LICENSE
MANIFEST.in
README.md
pyproject.toml
src/forensia/__init__.py
src/forensia/config.py
src/forensia.egg-info/PKG-INFO
src/forensia.egg-info/SOURCES.txt
src/forensia.egg-info/dependency_links.txt
src/forensia.egg-info/entry_points.txt
src/forensia.egg-info/requires.txt
src/forensia.egg-info/top_level.txt
src/forensia/ai/__init__.py
src/forensia/ai/audit.py
src/forensia/ai/case_profile.py
src/forensia/ai/compaction.py
src/forensia/ai/report_gap.py
src/forensia/ai/retrieval_telemetry.py
src/forensia/ai/checking/__init__.py
src/forensia/ai/checking/check_apply.py
src/forensia/ai/checking/check_guardrails.py
src/forensia/ai/checking/check_normalize.py
src/forensia/ai/checking/checker.py
src/forensia/ai/checking/settlement.py
src/forensia/ai/checking/sufficiency.py
src/forensia/ai/hypotheses/__init__.py
src/forensia/ai/hypotheses/hypothesis_manager.py
src/forensia/ai/hypotheses/hypothesis_model.py
src/forensia/ai/hypotheses/hypothesis_runner.py
src/forensia/ai/hypotheses/hypothesis_store.py
src/forensia/ai/hypotheses/relations.py
src/forensia/ai/hypotheses/seeding.py
src/forensia/ai/investigation/__init__.py
src/forensia/ai/investigation/investigation_cycle.py
src/forensia/ai/investigation/investigation_session.py
src/forensia/ai/investigation/investigator.py
src/forensia/ai/investigation/memory_sync.py
src/forensia/ai/investigation/planner.py
src/forensia/ai/investigation/progress.py
src/forensia/ai/investigation/selection.py
src/forensia/ai/investigation/work_state.py
src/forensia/ai/llm/__init__.py
src/forensia/ai/llm/json_response.py
src/forensia/ai/llm/llm_client.py
src/forensia/ai/llm/llm_gateway.py
src/forensia/ai/llm/schemas.py
src/forensia/ai/prompts/__init__.py
src/forensia/ai/prompts/prompt_context.py
src/forensia/ai/prompts/prompt_investigation.py
src/forensia/ai/prompts/prompt_playbook.py
src/forensia/ai/prompts/prompt_sections.py
src/forensia/ai/prompts/sql_schema.py
src/forensia/ai/prompts/sql_templates.py
src/forensia/ai/sections/__init__.py
src/forensia/ai/sections/section_agent.py
src/forensia/ai/sections/section_answers.py
src/forensia/ai/sections/section_block_context.py
src/forensia/ai/sections/section_block_narrative.py
src/forensia/ai/sections/section_block_plan.py
src/forensia/ai/sections/section_exec.py
src/forensia/ai/sections/section_refresher.py
src/forensia/ai/sections/section_run_store.py
src/forensia/api/__init__.py
src/forensia/api/cache.py
src/forensia/api/dto.py
src/forensia/api/progress.py
src/forensia/api/service.py
src/forensia/api/service_investigation.py
src/forensia/cli/__init__.py
src/forensia/cli/app.py
src/forensia/cli/doctor.py
src/forensia/cli/stages.py
src/forensia/cli/support.py
src/forensia/core/__init__.py
src/forensia/core/case.py
src/forensia/core/case_tasks.py
src/forensia/core/compaction.py
src/forensia/core/evidence.py
src/forensia/core/frontmatter.py
src/forensia/core/log.py
src/forensia/core/memory.py
src/forensia/core/memory_compaction.py
src/forensia/core/memory_context.py
src/forensia/core/memory_writers.py
src/forensia/core/progress_event.py
src/forensia/core/session.py
src/forensia/core/textutil.py
src/forensia/core/timeutil.py
src/forensia/core/verdicts.py
src/forensia/db/__init__.py
src/forensia/db/database.py
src/forensia/db/evidence_lookup.py
src/forensia/db/evidence_sources.py
src/forensia/db/investigation_state.py
src/forensia/db/query.py
