Practical DFIR tooling designed to support forensic analysis, investigative reconstruction, incident response, and modern cybersecurity workflows.
Purpose-built for triage, scoping, and investigative narrative support using Microsoft 365 sign-in telemetry.
Analysis of non-interactive authentication activity, including token-based access, application sign-ins, and background authentication events often associated with persistence and post-compromise behavior.
Focused on audit log review with a clean interface for rapid filtering, IOC identification, and artifact-based investigation.
Reserve this space for acquisition helpers, triage aids, parsers, forensic workflow accelerators, and experimental releases.
Current research focuses on improving the speed and clarity of investigative analysis across modern authentication, audit, and identity telemetry. Emphasis is placed on detection logic aligned to real-world attacker behavior, structured timeline reconstruction, and producing clear, defensible outputs that support investigative decision-making.
