Agent Claude Code
Use proactively when getamcache returns a csvpath. Windows Amcache forensic specialist - SHA-1 hash identification of renamed/deleted malware, loose executable detection, BYOVD driver profiling, compilation time analysis, and historical presence evidence. Returns confirmed IOCs with hashes, paths, and LinkDate…
Agent Claude Code
Use proactively when browser forensics is relevant - Chrome History SQLite at /mnt/disk/Users//AppData/Local/Google/Chrome/User Data/Default/History, Firefox places.sqlite, or Edge equivalent. Browser forensic specialist - local vs synced activity distinction, download URL chains, selective deletion detection, session…
Agent Claude Code
Use proactively after all artifact agents complete and before generatereport. Takes all findings from state.json and stress-tests each one against other artifact sources to confirm, escalate, demote, or dismiss. Applies evidence corroboration chains, stacked anomaly validation, and temporal proximity analysis. Returns…
Agent Claude Code
Use proactively when summarizeevtx returns a csvpath for Security.evtx, System.evtx, or Sysmon logs. Windows event log forensic specialist covering the full attacker lifecycle - authentication anomalies, lateral movement, credential theft, persistence, defense evasion, and NTLM/Kerberos attacks. Returns condensed…
Agent Claude Code
Use ONLY when invoked by the SAVVYDFIR agenttrigger PostToolUse hook to recover a structured JSON contract from a specialist subagent's truncated prose. NEVER investigate. NEVER call tools. Pure transcription / serialization.
Agent Claude Code
Use proactively after listprocesses, scanprocesses, detectinjection, scannetwork, and listdlls have all returned results. Windows memory forensic specialist - rogue process detection, code injection validation, DKOM rootkit detection, network anomalies, C2 indicators, and in-memory artifact recovery. Returns confirmed…
Agent Claude Code
Use proactively when extractmfttimeline returns a csvpath. NTFS MFT forensic specialist - timestomping, attacker file drops, sequential entry clustering, deleted evidence, and ADS detection. Returns condensed findings with true FN timestamps and ATT&CK mappings.
Agent Claude Code
Use proactively when extractprefetch returns a csvpath. Windows Prefetch execution specialist - multi-path execution detection, SysWOW64 LOLBin abuse, referenced file analysis, orphaned prefetch, lateral movement tools, and anti-forensic prefetch deletion. Returns confirmed execution evidence with first/last run…
Agent Claude Code
Use proactively when extractregistryrunkeys returns a csvpath. Windows registry persistence and attacker behavior specialist - ASEP sweep, fileless malware detection, credential theft artifacts, remote registry lateral movement, user behavior profiling, and anti-forensic recovery. Returns condensed findings with key…
Agent Claude Code
Use proactively when sigmahunt returns findingscreated. Chainsaw/Sigma threat detection specialist - validates ATT&CK technique attribution, reduces false positives, correlates Sigma hits with disk/memory/registry findings, and reconstructs the attack timeline from rule-confirmed evidence. Returns condensed…
Agent Claude Code
Use proactively when SRUM CSV output is available from SrumECmd. Windows System Resource Utilization Monitor specialist - data exfiltration quantification (bytes sent per process), human interaction vs automation (foreground time), user SID to network activity mapping, rogue network interface detection, and execution…
Agent Claude Code
Use ONLY when dispatched by the SAVVYDFIR dispatchcorroborationifready hook after ALL artifact-collection lanes (memory, diskexecutionpersistence, eventauth, timelinecorrelation) have closed. Cross-artifact synthesis specialist - stacks 3+ source evidence to promote ACTIVE → CONFIRMED, populates full…
Agent Claude Code
Use proactively after buildtimeline completes and querytimeline returns a CSV path. Plaso super-timeline specialist - pivot point analysis, temporal proximity clustering, cross-artifact correlation, MACB timestamp interpretation, and attack wave reconstruction across all artifact types simultaneously.
Hook Claude Code
Runs when a session starts, executing session-start.py. From kismatkunwar89/SAVVYDFIR-MCP.
Hook Claude Code
Runs before the agent uses a tool for mcp__savvydfir__generate_report and mcp__savvydfir__record_analysis_lane tool calls, executing workflow-enforce-pre.py. From kismatkunwar89/SAVVYDFIR-MCP.
Hook Claude Code
Runs after a tool call finishes for mcp__savvydfir__mount_image, mcp__savvydfir__extract_mft_timeline, mcp__savvydfir__extract_usn_journal, mcp__savvydfir__summarize_evtx, mcp__savvydfir__extract_prefetch, mcp__savvydfir__get_amcache, mcp__savvydfir__extract_shimcache, mcp__savvydfir__extract_registry_run_keys…
Hook Claude Code
Runs when the agent finishes a response, executing stop.py. From kismatkunwar89/SAVVYDFIR-MCP.
Settings file Claude Code
Agent settings declaring 4 hook events (SessionStart, PreToolUse, PostToolUse, Stop) and 66 allowed tools.
Skill Claude CodeCodex
Load when you need to determine which forensic tool to use for a specific Windows artifact type. Maps artifact categories to exact MCP tools and Bash commands using the Practical Windows Forensics taxonomy.
Skill Claude CodeCodex
REQUIRED when the user says "start investigation", "investigate", "analyze case", "Read case-templates/manifest.json", references a manifest.json, or provides a SAVVYDFIR-MCP caseid. Defines the 5-phase DFIR methodology from evidence mounting through report generation, with mandatory tools, decision points, and…
Skill Claude CodeCodex
Load when you have an initial finding and need to determine what to investigate next. Defines universal pivot chains from each artifact type to related evidence, enabling systematic investigation expansion.
Skill Claude CodeCodex
Load when running sigmascan(), interpreting anomaly results, or mapping findings to MITRE ATT&CK techniques. Covers all 5 universal detectors, severity levels, and pivot patterns from each detection type.
Skill Claude CodeCodex
Load when you need exact command syntax for SIFT Workstation tools. Covers Volatility 3, Sleuth Kit, EZ Tools, Plaso, YARA, and Regripper with actual invocation examples and output parsing guidance.
Cursor rule Cursor
IMPORTANT: This project has a knowledge graph. ALWAYS use the code-review-graph MCP tools BEFORE using Grep/Glob/Read to explore the codebase. The graph is faster, cheaper (fewer tokens), and gives you structural context (callers, dependents, test coverage) that file scanning cannot.