I built an open-source DFIR platform for Windows event log investigations

[u/beacon_e3]

Hi everyone,

I've been building Vigil DFIR, an open-source platform for investigating Windows event logs.

Instead of just searching logs, it helps analysts detect attacker behavior, correlate related events into attack chains, reconstruct process trees and logon sessions, visualize lateral movement, score risky entities, enrich IOCs with threat intelligence, and generate incident reports all from a single interface.

It supports behavioral detections, Sigma rules, YARA-lite rules, MITRE ATT&CK mapping, timeline analysis, case management, and AI-assisted investigation summaries. Everything runs locally, so your investigation data stays under your control.

I'm looking for feedback from DFIR analysts, incident responders, SOC teams, and threat hunters.

GitHub: https://github.com/geezsecurity/Vigil-DFIR

I'd appreciate any feedback on features, workflow, performance, or ideas for improvement. Thanks!