DFIR Companion — Evidence Capture & Push
1 rating
)
Overview
Connects to your local DFIR Companion server. Captures screenshots and pushes detections from DFIR consoles to the dashboard.
DFIR Companion-Evidence Capture & Push. requires the local DFIR Companion server (127.0.0.1:4773) to function. It is NOT a standalone tool. WHAT IT DOES: • Captures timed screenshots of SIEM, EDR, and threat-intel web consoles for local AI analysis. • Injects a "Push" button to send detections and alerts directly to your server. • Features offline queuing, auto-sync, and a keyboard toggle (Ctrl+Shift+S). • Per-case Start/Stop management. REQUIREMENTS: The DFIR Companion server must be running locally. Install via Chocolatey, EXE, Docker, AppImage, or Source. SERVER CAPABILITIES: • Runs AI vision analysis to build forensic timelines. • Synthesizes findings, MITRE ATT&CK techniques, and IOCs. • Provides a live dashboard with STIX, HTML, and Markdown exports. Source: https://github.com/hasamba/DFIR-Companion
5 out of 51 rating
Details
- Version0.31.0
- UpdatedJuly 10, 2026
- Offered byhasamba
- Size55.37KiB
- LanguagesEnglish
- Developer
Email
djyaniv@gmail.com - Non-traderThis developer has not identified itself as a trader. For consumers in the European Union, please note that consumer rights do not apply to contracts between you and this developer.
Privacy
DFIR Companion — Evidence Capture & Push has disclosed the following information regarding the collection and usage of your data. More detailed information can be found in the developer's privacy policy.
DFIR Companion — Evidence Capture & Push handles the following:
This developer declares that your data is
- Not being sold to third parties, outside of the approved use cases
- Not being used or transferred for purposes that are unrelated to the item's core functionality
- Not being used or transferred to determine creditworthiness or for lending purposes
Support
For help with questions, suggestions, or problems, visit the developer's support site