Method
DFIR Evidence Map Builder
Builds an evidence source matrix and investigation sequence for a selected incident scenario.
Field scoring contract
| Field | Type | Role | Direction | Scored |
|---|---|---|---|---|
| Incident type | select | risk_driver | higher_is_worse | yes |
| Environment | select | risk_driver | higher_is_worse | yes |
| Log source coverage | select | risk_driver | higher_is_worse | yes |
| Known time window | select | risk_driver | higher_is_worse | yes |
| Business impact | select | risk_driver | higher_is_worse | yes |
Limits
- Preliminary output
- Human review required
- Not certification
- Context text is not averaged into numeric scores.
- Outputs require source/evidence review before decisions.