Autonomous digital-forensics & incident-response agent for the SANS SIFT Workstation. Built on Protocol SIFT for the FIND EVIL! hackathon (SANS/GIAC, 2026).
This is the canonical documentation. Every page is plain Markdown — renders
natively on GitHub, and builds into a searchable static site via
mkdocs + Material theme.
| If you are… | Read |
|---|---|
| A first-time user | Getting started |
| A hackathon judge | Getting started → Try it out and Architecture |
| A senior IR analyst | Scenarios and Use cases |
| A developer extending APTWatcher | Architecture, Reference, and design/ |
How to install and run APTWatcher in each deployment mode.
- Installation
- Try it out — 10-minute quick start
- Mode A — Direct Agent Extension
- Mode B — Custom MCP Server
- Mode C — Hybrid (recommended)
How APTWatcher is structured and why.
- Overview
- Three deployment modes
- Tiered capability model
- Shared brain (
src/core/) - Evidence integrity
- Audit logging & traceability
- Self-correction & reasoning
Pre-flight profiles that bound what tools the agent can reach for.
- Windows host triage
- Linux host triage
- Memory-only analysis
- Timeline-only analysis
- Network artifact analysis
End-to-end demo scenarios — each one comes with a dataset, an expected agent approach, and a success rubric.
- S01 — Single Windows host compromise
- S02 — Multi-host lateral movement
- S03 — Ransomware pre-detonation
How we generate synthetic test cases and which public datasets we use.
Optional external capabilities wired into the tier model.
- APT Watch (Tier 1 intel)
- MS Threat Analytics (Tier 1 intel)
- GLPI (Tier 2 workflow)
- cnc_disruptor (Tier 3/4 containment)
Flat lookup tables.
Low-level implementation references — mostly for developers.
- Demo walkthrough — captured CLI output
- Try it out (top-level)
- Accuracy harness
- Dataset notes
- Devpost narrative
Corrections, additional scenarios, and new knowledge-base entries are welcome — see the clean-room content policy for what can and cannot go into the KB.
MIT. Third-party attributions are listed per integration page.