src/forensia/db/schema.py
src/forensia/evidence/__init__.py
src/forensia/evidence/artifacts.py
src/forensia/evidence/evtx.py
src/forensia/evidence/ingest.py
src/forensia/evidence/mft.py
src/forensia/evidence/normalize.py
src/forensia/evidence/prefetch.py
src/forensia/evidence/timeline_sql.py
src/forensia/evidence/timestamp_policy.py
src/forensia/evidence/timezone.py
src/forensia/knowledge/__init__.py
src/forensia/knowledge/catalog.py
src/forensia/knowledge/coverage.py
src/forensia/knowledge/external.py
src/forensia/knowledge/questions.py
src/forensia/knowledge/resources.py
src/forensia/knowledge/retrieval.py
src/forensia/knowledge/profiles/data-leakage.yaml
src/forensia/knowledge/profiles/insider-threat.yaml
src/forensia/knowledge/profiles/ransomware-basic.yaml
src/forensia/knowledge/profiles/windows-basic.yaml
src/forensia/knowledge/rulepacks/_schema/app_catalog.yaml
src/forensia/knowledge/rulepacks/_schema/artifact_capabilities.yaml
src/forensia/knowledge/rulepacks/_schema/artifact_inference.yaml
src/forensia/knowledge/rulepacks/_schema/benign_auth.yaml
src/forensia/knowledge/rulepacks/_schema/dfir_ioc_catalog.yaml
src/forensia/knowledge/rulepacks/_schema/event_ids.yaml
src/forensia/knowledge/rulepacks/_schema/evidence_sufficiency.yaml
src/forensia/knowledge/rulepacks/_schema/evtx_events.yaml
src/forensia/knowledge/rulepacks/_schema/false_positive_rules.yaml
src/forensia/knowledge/rulepacks/_schema/finding_themes.yaml
src/forensia/knowledge/rulepacks/_schema/findings.yaml
src/forensia/knowledge/rulepacks/_schema/investigation_priority.yaml
src/forensia/knowledge/rulepacks/_schema/keypoint_aliases.yaml
src/forensia/knowledge/rulepacks/_schema/logon_types.yaml
src/forensia/knowledge/rulepacks/_schema/mft_entries.yaml
src/forensia/knowledge/rulepacks/_schema/mft_timeline.yaml
src/forensia/knowledge/rulepacks/_schema/prefetch_executions.yaml
src/forensia/knowledge/rulepacks/_schema/prefetch_timeline.yaml
src/forensia/knowledge/rulepacks/_schema/query_templates.yaml
src/forensia/knowledge/rulepacks/_schema/question_routing.yaml
src/forensia/knowledge/rulepacks/_schema/question_routing_eval.yaml
src/forensia/knowledge/rulepacks/_schema/report_tables.yaml
src/forensia/knowledge/rulepacks/_schema/report_validation_vocab.yaml
src/forensia/knowledge/rulepacks/_schema/verdict_taxonomy.yaml
src/forensia/knowledge/rulepacks/_schema/playbook/broad_plan.md
src/forensia/knowledge/rulepacks/_schema/playbook/check.md
src/forensia/knowledge/rulepacks/_schema/playbook/hypothesis_plan.md
src/forensia/knowledge/rulepacks/_schema/playbook/report_section.md
src/forensia/knowledge/rulepacks/_schema/playbook/section_agent_check.md
src/forensia/knowledge/rulepacks/_schema/playbook/section_agent_plan.md
src/forensia/knowledge/rulepacks/_schema/suppression/allowlist_services.yaml
src/forensia/knowledge/rulepacks/leakage/corr_ost_then_browser.yaml
src/forensia/knowledge/rulepacks/leakage/evtx_ost_outlook_access.yaml
src/forensia/knowledge/rulepacks/leakage/mft_archive_staging_file.yaml
src/forensia/knowledge/rulepacks/leakage/mft_cloud_sync_artifact.yaml
src/forensia/knowledge/rulepacks/leakage/mft_cloud_sync_db_deleted.yaml
src/forensia/knowledge/rulepacks/leakage/mft_desktop_rename_burst.yaml
src/forensia/knowledge/rulepacks/leakage/mft_resignation_file.yaml
src/forensia/knowledge/rulepacks/leakage/mft_sensitive_filename.yaml
