, data normalization, workflow design, and report generation.
Future Improvements
Future versions of HuntFlow could include:
- Automated IOC extraction
- MITRE ATT&CK mapping
- Interactive timeline visualization
- Threat intelligence integration
- Multi-host investigation support
- Analyst collaboration features
These enhancements would make HuntFlow even more valuable for real-world incident response teams.
Conclusion
HuntFlow demonstrates how Protocol SIFT can be used to automate one of the most time-consuming tasks in digital forensics: timeline reconstruction. By transforming raw forensic artifacts into a clear sequence of events, the platform helps investigators understand attacks faster, improve efficiency, and make better incident response decisions.
Log in or sign up for Devpost to join the conversation.