LICENSE
MANIFEST.in
README.md
pyproject.toml
src/forensia/__init__.py
src/forensia/artifacts.py
src/forensia/cli.py
src/forensia/config.py
src/forensia/knowledge.py
src/forensia/questions.py
src/forensia/report_templates.py
src/forensia/web.py
src/forensia.egg-info/PKG-INFO
src/forensia.egg-info/SOURCES.txt
src/forensia.egg-info/dependency_links.txt
src/forensia.egg-info/entry_points.txt
src/forensia.egg-info/requires.txt
src/forensia.egg-info/top_level.txt
src/forensia/ai/__init__.py
src/forensia/ai/audit.py
src/forensia/ai/case_profile.py
src/forensia/ai/checker.py
src/forensia/ai/hypothesis_manager.py
src/forensia/ai/investigator.py
src/forensia/ai/json_response.py
src/forensia/ai/llm_client.py
src/forensia/ai/memory_sync.py
src/forensia/ai/planner.py
src/forensia/ai/progress.py
src/forensia/ai/prompts.py
src/forensia/ai/report_gap.py
src/forensia/ai/schemas.py
src/forensia/ai/section_agent.py
src/forensia/ai/section_blocks.py
src/forensia/ai/section_refresher.py
src/forensia/ai/seeding.py
src/forensia/ai/sql_schema.py
src/forensia/ai/sql_templates.py
src/forensia/api/__init__.py
src/forensia/api/cache.py
src/forensia/api/dto.py
src/forensia/api/progress.py
src/forensia/api/service.py
src/forensia/core/__init__.py
src/forensia/core/case.py
src/forensia/core/case_tasks.py
src/forensia/core/evidence.py
src/forensia/core/log.py
src/forensia/core/memory.py
src/forensia/core/session.py
src/forensia/core/textutil.py
src/forensia/core/timeutil.py
src/forensia/core/verdicts.py
src/forensia/db/__init__.py
src/forensia/db/database.py
src/forensia/db/evidence_lookup.py
src/forensia/db/query.py
src/forensia/db/schema.py
src/forensia/ingest/__init__.py
src/forensia/ingest/evtx.py
src/forensia/ingest/mft.py
src/forensia/ingest/prefetch.py
src/forensia/normalize/__init__.py
src/forensia/normalize/evtx.py
src/forensia/normalize/mft.py
src/forensia/normalize/prefetch.py
src/forensia/normalize/timezone.py
src/forensia/profiles/data-leakage.yaml
src/forensia/profiles/insider-threat.yaml
src/forensia/profiles/ransomware-basic.yaml
src/forensia/profiles/windows-basic.yaml
src/forensia/report/__init__.py
src/forensia/report/benchmark_keypoints.py
src/forensia/report/evidence_map.py
src/forensia/report/html.py
src/forensia/report/keypoints.py
src/forensia/report/markdown.py
src/forensia/report/narrative_review.py
src/forensia/report/probes.py
src/forensia/report/quality_gates.py
src/forensia/report/ranking.py
src/forensia/report/structured_answers.py
src/forensia/report/writer.py
src/forensia/report/templates/report.html.j2
src/forensia/report_template/1_overview.md
src/forensia/report_template/2_timeline.md
src/forensia/report_template/3_technical.md
src/forensia/report_template/4_gaps.md
src/forensia/report_template/5_recommendations.md
src/forensia/report_template/6_appendix.md
src/forensia/rulepacks/_schema/app_catalog.yaml
src/forensia/rulepacks/_schema/artifact_inference.yaml
src/forensia/rulepacks/_schema/dfir_ioc_catalog.yaml
src/forensia/rulepacks/_schema/event_ids.yaml
src/forensia/rulepacks/_schema/evtx_events.yaml
src/forensia/rulepacks/_schema/false_positive_rules.yaml
src/forensia/rulepacks/_schema/findings.yaml
src/forensia/rulepacks/_schema/logon_types.yaml
src/forensia/rulepacks/_schema/mft_entries.yaml
src/forensia/rulepacks/_schema/mft_timeline.yaml
