How joblinours/defair works
DEFAIR is a DFIR investigation platform: analysts or AI agents use its CLI or MCP interface to register cases and evidence, prepare inputs, run forensic profiles and tools, then inspect normalized artifacts, timelines, and findings. The README documents this overall orchestration; sampled code confirms the MCP-to-container proxy, container management, SQLite-backed artifact search, and normalization behavior. The graph preserves documented capability branches, but some links among unsampled services are intentionally omitted rather than inferred from module names.
Main entry points: database.py Investigation database · tools Forensic tool adapters · server.py MCP server · services Service layer
Components 22
Analyst interfaces
- DEFAIR CLI
src/defair/cli/main.py - MCP server
src/defair/mcp_server/server.py
Investigation management
- Service layer
src/defair/services - Cases and evidence
src/defair/services/case_service.py - Evidence preparation
src/defair/sources/prepare.py
Analysis execution
- Profile and run orchestration
src/defair/orchestrator - Background workers
src/defair/services/worker_service.py - Forensic tool adapters
src/defair/tools - Forensic engines
engines/raijin/src/main.rs - Plaso and Sleuth Kit
src/defair/services/supertimeline_service.py
Results and detection
- Normalization pipeline
src/defair/normalizers/pipeline.py - Artifact inspection
src/defair/services/artifact_service.py - Unified timeline
src/defair/services/timeline_service.py - Findings and detections
src/defair/services/finding_service.py - IOC and artifact search
src/defair/services/search_service.py - Watchlist hunting
src/defair/services/watchlist_service.py - YARA and Sigma scans
src/defair/services/scanning_service.py - Rule management
src/defair/services/rules_service.py
Runtime infrastructure
- Container management
src/defair/services/container_service.py - Investigation database
src/defair/database.py
Other components
- Analyst / agent
- Docker
Connections 25
- Analyst / agent → DEFAIR CLI: issues commands
- Analyst / agent → MCP server: sends MCP requests
- DEFAIR CLI → Service layer: invokes operations
- MCP server → Container management: manages containers
- MCP server → Container management: proxies commands
- Service layer → Cases and evidence: manages cases
- Service layer → Profile and run orchestration: starts investigations
- Cases and evidence → Investigation database: reads and writes
- Evidence preparation → Investigation database: records prepared evidence
- Container management → Docker: controls containers
- Profile and run orchestration → Background workers: dispatches jobs
- Profile and run orchestration → Forensic tool adapters: selects tools
- Background workers → Forensic tool adapters: runs tools
- Forensic tool adapters → Forensic engines: invokes engines
- Forensic tool adapters → Normalization pipeline: normalizes output
- Normalization pipeline → Investigation database: inserts artifacts
- Artifact inspection → Investigation database: reads artifacts
- IOC and artifact search → Investigation database: searches artifacts
- Unified timeline → Investigation database: reads timeline
- Findings and detections → Investigation database: reads findings
- Watchlist hunting → Investigation database: searches case data
- YARA and Sigma scans → Forensic tool adapters: runs scans
- Rule management → YARA and Sigma scans: provides rule sets
- Plaso and Sleuth Kit → Background workers: dispatches timeline jobs
- Plaso and Sleuth Kit → Investigation database: imports timeline events