Security engineer building DFIR and incident-response tooling, from acquisition through to a searchable, detection-rich case.
Most of my public work is one suite of standalone forensic tools. They share a set of contracts and normalize everything to Elastic Common Schema v8, so they compose into a pipeline but each one still works on its own.
citadel composes the tools below into a single case workflow: acquire, ingest, parse, normalize, detect, analyze, enrich and report. Each stage is its own repository with its own CLI, so you can run the platform or take one piece and ignore the rest.
| Stage | Tool | What it does |
|---|---|---|
| Acquire | talon | Live or dead-box collection on Windows, Linux and macOS into a hash-verified ZIP. gRPC remote agent over mTLS. |
| Intake | sluice | Identifies and deduplicates each artifact, then routes it to the right parser. |
| Parse | babel | 51 parser packs: EVTX, MFT, Registry, plist, PCAP, browsers, macOS triage, cloud audit. No suite dependencies. |
| Normalize | rosetta | Maps any event stream to ECS v8 and OSSEM through config-driven field maps. |
| Detect | sigil | 231 native rules across 33 ATT&CK-mapped categories, plus Sigma and YARA over the normalized timeline. Detections come back as events. |
| Analyze | anvil | Sandboxed runner for capa, FLOSS, oletools and PE triage, chained in a DAG. |
| Enrich | augur | Indicators to scored, sourced STIX 2.1 via OTX, AbuseIPDB, GreyNoise, Shodan, URLhaus and MISP. |
| Investigate | pilot | LLM agent that forms hypotheses, pivots, and cites the evidence behind every claim. |
| Report | scribe | Case timeline and findings to Markdown, HTML or DOCX. |
| Contracts | citadel-contracts | The event schema, parser contract and artifact taxonomy the rest depend on. |
| Project | What it does |
|---|---|
| cumulonimbus | Cloud forensics and IR toolkit. Collects and normalizes AWS, Azure, GCP and Kubernetes logs to ECS v8. |
| Madeleine | Memory forensics on Volatility3: orchestration, malware detection, timeline, ECS and STIX export. |
| MemoryLane | Forensic imager in Rust with FTK Imager-compatible output. Bit-for-bit E01 and raw acquisition, targeted logical collection, read-back verification, resume. |
| BreadCrumb · breadcrumb-rs | Signature-based file carver plus NTFS/FAT/ext/HFS+/APFS undelete. Two implementations at byte parity — Python as the readable reference, Rust for throughput. |
| CherryPick | Cross-OS acquisition agent producing a signed, content-addressed bundle. Shares Talon's bundle contract, adds pytsk3 imaging and YARA. |
| HoneyJam | Windows Registry forensics analyzer: plugins, malware detection, timelines, ECS export. |
| Pandora-Sandbox | Static malware analysis: PE parsing, IOC and string extraction, YARA, heuristic scoring. |
| atktimeline | Self-hosted attack timeline builder mapping events to MITRE ATT&CK. |
| Project | What it does |
|---|---|
| multilevel-multiusage-desktop | Multi-level workstation on KVM: three isolated VMs on one screen, hotkey-switched, aligned to ANSSI-PA-114. |
| planX | Native macOS task manager with a Kanban board, dependency graph and time tracking (SwiftUI, SwiftData). |
| License | Projects |
|---|---|
| PolyForm Noncommercial 1.0.0 | The Citadel suite: citadel, citadel-contracts, talon, sluice, babel, rosetta, sigil, anvil, augur, pilot, scribe |
| Apache-2.0 | cumulonimbus, Madeleine |
| MIT | BreadCrumb, breadcrumb-rs, MemoryLane, CherryPick, HoneyJam, Pandora-Sandbox, atktimeline, multilevel-multiusage-desktop, planX |
PolyForm Noncommercial is source-available rather than OSI-approved open source: free to run, modify and self-host for noncommercial purposes, with commercial use by written authorization.
Python · Rust · Elasticsearch · Sigma · ECS · STIX · MITRE ATT&CK · Docker · Kubernetes · React · SwiftUI
Incident response · cloud and memory forensics · artifact acquisition · detection engineering