src/forensia/rulepacks/_schema/prefetch_executions.yaml
src/forensia/rulepacks/_schema/prefetch_timeline.yaml
src/forensia/rulepacks/_schema/question_routing.yaml
src/forensia/rulepacks/_schema/question_routing_eval.yaml
src/forensia/rulepacks/_schema/report_tables.yaml
src/forensia/rulepacks/_schema/verdict_taxonomy.yaml
src/forensia/rulepacks/_schema/playbook/broad_plan.md
src/forensia/rulepacks/_schema/playbook/check.md
src/forensia/rulepacks/_schema/playbook/hypothesis_plan.md
src/forensia/rulepacks/_schema/playbook/report_section.md
src/forensia/rulepacks/_schema/playbook/section_agent_check.md
src/forensia/rulepacks/_schema/playbook/section_agent_plan.md
src/forensia/rulepacks/_schema/suppression/allowlist_services.yaml
src/forensia/rulepacks/leakage/corr_ost_then_browser.yaml
src/forensia/rulepacks/leakage/evtx_ost_outlook_access.yaml
src/forensia/rulepacks/leakage/mft_archive_staging_file.yaml
src/forensia/rulepacks/leakage/mft_cloud_sync_artifact.yaml
src/forensia/rulepacks/leakage/mft_cloud_sync_db_deleted.yaml
src/forensia/rulepacks/leakage/mft_desktop_rename_burst.yaml
src/forensia/rulepacks/leakage/mft_resignation_file.yaml
src/forensia/rulepacks/leakage/mft_sensitive_filename.yaml
src/forensia/rulepacks/leakage/pack.yaml
src/forensia/rulepacks/windows/application_1000_app_crash.yaml
src/forensia/rulepacks/windows/corr_account_created_then_admin_added.yaml
src/forensia/rulepacks/windows/corr_bruteforce_then_success.yaml
src/forensia/rulepacks/windows/corr_defender_disabled_then_exec.yaml
src/forensia/rulepacks/windows/corr_logon_then_logclear.yaml
src/forensia/rulepacks/windows/corr_logon_then_service.yaml
src/forensia/rulepacks/windows/corr_logon_then_task.yaml
src/forensia/rulepacks/windows/corr_rdp_then_powershell.yaml
src/forensia/rulepacks/windows/defender_1116_malware_detected.yaml
src/forensia/rulepacks/windows/defender_1117_action_taken.yaml
src/forensia/rulepacks/windows/defender_5001_realtime_disabled.yaml
src/forensia/rulepacks/windows/defender_5007_config_change.yaml
src/forensia/rulepacks/windows/directory_5137_5139_5141_changes.yaml
src/forensia/rulepacks/windows/ntlm_4020_outgoing_auth.yaml
src/forensia/rulepacks/windows/ntlm_4021_4023_4030_auth.yaml
src/forensia/rulepacks/windows/ntlm_4022_incoming_auth.yaml
src/forensia/rulepacks/windows/ntlm_4031_forwarded_auth.yaml
src/forensia/rulepacks/windows/pack.yaml
src/forensia/rulepacks/windows/powershell_400_engine_start.yaml
src/forensia/rulepacks/windows/powershell_403_engine_stop.yaml
src/forensia/rulepacks/windows/powershell_4103_module_logging.yaml
src/forensia/rulepacks/windows/powershell_4104_encoded.yaml
src/forensia/rulepacks/windows/powershell_4105_script_started.yaml
src/forensia/rulepacks/windows/powershell_4106_script_complete.yaml
src/forensia/rulepacks/windows/rdp_lsm_1146_session_initialized.yaml
src/forensia/rulepacks/windows/rdp_lsm_1147_session_connected.yaml
src/forensia/rulepacks/windows/rdp_lsm_1148_session_failed.yaml
src/forensia/rulepacks/windows/rdp_lsm_21_logon.yaml
src/forensia/rulepacks/windows/rdp_lsm_22_23_shell_logoff.yaml
src/forensia/rulepacks/windows/rdp_lsm_24_disconnect.yaml
src/forensia/rulepacks/windows/rdp_lsm_25_reconnect.yaml
src/forensia/rulepacks/windows/rdp_lsm_39_session_disconnected.yaml
src/forensia/rulepacks/windows/rdp_lsm_40_session_disconnect_reason.yaml