src/forensia/knowledge/rulepacks/leakage/pack.yaml
src/forensia/knowledge/rulepacks/windows/application_1000_app_crash.yaml
src/forensia/knowledge/rulepacks/windows/corr_account_created_then_admin_added.yaml
src/forensia/knowledge/rulepacks/windows/corr_bruteforce_then_success.yaml
src/forensia/knowledge/rulepacks/windows/corr_defender_disabled_then_exec.yaml
src/forensia/knowledge/rulepacks/windows/corr_logon_then_logclear.yaml
src/forensia/knowledge/rulepacks/windows/corr_logon_then_service.yaml
src/forensia/knowledge/rulepacks/windows/corr_logon_then_task.yaml
src/forensia/knowledge/rulepacks/windows/corr_rdp_then_powershell.yaml
src/forensia/knowledge/rulepacks/windows/defender_1116_malware_detected.yaml
src/forensia/knowledge/rulepacks/windows/defender_1117_action_taken.yaml
src/forensia/knowledge/rulepacks/windows/defender_5001_realtime_disabled.yaml
src/forensia/knowledge/rulepacks/windows/defender_5007_config_change.yaml
src/forensia/knowledge/rulepacks/windows/directory_5137_5139_5141_changes.yaml
src/forensia/knowledge/rulepacks/windows/finding_antiforensic_tools.yaml
src/forensia/knowledge/rulepacks/windows/finding_data_staging.yaml
src/forensia/knowledge/rulepacks/windows/ntlm_4020_outgoing_auth.yaml
src/forensia/knowledge/rulepacks/windows/ntlm_4021_4023_4030_auth.yaml
src/forensia/knowledge/rulepacks/windows/ntlm_4022_incoming_auth.yaml
src/forensia/knowledge/rulepacks/windows/ntlm_4031_forwarded_auth.yaml
src/forensia/knowledge/rulepacks/windows/pack.yaml
src/forensia/knowledge/rulepacks/windows/powershell_400_engine_start.yaml
src/forensia/knowledge/rulepacks/windows/powershell_403_engine_stop.yaml
src/forensia/knowledge/rulepacks/windows/powershell_4103_module_logging.yaml
src/forensia/knowledge/rulepacks/windows/powershell_4104_encoded.yaml
src/forensia/knowledge/rulepacks/windows/powershell_4105_script_started.yaml
src/forensia/knowledge/rulepacks/windows/powershell_4106_script_complete.yaml
src/forensia/knowledge/rulepacks/windows/rdp_lsm_1146_session_initialized.yaml
src/forensia/knowledge/rulepacks/windows/rdp_lsm_1147_session_connected.yaml
src/forensia/knowledge/rulepacks/windows/rdp_lsm_1148_session_failed.yaml
src/forensia/knowledge/rulepacks/windows/rdp_lsm_21_logon.yaml
src/forensia/knowledge/rulepacks/windows/rdp_lsm_22_23_shell_logoff.yaml
src/forensia/knowledge/rulepacks/windows/rdp_lsm_24_disconnect.yaml
src/forensia/knowledge/rulepacks/windows/rdp_lsm_25_reconnect.yaml
src/forensia/knowledge/rulepacks/windows/rdp_lsm_39_session_disconnected.yaml
src/forensia/knowledge/rulepacks/windows/rdp_lsm_40_session_disconnect_reason.yaml
src/forensia/knowledge/rulepacks/windows/rdp_rcm_1149_user_auth_success.yaml
src/forensia/knowledge/rulepacks/windows/rdp_rcm_261_connection_received.yaml
src/forensia/knowledge/rulepacks/windows/rdpclient_1024_1026.yaml
src/forensia/knowledge/rulepacks/windows/security_1100_evtlog_shutdown.yaml
src/forensia/knowledge/rulepacks/windows/security_1101_audit_events_dropped.yaml
src/forensia/knowledge/rulepacks/windows/security_1102_log_cleared.yaml
src/forensia/knowledge/rulepacks/windows/security_1104_security_log_full.yaml
src/forensia/knowledge/rulepacks/windows/security_1105_log_archived.yaml
src/forensia/knowledge/rulepacks/windows/security_4616_time_changed.yaml
src/forensia/knowledge/rulepacks/windows/security_4624_explicit_creds.yaml
