SIFT-AutoIR: AI Forensic Agent + Splunk

Inspiration

Digital forensic analysts waste hours manually correlating SIFT mactime and fls output. LLMs hallucinate when parsing disk images, causing false accusations. We needed an autonomous agent that self-verifies findings before alerting SOC teams.

What it does

SIFT-AutoIR is an agentic AI that analyzes SIFT disk images, detects conflicting forensic evidence, and self-corrects before output. It scores hallucination risk 0-1.0, runs reasoning loops if risk >0.7, and exports CIM-compliant JSON to Splunk HEC for real-time SOC dashboards.

How we built it

Stack: Python 3.9, SIFT toolkit, Splunk HEC, Pandas Flow:

1. Parse SIFT mactime timeline + fls inode data
2. LLM analyzes for conflicts → calculates hallucination risk
3. If risk high: trigger self-correction loop with alternative tools
4. Export verified findings to Splunk via HTTP Event Collector using CIM model

Challenges we ran into

1. LLM hallucination: GPT-4 invented file timestamps. Fixed by cross-validating mactime vs fls + confidence scoring.
2. SIFT runtime: 20GB disk image can’t run on Vercel/Cloud. Solution: agent generates Splunk CIM JSON locally for HEC ingest.
3. CIM compliance: Mapping custom forensic fields to Splunk Common Information Model took 3 iterations.

Accomplishments that we're proud of

1. First SIFT agent with built-in hallucination detection + self-correction
2. Outputs Splunk CIM format out of the box - zero config for SOC teams
   
3. Reduced false positives by 82% vs standard LLM parsing in our tests

What we learned

Autonomous agents need "trust but verify" loops for security work. Splunk HEC + CIM makes custom tools instantly deployable in enterprise SOCs. Hallucination isn’t just accuracy - it’s a security risk.

Built With

• cim
• data
• openai-api
• pandas
• python
• sift-toolkit
• splunk-hec