The worst hours of an incident are the quiet ones — when nobody can say what the agent did. Here is how those hours end.
That headline is literal. Below, Agent Autopsy takes one real incident — a finance copilot hijacked by prompt injection, escalating privilege and exfiltrating customer data — and turns the scattered logs it left behind into a defensible, stage-by-stage account of what it read, called, changed, and decided.
Answer a few questions — which platforms, what window, which suspects — and Agent Autopsy generates a tailored acquisition plan: the exact export to pull from each platform, the minimum access role it needs, and a realistic time budget. Pre-filled for your incident window.
Two ways to work: one-shot when you're responding to an incident now, or continuous custody — the same collectors on a schedule, so evidence is already under tamper-evident custody before anything goes wrong. The stronger posture, and the one insurers ask about.
./collect/targets/m365-unified-audit/collect.ps1 -Start 2025-07-13 -End 2025-07-15 -OutDir ./out
Drop each export in. Agent Autopsy auto-detects the format, validates it against your incident window, and — this matters for evidence — refuses to guess when a file is ambiguous, instead of silently mis-parsing it.
Every record is committed to an append-only, SHA-256 hash-chained ledger the moment it lands. Custody doesn't start when you export a report; it starts at ingest. Coverage chips show exactly which requested sources have landed and which are still outstanding.
The engine normalizes every source into one time-ordered timeline of agent actions — model calls, tool use, sign-ins, role grants, file access, sends — filterable down to just the reads, the writes, or the egress. Non-human identities are badged on every row.
On top of the timeline, 36 detection rules surface findings as confidence-rated leads — severity and confidence, stated separately — each mapped to OWASP Agentic and MITRE ATT&CK so your SOC and your auditors speak the same language. Findings are leads for the examiner, not verdicts.
1 action sent data across the trust boundary — the materiality trigger for breach notification.
The same agent looks like three different "users" in three different logs. Agent Autopsy resolves them into one actor — agent name, service principal, role ARN — with a stated confidence for every correlation, and renders the investigation graph across all your sources.
Findings then correlate into kill-chain phases — privilege escalation, collection, lateral movement, exfiltration, impact — with multi-agent cascade detection (injection at one agent propagating through delegation to another) and an incident severity score. Time-separated memory-poisoning chains — write → retrieve → act — are reconstructed too.
Agent Autopsy traces from impact back to the earliest enabling event — the one that, if removed, breaks the causal path. Not the earliest timestamp: a causal walk-back along attested links — parent lineage, delegation, memory provenance — with every hop labeled attested or inferred.
And it's honest about the edge of its knowledge. When the evidence is only inferential, it returns "undetermined, low confidence, here are the candidates" — it will not name a confident root it can't prove. In 3,240 benchmark cases it produced zero confident-wrong roots.
Ask the case questions in plain English — how did this start, what was exfiltrated, how far did it spread — and get answers assembled from deterministic queries over the reconstruction, each one carrying its provenance back to the underlying events.
This is not a chatbot riffing on your incident. No model sits between you and the evidence. Every claim in every answer traces to ledger entries you can open.
The product of a forensic tool is the artifact you hand off. One click each: the examiner report for counsel and the board; EU AI Act Art. 73 and Art. 12 regulatory artifacts; STIX 2.1 and raw JSON for your SIEM; and the sealed .case bundle — Ed25519-signed, with the private key never leaving your side.
Anyone holding the bundle — opposing counsel, an insurer, a regulator, a court — can re-verify the entire hash chain and signature themselves, with the embedded public key alone. Verification is free, forever, for everyone. That's the point.
Ed25519 · signer Todd Nelson · private key kept outside the bundle
ledger tip: 42bd4602476f976f258ce400e673b317fc8f92b0…Nothing to install in production. Evidence never leaves your environment — there is no "send us your logs."
Every link labeled attested or inferred. Every conclusion carries its confidence. Ambiguity is stated, not papered over.
Hash-chained ledger, Ed25519-signed bundles, free verification for any third party. No trust required — by design.
A 3,240-case known-truth benchmark, proven non-circular, with results reproducible under evaluation. Read the methodology →
The evidence room is one real incident, fully reconstructed — decode the payloads, trace the cross-source graph, walk the root cause back to patient zero, and open the sealed report. Not a tour. The actual output.