CIRTKit

CIRTKit is a digital forensics and incident response (DFIR) console built on top of the Viper Framework. The tool serves as an integrated platform for forensic analysis and incident response activities. The console provides a centralized interface for various forensic operations and is designed to integrate with multiple security and forensic tools. Planned integrations include Bit9 for application control, Palo Alto Networks for network security analysis, and EnCase/FTK for comprehensive forensic examination capabilities. CIRTKit includes modules for packet analysis to examine network traffic, JavaScript unpacking and deobfuscation for malware analysis, and integration with the Volatility Memory Analysis Framework for memory forensics. The platform also features a hex viewer and editor for low-level file analysis. The tool incorporates a scripting framework that enables automation of forensic processes and incident response workflows. This allows forensic analysts to create custom scripts and automate repetitive tasks during investigations.