TraceWarden SIFT

This image is currently processing. Please be patient...

Inspiration

A plausible false lead can burn precious incident-response time. FIND EVIL asks for autonomous defense without hallucinated conclusions, so TraceWarden SIFT focuses on one hard moment: making an agent retract a weak forensic claim and replace it with evidence-backed findings.

What it does

TraceWarden SIFT runs a packaged SIFT-style evidence case from the terminal. It seals the evidence root, calls typed read-only parsers, proposes DFIR claims, verifies each claim against evidence refs, revokes unsupported claims, and writes claim receipts, an execution log, an accuracy report, and an incident report.

The main demo moment is CLAIM-004. The agent first suspects an updater lead. The verifier rejects it because the support is weak, then pushes the run toward the PowerShell and network artifacts that explain the intrusion.

How we built it

The core is a Python CLI with four pieces: EvidenceToolset, TraceWardenAgent, ClaimVerifier, and AccuracyScorer. The toolset reads only inside a sealed evidence root. The verifier owns claim state transitions. The scorer compares confirmed claims against ground truth. The report writer turns each run into files judges can inspect and replay.

Challenges

The hardest part was building a self-correction that was visible and defensible. CLAIM-004 had to start as a plausible updater lead, fail verifier policy for lack of cross-source support, and then steer the agent toward the PowerShell and network evidence that actually explains the intrusion.

Accomplishments

The sample run evaluates 17 claims, confirms 16, revokes 1, and reports 0 hallucinated claims. Every confirmed claim maps to file, line, parser, hash, and tool call.

What we learned

For DFIR agents, the useful safety layer is not another prompt instruction. It is a typed tool surface, a verifier-owned claim lifecycle, and a receipt format that makes each surviving finding replayable.