Incident response for AI agents.

MITRE coverage you can check. Detections that read the tool call.

New in v5. Every ATLAS technique is classified for whether an offline forensic tool can see it at all, tool calls carry what they did without carrying what they said, and cross-case joins say how strong they are. A missing finding is never proof that nothing happened.

• rules coverage — all 208 ATLAS techniques. ATLAS 2026.09 and ATT&CK Enterprise v20.0, pinned by SHA-256. 63 direct, 41 supporting, 14 unobservable, 90 out of scope; 30 of 31 P0 observable techniques have a rule or chain, and the one without (AML.T0077) has a written exception. OWASP LLM 2025 and Agentic 2026 references per technique. Six revoked ATT&CK IDs found by strict validation are migrated, on the record.
• Evidence-aware detections. Tool calls carry argument and result digests, argument names, a few allowlisted and redacted identifiers, the recorded outcome and the recorded approval, never the raw arguments. Ten new rules read them: credentials in an external tool call, an MCP call that breaks its declaration, MCP identity drift, changes in plan mode, permission widened with no recorded approval, recon sweeps, a different method after a block, subagents outside their definition, call loops, actions after non-text input.
• Linked chains. Seven new chains, twenty built in. Steps can be required to share a file, host, tool call, MCP tool, skill or target, and the finding names the shared value (link_reason, redacted).
• correlate-cases --graph. Strong joins (session, agent, delegation or tool-call id, commit, file hash, principal plus resource), moderate and weak ones, each with its time relation and evidence on both sides. Weak joins never raise a finding.

  ATLAS        CLASS       PRI  DET  NAME
  AML.T0086    direct      P0   18   Exfiltration via
                                     AI Agent Tool Invocation
  AML.T0109    direct      P0   6    AI Supply Chain Rug Pull
  AML.T0117    direct      P1   3    Autonomous Attack-Path
                                     Adaptation
  AML.T0077    supporting  P0   exc  LLM Response Rendering

  208/208 classified; P0 observable covered 30/31
# covered = a rule is mapped, not every variant detected

These rules decide no intent: a schema mismatch is not a compromise, a missing approval record is not an unauthorized action, autonomous recon can be legitimate, and a sequence is not causation. A field a parser did not record means no finding, not a clean result. Fixtures are synthetic. Rules, dedupe and limits

From coding agents to every AI evidence source.

New in v4.0. The evidence an investigation runs into is not always a transcript on a live machine. Each new source says plainly what it can prove, and what it reports as unsupported instead of guessing.

• collect --image — straight from the image. E01 (stored MD5/SHA-1 re-checked), raw and split, VHD, VHDX, VMDK; MBR and GPT; NTFS, ext2/3/4, FAT and exFAT, in pure Go, nothing mounted. Only agent files are extracted, each with its partition, inode and MACB times; the image is hashed before and after. BitLocker, APFS and the rest are named, with the route to read them.
• collect --ai-export — the provider's record. ChatGPT, Claude.ai, DeepSeek and Gemini Takeout exports, and the layout of a UFDR, sealed and rebuilt into conversations. An export's tool calls ran in the provider's sandbox, so they are never confirmed against the machine. Browser history adds AI-service visits only with --include-browser: visits, never content.
• More witnesses. Raw .evtx (Sysmon, Security 4688, PowerShell 4104), DNS, web proxy, auth and journald, Kubernetes, GitHub/GitLab and storage access logs. The partial ones confirm; they never contradict a tool call.
• gaps, lineage, correlate-cases. What the case does not show and what to collect next; human → agent → tool call → process → destination with the evidence behind every edge; what several verified cases share.
• Hand-off and self-checks. RSMF 2.0 and production sets for legal review (structural validation, no admissibility claim); extensions for IDE extensions, agent plugins and skills; a synthetic benchmark and an independent Python verifier for .adfir packages.

  E01 stored hashes: md5=match sha1=match
  Volumes (gpt):
    #1  ntfs   read, 2 candidate file(s) extracted
          note: 1 deleted MFT records skipped
  Image re-hash after extraction: unchanged
  profile Users/alice     products: [claude-code]

# nothing on the image was mounted or executed

  UNKNOWN
    1 shell command tool call(s) are unverified:
    no telemetry covers their time.
  VERIFY NEXT — what to collect
    Process telemetry (Sysmon event 1, auditd EXECVE,
    EDR process events) covering 10:00–10:01 UTC
    would verify 1 shell command(s).

Synthetic corpus, stated as such: 100% precision and recall on its own labeled fixtures, which is not real-world accuracy (independent-corpus metrics are separate); 24 of 24 tamper mutations detected; 0 dangling provenance references; packages from five earlier releases still verify. How it is measured

Then make sure it cannot happen again.

agentdfir mitigate turns findings into guardrails in the agents' own settings: Claude Code permissions and a log-guard hook, a Codex rules file, Cursor CLI denies, pinned MCP packages. It shows the plan first, backs up every file, records each change in a hash-chained ledger and can put every byte back.

• Two packs with zero friction, on by default. The agent cannot delete its own transcripts or read cloud keys, SSH keys and browser password stores.
• Seven more, opt-in, each with its cost stated. Ask before uploads, downloaded scripts, persistence, self-modification, destructive commands, and deleting cloud resources or their backups.
• Drift detection. --status re-reads every file and flags a guardrail an agent removed after it went in.
• Or from the browser. On the machine the case came from, the Protect tab previews every file and diff, applies on a click and undoes any change, byte-exact. For a case from another computer it builds the command to run there.

  applied  ~/.claude.json                   id e4fbd3c91cda
  applied  ~/.claude/settings.json          id 9bf8598b55aa
  applied  ~/.codex/rules/agentdfir.rules   id 24715a787929
  applied  ~/.cursor/cli-config.json        id 5a7b3ee2eb39

# the next scan counts only what happens after this
$ agentdfir mitigate --status
e4fbd3c91cda in place  ~/.claude.json            fix
9bf8598b55aa in place  ~/.claude/settings.json   log-protect,secret-paths