Skip to content

norandom/investigation-theory

v1.0.1

Guide SOC and DFIR investigations with Investigation Theory's Diagnostic Inquiry workflow. Use for alert triage, evidence and log analysis, phishing, lateral movement, C2, malware, exfiltration, and insider cases. Produces case notes, playbooks, timelines, dispositions, compromise reports, and review diagrams. Excludes detection engineering and offensive work.

GitHubOpen Website
investigation-theory

Guide SOC and DFIR investigations with Investigation Theory's Diagnostic Inquiry workflow. Use for alert triage, evidence and log analysis, phishing, lateral movement, C2, malware, exfiltration, and insider cases. Produces case notes, playbooks, timelines, dispositions, compromise reports, and review diagrams. Excludes detection engineering and offensive work.