DFIR AI Pipeline

I don’t have any suggestions but I’ve never felt safer as DFIR. I’ve had sooooo many incidents from Devs making huge mistakes in vibe coded stuff. AI has been helpful in parsing logs and such but it’s just a tool. If anything AI is making me wayyy busier.

I’m sure some vendor’ll pop in to tell you all about their new “AI” product. But no, the AI companies are the ones telling everyone that it’s inevitable and we’ll all be out of jobs soon(tm). They have a vested interest in overselling their product. AI has uses, but the cost-benefit ratio is going to be way off once these companies actually have to turn a profit.

Fusion workflows are a part of the CS suite, it's their SOAR platform that allows automation actions for a wide range of use cases. You can create a custom workflow to download browser history or network contain a host based on X detection. There's a ton of use cases, I recommend asking about it during your procument process.

I havent done any testing personally but playing with the idea I would assume you can infect knwoledge bases to fake out LLMs relying on trivial IOCs, that would like be a mass deception campaign though. Prompt injection is probably the easiest win with filenames, registry values, event log messages, PDF metadata, WMI subscriptions, anything untrusted that ends up in the model's context is fair game if the collector doesn't isolate it. But with CS Fusion there is no agentic model, its just a set of specific instructions you design for the CS Falcon Agent to run. If X equals Y then Z sort of rule set. Same for my agents and claude code set up, I set specific instructions, .md files, and frameworks with industry and corporate context. In the case of true AI DFIR pipelines, the analysis side is probably more interesting and less explored, since if the pipeline RAGs over MISP/OTX/scraped blogs you can plant lookups that misattribute without touching the endpoint at all. And the volume concern kind of breaks down for agents on token budgets doing hierarchical summarization, because real IOCs get quietly compressed away under a flood of plausible junk.

It’s a custom acquisition service orchestrated through CrowdStrike, not a native Falcon full-disk imaging feature. Fusion contains the endpoint and triggers the workflow; the service then attempts a remote forensic disk acquisition, with targeted triage collection as the fallback when a full image is impractical or the host is unstable. I work in a large regulated enterprise environment. The “unlimited AI budget” comment was mostly shorthand for not having meaningful token constraints, so we can provide the models with substantial internal documentation, detection logic, investigation standards, and corporate context. AI assists with analysis and workflow development, but acquisition remains deterministic and the final forensic conclusions still require analyst validation. Imaging is largely automated with a private orchestration handling trained agents.

Becoming a CS customer soon. Can you share more about that?

Vendor hype is pure bs. Nobody in prod runs end-to-end ai dfir pipelines unless they want hallucinated triage reports. If you want FOSS to test poisoning, check OpenCTI or Timesketch with local ollama plugins. Our L2 guy tried piping raw Volatility dumps into Claude last month and the context window choked after 4k events lol. Poison attacks on RAG embeddings work embarrassingly well though.

Nobody in prod runs end-to-end ai dfir pipelines unless they want hallucinated triage reports. Not fully e2e, but pretty close. Hallucinations do still happen but they are significantly rarer than previously - obviously don't blindly trust the model output, but a lot of people mistake building for what the models are now, versus where they'll be in 6, 9, 12 months. By then, given the rate of progress, they'll likely be better than most Seniors at most things (already is at some, tbh, but capabilities can be pretty uneven).

A lot of my work is agentic mostly using Crowdstrike Fusion workflows and a custom CS MCP within Claude Code. I will never use AI for reporting though, mostly cause I end up having to QC it anyway but thats a personally thing. Metrics are pretty easy with AI as well. For full fledge forensic pipelines, I built an imaging service that will attempt to image a host once its been network contained. Collection as a whole can be automated, we based it off blue team runbooks for specific detections. That's been nearly automated with CS Fusion. Analysis for me has been mostly claude skills with industry best practices and intimate corporate context, we also have unlimited AI budget so no concerns with tokens.

Looking for input in terms of what the industry is using in terms of collection and analysis pipelines utilizing AI. I keep seeing non-stop slop posts on social media and forums about how DFIR careers are going out the window because these agents and automation are sooooo good. What exactly is capable of doing this kind of work? Can anyone put a name to it? Public GitHub? Ideally like some FOSS platform I could host for my own testing. I have this fun project idea that involves seeing how easy it is to poison the reporting from these AI driven analysis platforms using a bunch of bogus IOCs, hashes, etc I can plant on the endpoint before collection/analysis. [...] I built an imaging service that will attempt to image a host once its been network contained. -> you built an imaging service for CS ? -> Are you talking about full disk image or triage collection? unlimited AI budget so concerns with tokens? -> What industry are you working?

i think a lot of people on this sub are literally not even in the industry at all. if you work for a serious company, you know that none of this AI stuff is fake and trash. it's always been hard to get into DFIR, there just isn't a surplus of work for it, much like the rest of cyber - there just isn't a lot of it. and, AI isn't making it go away