EvidenceFlow

EvidenceFlow is a web app (with optional desktop agent) that focuses on one painful gap in incident response: preserving, organizing, and exporting defensible evidence without slowing responders down. It ingests artifacts from common sources (EDR exports, firewall logs, cloud audit logs, email headers, screenshots, chat transcripts) and automatically builds a time-ordered evidence timeline with hashes, chain-of-custody events, and investigator notes. The AI layer suggests what’s missing (e.g., “no Okta sign-in logs for the impacted user”) and drafts a clean incident evidence package for legal, cyber insurance, and regulators. It does not try to replace your SIEM/SOAR; it sits downstream to reduce reporting chaos and rework. Realistically, the product wins only if it’s faster than spreadsheets and more defensible than ad-hoc wiki pages, with exports that auditors actually accept.