src/forensia/rulepacks/windows/rdp_rcm_1149_user_auth_success.yaml
src/forensia/rulepacks/windows/rdp_rcm_261_connection_received.yaml
src/forensia/rulepacks/windows/rdpclient_1024_1026.yaml
src/forensia/rulepacks/windows/security_1100_evtlog_shutdown.yaml
src/forensia/rulepacks/windows/security_1101_audit_events_dropped.yaml
src/forensia/rulepacks/windows/security_1102_log_cleared.yaml
src/forensia/rulepacks/windows/security_1104_security_log_full.yaml
src/forensia/rulepacks/windows/security_1105_log_archived.yaml
src/forensia/rulepacks/windows/security_4616_time_changed.yaml
src/forensia/rulepacks/windows/security_4624_explicit_creds.yaml
src/forensia/rulepacks/windows/security_4624_interactive_logon.yaml
src/forensia/rulepacks/windows/security_4624_network_logon.yaml
src/forensia/rulepacks/windows/security_4624_rdp_logon.yaml
src/forensia/rulepacks/windows/security_4625_failed_logon.yaml
src/forensia/rulepacks/windows/security_4634_logoff.yaml
src/forensia/rulepacks/windows/security_4647_logoff_started.yaml
src/forensia/rulepacks/windows/security_4648_logon_explicit_creds.yaml
src/forensia/rulepacks/windows/security_4672_special_privileges.yaml
src/forensia/rulepacks/windows/security_4673_privileged_service.yaml
src/forensia/rulepacks/windows/security_4674_privileged_object.yaml
src/forensia/rulepacks/windows/security_4688_powershell.yaml
src/forensia/rulepacks/windows/security_4688_suspicious_tools.yaml
src/forensia/rulepacks/windows/security_4689_process_exit.yaml
src/forensia/rulepacks/windows/security_4697_service_install.yaml
src/forensia/rulepacks/windows/security_4698_task_created.yaml
src/forensia/rulepacks/windows/security_4699_task_deleted.yaml
src/forensia/rulepacks/windows/security_4700_task_enabled.yaml
src/forensia/rulepacks/windows/security_4701_task_disabled.yaml
src/forensia/rulepacks/windows/security_4702_task_updated.yaml
src/forensia/rulepacks/windows/security_4719_audit_policy_changed.yaml
src/forensia/rulepacks/windows/security_4720_account_lifecycle_consolidated.yaml
src/forensia/rulepacks/windows/security_4723_password_change.yaml
src/forensia/rulepacks/windows/security_4728_group_change_consolidated.yaml
src/forensia/rulepacks/windows/security_4731_local_group_created.yaml
src/forensia/rulepacks/windows/security_4739_domain_policy_changed.yaml
src/forensia/rulepacks/windows/security_4740_account_lockout.yaml
src/forensia/rulepacks/windows/security_4756_universal_group_added.yaml
src/forensia/rulepacks/windows/security_4764_group_type_changed.yaml
src/forensia/rulepacks/windows/security_4768_4769_kerberos_consolidated.yaml
src/forensia/rulepacks/windows/security_4770_kerberos_ticket_renewed.yaml
src/forensia/rulepacks/windows/security_4771_kerberos_preauth_failed.yaml
src/forensia/rulepacks/windows/security_4771_pre_auth_failed.yaml
src/forensia/rulepacks/windows/security_4776_ntlm_auth.yaml
src/forensia/rulepacks/windows/security_4778_rdp_reconnect.yaml
src/forensia/rulepacks/windows/security_4779_rdp_disconnect.yaml
src/forensia/rulepacks/windows/security_5136_ds_object_change.yaml
src/forensia/rulepacks/windows/security_5140_admin_share_access.yaml
src/forensia/rulepacks/windows/security_5142_share_added.yaml
src/forensia/rulepacks/windows/security_5143_share_modified.yaml
src/forensia/rulepacks/windows/security_5144_share_deleted.yaml
