DeepSIFT CLAUDE.md

DeepSIFT — CLAUDE.md

This file is read by Claude Code when running on the SANS SIFT Workstation VM. It configures Claude's behavior for forensic investigations using DeepSIFT.

---

Project Overview

DeepSIFT is a Python MCP middleware layer between Claude Code and SANS SIFT forensic tools. It reduces hallucinations by parsing raw tool output into structured JSON before it reaches the LLM, exposing typed functions instead of generic shell commands, and injecting RAG threat intelligence context into every analysis step.

148 typed forensic MCP functions (+ preflight self-check) · 23 tool modules · 15 parser modules · Per-finding RAG enrichment

Status: Production-ready — every tool runs a real forensic binary/parser (no demo/simulation/ placeholder paths), no evidence path is hard-coded, EZ Tools runs are case-isolated, and the RAG corpus ships case-agnostic. Originally built for the Find Evil! (SANS DFIR, Devpost) challenge.

---

Architecture

Claude Code (you)
    ↓ calls typed MCP functions only
DeepSIFT MCP Server (mcp_server/server.py)
    ↓ executes and parses raw output
SIFT Tools (volatility, log2timeline, sleuthkit, yara, ez tools, bulk_extractor, capa, FLOSS, hayabusa)
    ↑ structured JSON returned — never raw text
Middleware Parsers (15 modules — pslist, netscan, malfind, timeline, browser, cloud, document, network_log, linux, mitre_auto_map, rag_enrichment, grounding_verifier, confidence_scorer, forensic_knowledge)
    ↑ RAG enrichment injected per suspicious finding (ChromaDB + MITRE ATT&CK)
    ↑ Forensic knowledge envelope wraps every response (caveats, advisories, corroboration)

---

How to Start an Investigation

1. Start the MCP server (in a separate terminal)

cd /path/to/deepsift
python3 mcp_server/server.py

2. Connect Claude Code to the MCP server

Add to your ~/.config/claude/claude.json or project .claude/settings.json:

{
  "mcpServers": {
    "deepsift": {
      "command": "python3",
      "args": ["/path/to/deepsift/mcp_server/server.py"]
    }
  }
}