Tools
Tools I’ve built for day-to-day DFIR work. Each one runs entirely in your browser: there’s no account, and nothing you load is uploaded anywhere.
Spoke
See the relationships in your CSVs. Turn rows like who → did what → to what into an interactive graph. Load a CSV or Excel export, map the columns, then filter, follow process chains or insider risk webs, and export what you find.
Good for: Process trees, insider risk, EDR exports, anything that’s really a graph pretending to be a spreadsheet.
Huddle
Build and run DFIR playbooks. Drag incident response plays into the lifecycle phases, connect them with decisions, and export a runbook or work it as a timestamped checklist. Includes templates and an AI-Assisted SOC play library.
Good for: Writing playbooks before the incident and following them during it.