Log Volume as an Investigative Barrier

▶ Watch (02:28)

A freshly installed Windows Server 2022 produces 4 million events before a single user logs in: 3.1 million file system changes, 400,000 registry events, and 350,000 USN journal entries. That count ignores EDR telemetry, which adds more.

Three things compound the problem. The relevant signal hides inside that noise. Analysts cannot be fluent in every log format, since web server logs and Windows event logs look nothing alike. Attackers also abuse built-in system tools to blend with normal traffic. Together, they make manual triage unrealistic at any real scale.

Google’s Open Source Forensic Pipeline

▶ Watch (04:00)

Google’s forensic chain runs through four open source tools. libcloudforensics pulls disk images and console logs from GCP, AWS, or Azure. Plaso parses those artifacts into normalized events. Timesketch loads them into a collaborative timeline. dfTimewolf wraps all three: one command, one recipe, automated end to end.

The Timesketch AI summary demo (08:56) shows the current summarization feature, which condenses 500 events at a time. A six-hour search window still returns 8,000 events, so analysts still page through everything manually. That limitation is what motivated the agent.

Why Naive LLM Approaches Break at Scale

▶ Watch (13:14)

The obvious approach is a ReAct loop: equip Gemini with a fetch tool and let it pull records batch by batch. Three problems kill this. Fetching records steadily fills the context window; with hundreds of millions of events, the agent exhausts its iterations fast. Experimentally, the LLM also loses its reasoning thread as earlier records accumulate. And the audit trail becomes hundreds of pages of interleaved outputs and raw logs that no analyst can verify.

SEGI discards the free-form context representation and replaces it with a structured graph.

The Exploration Graph: Structured Memory for the Agent

▶ Watch (16:23)

SEGI’s exploration graph stores the entire investigation state as nodes. Four types exist: investigative directions (goals the agent sets for itself), fetch-record calls (the actual tool calls), observation summaries (what the LLM found), and findings (confirmed attacker actions). Each round, the LLM does one thing: add nodes. It proposes directions, then writes fetch calls against them, then summarizes the results.

In the exploration graph walkthrough on a Linux VM (18:06), the agent works 1 million records across seven log types with no starting hint.

“it’s doing it all by itself like we’re not guiding it in any” — Alex Kantchelian

Integrating Agent Output into Timesketch for Analyst Review

▶ Watch (22:20)

The Timesketch AI View streams the agent’s work as it runs. On the left, investigative questions appear as the agent generates them. Each question links directly to the Timesketch events the agent flagged, so analysts can see the source logs immediately and confirm results were not hallucinated. From any flagged event, analysts can run a context search to pull the 60 seconds before and after.

At the top of the view, the agent writes a conclusion that analysts can accept or reject. Accepted conclusions roll up into a final investigative report combining agent and analyst input.

Evaluation: 100 Real Compromises, Under $3 Per Case

▶ Watch (25:15)

The evaluation covers 100 real GCP compromises: actual VMs hit by real attackers. Cases average 15 log types and 4 million records; the hardest reach 50 log types and 100 million. Human analysts labeled 38 attacker-linked log records per case on average.

In hinted mode (detection signal provided), SEGI recalls 53% of critical indicators for under $3 per case. Blind threat-hunting drops to 47%.

“it’s still there and still quite usable” — Alex Kantchelian

The CTF challenge blind run (33:21) puts SEGI on parsed disk images from dfirmadness.com with no scenario context. It answers 20 of 30 questions and finds 50% of critical indicators.

Notable Quotes

cut through the weeds. Martin Van Donsk · ▶ 1:30

it’s doing it all by itself like we’re not guiding it in any Alex Kantchelian · ▶ 20:19

it’s still there and still quite usable Alex Kantchelian · ▶ 32:18

Key Takeaways

  • A freshly installed Windows 2022 server produces 4 million log events before any user activity begins.
  • SEGI’s exploration graph lets Gemini process hundreds of millions of records without exhausting its context window.
  • Blind threat hunting on 100 real GCP compromises recovers 53% of critical indicators for under $3 per case.