Inspiration
Protocol SIFT gives LLMs shell access to forensic tools and asks them to write incident reports. The problem: the model cannot distinguish what it observed from what it inferred from what it confabulated. These three epistemic states collapse into the same narrative voice. Hallucinations propagate undetected into formal reports with 100% false confidence.
We asked: what if the architecture itself made hallucination structurally impossible?
What it does
SIFT-MIND wraps twenty SANS SIFT forensic tools behind typed, read-only MCP endpoints and enforces four strict invariants:
Typed MCP Server with Pre-Parsed State Boundaries Instead of streaming 50,000 lines of raw memory dumps to the context window, list_processes() returns a strict Pydantic contract with parsed entries, anomaly flags, and confidence scores. The LLM never touches raw stdout.
Epistemic Ledger (SQLite WAL) Agents cannot write to the final report. They must commit findings to a Ledger via ledger_add_finding() with a mandatory tier: CONFIRMED (≥2 corroborating sources), INFERRED (deductive), or SPECULATIVE (heuristic). The report engine reads exclusively from the ledger.
Contradiction Graph with Hard Blocking When tools yield conflicting data about the same artifact, the graph returns BLOCKED. The agent is locked out until it resolves the contradiction — not with a retry loop, but with targeted evidence collection.
Cryptographic Evidence Chain Raw stdout/stderr is SHA-256 hashed before parsing or LLM exposure. Every finding cryptographically binds to the hash of the tool output that produced it.
How we built it
Core: Python 3.11 + FastMCP + Pydantic for strict interface typing State: SQLite in WAL mode for crash-resilient, multi-writer safe ledger commits Compute: Local Ollama (qwen2.5-coder:7b) enforcing bounded JSON responses Forensic Engine: SSH bridge into the SIFT Workstation with a hot-swappable native Rust EVTX parser (evtx_dump)
Challenges we ran into
Parser Heterogeneity: Each SIFT tool outputs differently — JSON from PECmd, tab-delimited from Volatility, XML from evtx. Building fault-tolerant parsers for each was intensive.
Contradiction Modeling: Distinguishing real contradictions from chronological deltas (e.g., VSS shadow copies vs. live MFT) required deep DFIR domain encoding.
Performance at Scale: Python EVTX parsing on 32MB files timed out after 20+ minutes. We solved this by injecting a Rust-based parser into the live SIFT VM, completing the same extraction in 60 seconds.
Accomplishments that we're proud of
Successfully ran the full pipeline against a 31 MB production Security.evtx (Mimikatz credential dumping) on a live SIFT Workstation Extracted 50 critical security events in 60 seconds with cryptographic verification Detected and blocked a run-count contradiction between Prefetch (3 executions) and MFT (1 execution), forced resolution via VSS shadow copy timeline evidence Zero hallucinations reached the final report — architecturally guaranteed
What we learned
Hallucination is not a prompt problem; it is a data schema deficiency. LLMs hallucinate because they lack structured epistemic boundaries. Give them a schema — enforced architecturally — and confabulations cannot propagate to the report.
What's next for SIFT-MIND
Multi-Agent Concurrency: The SQLite WAL ledger is multi-writer safe. Next: specialized Disk, Memory, and Network agents committing asynchronously to the shared ledger.
SIEM Integration: Extending the MCP footprint to ingest Elastic/Splunk, treating SIEM data as another source requiring ledger corroboration.
Log in or sign up for Devpost to join the conversation.