Media
1 item
Description
Connects to the DFIR Companion you configure, local by default. Captures screenshots and pushes detections from DFIR consoles. DFIR Companion-Evidence Capture & Push. requires the local DFIR Companion server (127.0.0.1:4773) to function. It is NOT a standalone tool. WHAT IT DOES: • Captures timed screenshots of SIEM, EDR, and threat-intel web consoles for local AI analysis. • Injects a "Push" button to send detections and alerts directly to your server. • Features offline queuing, auto-sync, and a keyboard toggle (Ctrl+Shift+S). • Per-case Start/Stop management. REQUIREMENTS: The DFIR Companion server must be running locally. Install via Chocolatey, EXE, Docker, AppImage, or Source. SERVER CAPABILITIES: • Runs AI vision analysis to build forensic timelines. • Synthesizes findings, MITRE ATT&CK techniques, and IOCs. • Provides a live dashboard with STIX, HTML, and Markdown exports. Source: https://github.com/hasamba/DFIR-Companion