How sh3n0bi/netforensicai works
NetForensicAI is a local-first digital-forensics workbench: investigators ingest packet captures and endpoint logs into a case, then examine correlated events, entities, detections, findings, and evidence-cited reports. The graph follows that shared workflow and includes investigation, live capture, and optional enrichment capabilities documented in the README. Source excerpts directly establish the ingestion dispatch and persistence path; links for other documented capabilities are limited to their supported module paths.
Main entry points: cli.py CLI · pipeline.py Ingestion pipeline · app.py Local web UI · finding.py Investigator findings
Components 24
Investigator interfaces
- CLI
netforensicai/cli.py - Local web UI
netforensicai/web/app.py
Evidence ingestion
- Case management
netforensicai/core/case.py - Live capture
netforensicai/core/capture.py - Ingestion pipeline
netforensicai/core/pipeline.py - Format parsers
netforensicai/parsers - PCAP engine selection
netforensicai/parsers/pcap_engine.py - Wireshark tools
netforensicai/integrations/wireshark.py
Case analysis
- Case event store
netforensicai/core/store.py - Entity extraction
netforensicai/core/entities.py - Event correlation
netforensicai/core/correlation.py - Unified timeline
netforensicai/core/timeline.py - Deterministic detections
netforensicai/core/detections.py
Investigation outputs
- Packet content search
netforensicai/core/search.py - Indicator investigation
netforensicai/core/investigate.py - IOC feed import
netforensicai/core/ioc.py - Investigator findings
netforensicai/core/finding.py - Reports and export
netforensicai/core/report.py - Custody audit
netforensicai/core/audit.py
Optional enrichment
- AI investigation team
netforensicai/agents/coordinator.py - AI assistant
netforensicai/core/ai_assistant.py - VirusTotal lookup
netforensicai/intel/virustotal.py
Other components
- Investigator
- VirusTotal service
Connections 27
- Investigator → CLI: runs commands
- Investigator → Local web UI: uses UI
- CLI → Case management: manages cases
- Local web UI → Case management: manages cases
- CLI → Ingestion pipeline: parses evidence
- Local web UI → Ingestion pipeline: analyzes uploads
- Live capture → Ingestion pipeline: ingests rotations
- Ingestion pipeline → Format parsers: dispatches parsing
- Format parsers → PCAP engine selection: selects PCAP parser
- PCAP engine selection → Wireshark tools: checks availability
- Ingestion pipeline → Case event store: writes events
- Ingestion pipeline → Entity extraction: extracts entity IDs
- Entity extraction → Case event store: stores entities
- Ingestion pipeline → Custody audit: records ingest
- CLI → Unified timeline: builds timeline
- CLI → Deterministic detections: runs detections
- CLI → Indicator investigation: investigates indicators
- CLI → Packet content search: searches captures
- CLI → IOC feed import: imports feeds
- CLI → Investigator findings: manages findings
- CLI → Reports and export: generates reports
- Local web UI → Unified timeline: views timeline
- Local web UI → Investigator findings: manages findings
- Local web UI → IOC feed import: imports feeds
- AI investigation team → Investigator findings: proposes cited findings
- AI assistant → Investigator: offers assistance
- VirusTotal lookup → VirusTotal service: queries reputation