src/forensia/knowledge/rulepacks/windows/security_4624_interactive_logon.yaml
src/forensia/knowledge/rulepacks/windows/security_4624_network_logon.yaml
src/forensia/knowledge/rulepacks/windows/security_4624_rdp_logon.yaml
src/forensia/knowledge/rulepacks/windows/security_4625_failed_logon.yaml
src/forensia/knowledge/rulepacks/windows/security_4634_logoff.yaml
src/forensia/knowledge/rulepacks/windows/security_4647_logoff_started.yaml
src/forensia/knowledge/rulepacks/windows/security_4648_logon_explicit_creds.yaml
src/forensia/knowledge/rulepacks/windows/security_4672_special_privileges.yaml
src/forensia/knowledge/rulepacks/windows/security_4673_privileged_service.yaml
src/forensia/knowledge/rulepacks/windows/security_4674_privileged_object.yaml
src/forensia/knowledge/rulepacks/windows/security_4688_powershell.yaml
src/forensia/knowledge/rulepacks/windows/security_4688_suspicious_tools.yaml
src/forensia/knowledge/rulepacks/windows/security_4689_process_exit.yaml
src/forensia/knowledge/rulepacks/windows/security_4697_service_install.yaml
src/forensia/knowledge/rulepacks/windows/security_4698_task_created.yaml
src/forensia/knowledge/rulepacks/windows/security_4699_task_deleted.yaml
src/forensia/knowledge/rulepacks/windows/security_4700_task_enabled.yaml
src/forensia/knowledge/rulepacks/windows/security_4701_task_disabled.yaml
src/forensia/knowledge/rulepacks/windows/security_4702_task_updated.yaml
src/forensia/knowledge/rulepacks/windows/security_4719_audit_policy_changed.yaml
src/forensia/knowledge/rulepacks/windows/security_4720_account_lifecycle_consolidated.yaml
src/forensia/knowledge/rulepacks/windows/security_4723_password_change.yaml
src/forensia/knowledge/rulepacks/windows/security_4728_group_change_consolidated.yaml
src/forensia/knowledge/rulepacks/windows/security_4731_local_group_created.yaml
src/forensia/knowledge/rulepacks/windows/security_4735_group_metadata_changed.yaml
src/forensia/knowledge/rulepacks/windows/security_4738_user_account_changed.yaml
src/forensia/knowledge/rulepacks/windows/security_4739_domain_policy_changed.yaml
src/forensia/knowledge/rulepacks/windows/security_4740_account_lockout.yaml
src/forensia/knowledge/rulepacks/windows/security_4756_universal_group_added.yaml
src/forensia/knowledge/rulepacks/windows/security_4764_group_type_changed.yaml
src/forensia/knowledge/rulepacks/windows/security_4768_4769_kerberos_consolidated.yaml
src/forensia/knowledge/rulepacks/windows/security_4770_kerberos_ticket_renewed.yaml
src/forensia/knowledge/rulepacks/windows/security_4771_kerberos_preauth_failed.yaml
src/forensia/knowledge/rulepacks/windows/security_4771_pre_auth_failed.yaml
src/forensia/knowledge/rulepacks/windows/security_4776_ntlm_auth.yaml
src/forensia/knowledge/rulepacks/windows/security_4778_rdp_reconnect.yaml
src/forensia/knowledge/rulepacks/windows/security_4779_rdp_disconnect.yaml
src/forensia/knowledge/rulepacks/windows/security_5136_ds_object_change.yaml
src/forensia/knowledge/rulepacks/windows/security_5140_admin_share_access.yaml
src/forensia/knowledge/rulepacks/windows/security_5142_share_added.yaml
src/forensia/knowledge/rulepacks/windows/security_5143_share_modified.yaml
src/forensia/knowledge/rulepacks/windows/security_5144_share_deleted.yaml
src/forensia/knowledge/rulepacks/windows/security_5145_share_access_detailed.yaml
src/forensia/knowledge/rulepacks/windows/security_5156_wfp_allowed.yaml
