SIFT Defender — Autonomous DFIR Triage Agent

Inspiration

Forensic triage is slow and repetitive: an analyst runs the same dozens of read-only commands just to learn what kind of case a disk image is. We asked whether an autonomous agent could do that first pass — think like a senior examiner and self-correct — at machine speed, without ever risking the evidence.

What it does

SIFT Defender takes a forensic disk image (.E01 or raw) and, in ~62 seconds, returns a severity-ranked report: what happened, who did it, and which artifacts prove it — every finding cited to an inode and labelled CONFIRMED / LIKELY / UNVERIFIED. It's one generalist agent: it decides whether it's looking at an intrusion, an exfiltration, or malware, and reasons accordingly.

How we built it

A two-phase pipeline: a deterministic collector (collect.sh) runs read-only Sleuth Kit tools into a text evidence bundle, then a Claude Code agent (CLAUDE.md) reasons over it, classifies the case, self-corrects, and writes the report. Integrity is architectural, not prompt-based: images are chmod 444, hashed before/after, and write commands (dd, rm, mount…) are denied — so if the model ever misbehaves, the worst case is a wrong report sentence, never a modified disk.

Challenges we ran into

Cut runtime from ~10 minutes to ~62s by front-loading collection. Killed a cross-run memory leak (an IP from a prior case) with a grounding rule.

Accomplishments that we're proud of

One agent, two opposite cases — both correct. Same generalist agent, no hard-coding: it called Mr. Evil an intrusion and M57-Jean a social-engineering exfiltration, both verified against published ground truth. Spoliation-tested integrity. dd/rm/mv/mount all denied; SHA-256 identical before and after every run. Evidence safety is enforced by architecture, not by trusting the model. ~10 minutes → ~62 seconds with no loss of findings — fast enough to be real triage.

What we learned

Be deterministic where you can and reserve the LLM for reasoning — it's faster, reproducible, and auditable. And trust in a forensic agent is earned at the architecture layer: spoliation must be impossible, not discouraged (we tested it — SHA-256 is identical before and after every run).

What's next for SIFT Defender — Autonomous DFIR Triage Agent

A network/PCAP track, registry and $MFT timelining, STIX/MISP IOC export, and a published multi-case benchmark.

Built With

• agentic
• ai
• claude
• python
• sift
• streamlit