src/forensia/rulepacks/windows/security_5145_share_access_detailed.yaml
src/forensia/rulepacks/windows/security_5156_wfp_allowed.yaml
src/forensia/rulepacks/windows/security_5168_spn_check_failed.yaml
src/forensia/rulepacks/windows/smbclient_30803_30807.yaml
src/forensia/rulepacks/windows/smbclient_30809_timeout.yaml
src/forensia/rulepacks/windows/smbclient_31001_security_context.yaml
src/forensia/rulepacks/windows/smbclient_31010_connection_failed.yaml
src/forensia/rulepacks/windows/smbclient_32000_32002_smbnegotiation.yaml
src/forensia/rulepacks/windows/smbclient_detailed.yaml
src/forensia/rulepacks/windows/smbserver_1006_1009_1016_1020_errors.yaml
src/forensia/rulepacks/windows/smbserver_551_auth_failed.yaml
src/forensia/rulepacks/windows/system_104_log_cleared.yaml
src/forensia/rulepacks/windows/system_1074_initiated_shutdown.yaml
src/forensia/rulepacks/windows/system_12_kernel_boot.yaml
src/forensia/rulepacks/windows/system_13_kernel_shutdown.yaml
src/forensia/rulepacks/windows/system_41_unexpected_reboot.yaml
src/forensia/rulepacks/windows/system_6005_6006_eventlog_service.yaml
src/forensia/rulepacks/windows/system_6008_unexpected_shutdown.yaml
src/forensia/rulepacks/windows/system_6009_uptime.yaml
src/forensia/rulepacks/windows/system_6013_uptime.yaml
src/forensia/rulepacks/windows/system_7036_service_state.yaml
src/forensia/rulepacks/windows/system_7040_service_starttype_change.yaml
src/forensia/rulepacks/windows/system_7045_service_installed.yaml
src/forensia/rulepacks/windows/system_9009_dwm_end.yaml
src/forensia/rulepacks/windows/tasksched_101_task_start_failed.yaml
src/forensia/rulepacks/windows/tasksched_102_103_task_complete.yaml
src/forensia/rulepacks/windows/tasksched_106_task_registered.yaml
src/forensia/rulepacks/windows/tasksched_141_task_deleted.yaml
src/forensia/rulepacks/windows/tasksched_200_action_started.yaml
src/forensia/rulepacks/windows/tasksched_comprehensive.yaml
src/forensia/rulepacks/windows/wmi_5857_5858_activity.yaml
src/forensia/rules/__init__.py
src/forensia/rules/engine.py
src/forensia/rules/loader.py
src/forensia/rules/models.py
src/forensia/static/index.html
src/forensia/static/assets/forensia-logo-Cn6f8HQ0.svg
src/forensia/static/assets/index-DAjQvo1Q.css
src/forensia/static/assets/index-OqKl3Ak1.js
tests/test_api_cache.py
tests/test_api_service.py
tests/test_audit.py
tests/test_audit_coverage.py
tests/test_auto_confirm_coobservation.py
tests/test_case_tasks.py
tests/test_checker_gates.py
tests/test_config.py
tests/test_db_query.py
tests/test_eval_metrics.py
tests/test_evidence.py
tests/test_evidence_lookup.py
tests/test_host_epochs.py
tests/test_html.py
tests/test_hypothesis_similarity.py
tests/test_investigator_wiring.py
tests/test_json_response.py
tests/test_keypoint_selection.py
tests/test_lmstudio.py
tests/test_memory_and_ingest.py
tests/test_normalize_mft.py
tests/test_normalize_prefetch.py
tests/test_persistence.py
tests/test_planner.py
tests/test_playbook_budget.py
tests/test_regression_rq.py
tests/test_report_aggregation.py
tests/test_review_regressions.py
tests/test_rules_and_profiles.py
tests/test_sql_schema.py
tests/test_sql_templates.py
tests/test_stale_propagation.py
tests/test_timezone.py
tests/test_untestable_resolution.py
tests/test_web_api.py
tests/test_writer_rq_regressions.py