src/forensia/knowledge/rulepacks/windows/security_5168_spn_check_failed.yaml
src/forensia/knowledge/rulepacks/windows/security_group_deleted.yaml
src/forensia/knowledge/rulepacks/windows/security_group_removed.yaml
src/forensia/knowledge/rulepacks/windows/smbclient_30803_30807.yaml
src/forensia/knowledge/rulepacks/windows/smbclient_30809_timeout.yaml
src/forensia/knowledge/rulepacks/windows/smbclient_31001_security_context.yaml
src/forensia/knowledge/rulepacks/windows/smbclient_31010_connection_failed.yaml
src/forensia/knowledge/rulepacks/windows/smbclient_32000_32002_smbnegotiation.yaml
src/forensia/knowledge/rulepacks/windows/smbclient_detailed.yaml
src/forensia/knowledge/rulepacks/windows/smbserver_1006_1009_1016_1020_errors.yaml
src/forensia/knowledge/rulepacks/windows/smbserver_551_auth_failed.yaml
src/forensia/knowledge/rulepacks/windows/system_104_log_cleared.yaml
src/forensia/knowledge/rulepacks/windows/system_1074_initiated_shutdown.yaml
src/forensia/knowledge/rulepacks/windows/system_12_kernel_boot.yaml
src/forensia/knowledge/rulepacks/windows/system_13_kernel_shutdown.yaml
src/forensia/knowledge/rulepacks/windows/system_41_unexpected_reboot.yaml
src/forensia/knowledge/rulepacks/windows/system_6005_6006_eventlog_service.yaml
src/forensia/knowledge/rulepacks/windows/system_6008_unexpected_shutdown.yaml
src/forensia/knowledge/rulepacks/windows/system_6009_uptime.yaml
src/forensia/knowledge/rulepacks/windows/system_6013_uptime.yaml
src/forensia/knowledge/rulepacks/windows/system_7036_service_state.yaml
src/forensia/knowledge/rulepacks/windows/system_7040_service_starttype_change.yaml
src/forensia/knowledge/rulepacks/windows/system_7045_service_installed.yaml
src/forensia/knowledge/rulepacks/windows/system_9009_dwm_end.yaml
src/forensia/knowledge/rulepacks/windows/tasksched_101_task_start_failed.yaml
src/forensia/knowledge/rulepacks/windows/tasksched_102_103_task_complete.yaml
src/forensia/knowledge/rulepacks/windows/tasksched_106_task_registered.yaml
src/forensia/knowledge/rulepacks/windows/tasksched_141_task_deleted.yaml
src/forensia/knowledge/rulepacks/windows/tasksched_200_action_started.yaml
src/forensia/knowledge/rulepacks/windows/tasksched_comprehensive.yaml
src/forensia/knowledge/rulepacks/windows/wmi_5857_5858_activity.yaml
src/forensia/knowledge/rules/__init__.py
src/forensia/knowledge/rules/engine.py
src/forensia/knowledge/rules/loader.py
src/forensia/knowledge/rules/models.py
src/forensia/report/__init__.py
src/forensia/report/api_snapshot.py
src/forensia/report/benign_auth.py
src/forensia/report/evidence_refs.py
src/forensia/report/finding_themes.py
src/forensia/report/report_brief.py
src/forensia/report/report_validation.py
src/forensia/report/resources.py
src/forensia/report/section_views.py
src/forensia/report/template_export.py
src/forensia/report/answers/__init__.py
src/forensia/report/answers/answer_builders_artifacts.py
src/forensia/report/answers/answer_builders_host.py
src/forensia/report/answers/answer_registry.py
src/forensia/report/answers/answer_store.py
src/forensia/report/answers/event_semantics.py
src/forensia/report/answers/gap_tables.py
src/forensia/report/answers/keypoint_catalog.py
src/forensia/report/answers/keypoint_sql.py
src/forensia/report/answers/keypoints_activity.py
src/forensia/report/answers/keypoints_host_account.py
src/forensia/report/answers/keypoints_overview_ioc.py
