ForensicTriage

ForensicTriage is a web + lightweight desktop agent that helps incident responders quickly decide what happened on a suspected endpoint and what to do next. Instead of being a full EDR replacement (it won’t be), it focuses on rapid evidence collection and prioritization: pull a minimal, defensible artifact set (process tree, autoruns, network connections, recent file writes, browser downloads, event log slices), hash and timestamp everything, and generate a case timeline. An AI assistant summarizes likely intrusion paths and suggests containment steps, but every claim links back to specific artifacts so analysts can verify. The app also produces a clean “executive + legal” report package with chain-of-custody metadata. It’s realistic for small security teams who can’t afford premium DFIR retainers for every alert, and it reduces the time wasted deciding whether an endpoint is truly compromised.