01DESIGNING
Forensic Artifact Knowledge Base
TRACE
A Windows-first knowledge base that maps artifacts to investigative questions, collection paths, parsing methods, and evidentiary limits.
ARTIFACT MAPSTRIAGE WORKFLOWSEVIDENCE NOTES
WORKBENCH
Projects
Long-running efforts that turn research into reusable infrastructure: labs, knowledge bases, detections, and investigative workflows.
02BUILDING
Behavior to Analytics
Detection Notebook
A practical collection of detection hypotheses, KQL analytics, telemetry requirements, validation notes, and known failure modes.
KQLVALIDATIONTUNING NOTES
THE STANDARD
Reproducible by design.
01 Define the question before collecting evidence.
02 Document the environment and assumptions.
03 Separate observation from interpretation.
04 Publish limitations beside conclusions.