Three routes in, depending on what you already have running.
| You have… | Start here |
|---|---|
| Claude Code already set up and you want to extend it | Mode A — Direct Agent Extension |
| Any MCP-capable client and want strict architectural guardrails | Mode B — Custom MCP Server |
| Claude Code and want the safest, most auditable setup | Mode C — Hybrid (recommended) |
Not sure? Mode C is the right default. It's what the demo video uses, and it's what we suggest to hackathon judges.
You will need:
- SANS SIFT Workstation (Ubuntu 22.04 LTS variant) — host for the agent and the forensic tooling. See sift-workstation install.
- Python 3.12+ on the SIFT VM.
- Protocol SIFT installed (
curl -fsSL https://raw.githubusercontent.com/teamdfir/protocol-sift/main/install.sh | bash). - (Optional) API keys for Tier 1 intel sources — see Integrations.
- (Optional) A GLPI instance for Tier 2 workflow — see GLPI.
- Installation — one-page install guide common to all modes.
- Try it out — 10-minute quick start that runs a sample scenario end to end.