src/forensia/report/answers/keypoints_report_meta.py
src/forensia/report/answers/summary_rows.py
src/forensia/report/answers/table_registry.py
src/forensia/report/render/__init__.py
src/forensia/report/render/evidence_map.py
src/forensia/report/render/formats.py
src/forensia/report/render/html.py
src/forensia/report/render/markdown.py
src/forensia/report/render/writer.py
src/forensia/report/render/templates/report.css.j2
src/forensia/report/render/templates/report.html.j2
src/forensia/report/render/templates/partials/key_findings.html.j2
src/forensia/report/render/templates/partials/report_header.html.j2
src/forensia/report/sections/__init__.py
src/forensia/report/sections/narrative_review.py
src/forensia/report/sections/quality_gates.py
src/forensia/report/sections/section_assembly.py
src/forensia/report/sections/section_finalize.py
src/forensia/report/sections/section_quality.py
src/forensia/report/sections/section_store.py
src/forensia/report/sections/section_taxonomy.py
src/forensia/report/sections/template_parsing.py
src/forensia/report/templates/1_overview.md
src/forensia/report/templates/2_timeline.md
src/forensia/report/templates/3_technical.md
src/forensia/report/templates/4_gaps.md
src/forensia/report/templates/5_recommendations.md
src/forensia/report/templates/_formats/report.yaml
src/forensia/web/__init__.py
src/forensia/web/app.py
src/forensia/web/resources.py
src/forensia/web/static/index.html
src/forensia/web/static/assets/forensia-logo-Cn6f8HQ0.svg
src/forensia/web/static/assets/index-CW5omHsn.css
src/forensia/web/static/assets/index-Pbv-y-KJ.js
tests/test_api_cache.py
tests/test_api_report_views.py
tests/test_api_service.py
tests/test_api_snapshot.py
tests/test_audit.py
tests/test_audit_coverage.py
tests/test_benign_auth.py
tests/test_case_db_maintenance.py
tests/test_case_setup.py
tests/test_case_tasks.py
tests/test_checker_gates.py
tests/test_checker_verdicts.py
tests/test_compaction.py
tests/test_config.py
tests/test_core_log.py
tests/test_coverage.py
tests/test_coverage_lineage.py
tests/test_db_query.py
tests/test_evidence.py
tests/test_evidence_lookup.py
tests/test_extension_points.py
tests/test_gap_task_integration.py
tests/test_host_epochs.py
tests/test_html.py
tests/test_hypothesis_manager.py
tests/test_hypothesis_relations.py
tests/test_hypothesis_seeding.py
tests/test_ingest.py
tests/test_investigation_state.py
tests/test_investigator_wiring.py
tests/test_json_response.py
tests/test_keypoint_selection.py
tests/test_knowledge_external.py
tests/test_knowledge_retrieval.py
tests/test_llm_compaction.py
tests/test_lmstudio.py
tests/test_memory.py
tests/test_memory_sync.py
tests/test_normalize_mft.py
tests/test_normalize_prefetch.py
tests/test_persistence.py
tests/test_planner.py
tests/test_playbook_budget.py
tests/test_progress_tracker.py
tests/test_prompt_messages.py
tests/test_question_answers.py
tests/test_report_aggregation.py
tests/test_report_quality_harness.py
tests/test_report_review.py
tests/test_report_validation.py
tests/test_resources.py
tests/test_retrieval_telemetry.py
tests/test_rules_and_profiles.py
tests/test_section_finalize.py
tests/test_section_narrative.py
tests/test_selection.py
tests/test_settlement.py
tests/test_sql_schema.py
tests/test_sql_templates.py
tests/test_sufficiency.py
tests/test_table_rendering.py
tests/test_timezone.py
tests/test_web_api.py