https://github.com/securityronin/issen

Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/LNK/SRUM/browser/Amcache + memory (processes, netstat, injection), correlates into a DuckDB super-timeline, scans threat-intel, and reports.

attack-flow browser-forensics dfir digital-forensics disk-forensics duckdb evtx forensics incident-response linux-forensics memory-forensics mitre-attack ntfs rust sigma threat-intelligence timeline velociraptor windows-forensics yara

Last synced: 11 Jul 2026