DFIR Companion - Evidence Capture & Push by hasamba

DFIR Companion - Evidence Capture & Push turns your browser into an evidence
collector for digital forensics and incident response work.

It captures screenshots of the investigative consoles you are already working in -
Velociraptor, Splunk, Elastic/Kibana, CrowdStrike Falcon, VirusTotal - and pushes them,
along with the detection rows you are looking at, straight into a case on your DFIR
Companion server. No re-typing, no manual screenshots, no lost context.

You need the DFIR Companion server. This add-on does nothing on its own. The server
is free and open source, runs on your own machine, and is available at
https://github.com/hasamba/DFIR-Companion

• Screenshot capture - one-off from the toolbar button, or ongoing on a console you
  have approved (timer, navigation, or tab switch).
• Push detections - on a recognised security console, send the rows you are viewing
  to your case with one click.
• Right-click send - push a text selection, a table, or a link into the case.

A fresh install has access to no website at all. You approve each console origin
individually, and you can revoke any of them from the popup, the options page, or
Firefox's own controls. It refuses browser-internal pages, local files, and private
windows.


Captures go to the one DFIR Companion address you configure - by default a server on
your own machine - and nowhere else. The add-on sends nothing to its authors, to any
analytics service, or to any third party. There is no telemetry.

Requires Firefox 140 or later. Licensed AGPL-3.0-only.