Inspiration
Modern attackers can move faster than human incident responders can manually triage evidence. The Find Evil challenge asks defenders to close that speed gap using autonomous AI agents on the SANS SIFT Workstation. I built TriageForce to explore what a safe AI forensic co-pilot should look like: fast, structured, evidence-aware, and unwilling to overclaim.
What it does
TriageForce is an autonomous forensic triage agent that connects Gemini to a SIFT VM through a custom Model Context Protocol server. It can inspect mounted forensic evidence, call typed forensic tools, collect artifacts, produce structured evidence_claim blocks, verify findings, assign confidence scores, identify evidence gaps, map findings to MITRE ATT&CK, and write a traceable JSONL audit log.
The agent currently exposes 23 typed, read-only MCP tools, including Amcache, ShimCache, Sysmon, EVTX, PowerShell logs, services, scheduled tasks, autoruns, registry hives, MFT, USN Journal, browser history, network capture summaries, and domain controller artifact inventory.
How I built it
I built a local agent.py client using the Google Gemini SDK. The agent connects over SSH stdio to a FastMCP server running on a SANS SIFT VM. Instead of giving the model generic shell access, the server exposes only typed forensic functions. This means the model can request safe forensic actions, but cannot run arbitrary destructive commands.
Evidence is mounted read-only under /cases/<case_id>/evidence. The agent supports multiple cases with --case-id, so the same workflow can target case_001 or case_002.
The agent uses an evidence correlation layer that stores findings as structured objects. Each finding tracks its sources, supporting observations, contradictions, confidence score, verification history, evidence gaps, and ATT&CK mappings. A verification stage challenges the findings before the final report is produced.
What makes it different
The main design goal was forensic safety. TriageForce enforces guardrails architecturally, not only through prompts. The model does not receive shell access. It receives a controlled set of read-only forensic tools.
The agent also avoids pretending weak evidence is strong. In the live demo, it verifies a PsExec/PSEXESVC finding using Amcache, Windows services, and Sysmon context, but keeps it at medium confidence because slower Security EVTX evidence was intentionally skipped. It also leaves weaker PWDumpX evidence inconclusive when there is not enough corroboration.
Challenges
The hardest part was balancing autonomy with forensic discipline. Some tools can be slow on large logs, especially Security EVTX, MFT, and USN Journal parsing. I added max-iteration limits, targeted tool guidance, timeout handling, evidence gaps, and confidence penalties so the agent can degrade safely instead of hanging forever or hallucinating.
Another challenge was avoiding overconfidence. I added self-correction, single-artifact warnings, composite evidence scoring for domain controller context, and deterministic fallback creation for context findings when the model calls a tool but forgets to emit a structured claim.
What I learned
I learned that the strongest AI DFIR systems are not just better prompts. They need secure tool boundaries, structured output parsing, confidence scoring, verification loops, and audit trails. The model should help the analyst move faster, but the architecture must force it to stay honest.
What's next
Next steps would include deeper benchmark testing, memory image support, better UI output, richer timeline visualization, and more SIFT tool wrappers. I would also like to add a formal accuracy harness that compares agent findings against known ground truth across multiple cases.
