The Windows WMI (CIM) repository for forensics: namespaces, classes and instances read from OBJECTS.DATA, INDEX.BTR and the MAPPING files, and the event…
The FusionVault transform executor on Apache DataFusion: inline row steps and relational reshapes (join, aggregate, window, union) over Arrow, with the value…
Reports as code: SQL and YAML in git, built into Excel, CSV or fixed-width files and headline messages, delivered to email, SFTP, cloud storage or Slack
omgbase: a versioned, addressable graph layer over authored Markdown — the `omgbase` binary (`omgbase mcp` serves the tool catalog over MCP stdio, with the…
Microsoft Defender for forensics: its detection history files (what was detected, where, when, by which process, for which user, and the file's SHA-256) and…
Windows scheduled tasks for forensics: the task XML files of System32\Tasks and the .job files of older Windows (what runs, as whom, when, hidden or not).
The FusionVault Streams standalone runner: run a stream pipeline defined in one TOML file against Kafka or Redpanda with no control plane, including the…