Agentic-DFIR — Autonomous DFIR Agent for the SIFT Workstation
An autonomous AI agent that runs a senior-analyst-style forensic investigation loop on top of the SANS SIFT Workstation, restricted to a fixed set of read-only forensic tools, and produces an auditable, traceable incident report.
Agentic-DFIR sits on top of SIFT Workstation tools such as Velociraptor, KAPE, Timesketch and Plaso rather than replacing them, running a reasoning loop through a custom MCP server that exposes exactly 48 typed, read-only native forensic functions plus 25 SIFT tool adapters. Anything outside that surface, such as executing a shell command, writing a file or mounting a device, does not exist as a callable tool regardless of what a prompt asks for, so the safety boundary is architectural rather than a rule the agent is asked to follow.
Every finding carries the audit IDs of the MCP calls that produced it, and a trace command resolves a finding in a reference run back to the exact call, source artifact and output hash. A ten-phase YAML playbook encodes a senior-analyst methodology with every step citing its source, and a contradiction handler halts and flags a finding as unresolved when evidence disagrees, such as file-system timestamps conflicting with event-log entries, rather than picking a side.
The project reports 73 total typed, read-only MCP tools and zero destructive operations possible by construction, verified by a bundled demo script and test suite. It is MIT licensed and runs end to end offline.