Automated DFIR software that collects endpoint artifacts and scores them for investigators

Sleuth Kit Labs comes out of a lineage most digital forensics practitioners already know. Brian Carrier wrote The Sleuth Kit, the open-source forensic toolkit, and later Autopsy, the graphical platform built on top of it that is used by tens of thousands of investigators and taught widely in law enforcement training. After more than fifteen years at Basis Technology, Carrier spun the work out as its own company in October 2023 and continues as chief executive. The open-source projects remain, and the commercial product, Cyber Triage, is aimed at the part of an investigation that scales badly: the initial pass over a compromised host.

Cyber Triage takes evidence from several directions, including its own DFIR collector run against a live endpoint, EDR telemetry, full disk images, and data pulled through SIEM integrations. It then applies more than forty malware scanning engines alongside YARA signatures, Hayabusa event-log rules, sandbox analysis and a scoring model that classifies each artifact as malicious, suspicious, benign or unknown. What the analyst receives is not a raw artifact dump but a ranked set of findings with a reconstructed timeline and pointers to related items worth pulling next, with results exported to case management systems and back to the SIEM. Its users are internal incident response teams, SOC analysts validating alerts, IR consultants, and law enforcement.