Agent Autopsy
Product tour · an incident, end to end

From scattered logs to a defensible account — in one sitting.

The worst hours of an incident are the quiet ones — when nobody can say what the agent did. Here is how those hours end.

That headline is literal. Below, Agent Autopsy takes one real incident — a finance copilot hijacked by prompt injection, escalating privilege and exfiltrating customer data — and turns the scattered logs it left behind into a defensible, stage-by-stage account of what it read, called, changed, and decided.

STAGE 01

Collect — from logs you already have. You never write a script.

Answer a few questions — which platforms, what window, which suspects — and Agent Autopsy generates a tailored acquisition plan: the exact export to pull from each platform, the minimum access role it needs, and a realistic time budget. Pre-filled for your incident window.

Two ways to work: one-shot when you're responding to an incident now, or continuous custody — the same collectors on a schedule, so evidence is already under tamper-evident custody before anything goes wrong. The stronger posture, and the one insurers ask about.

Why it matters: no agents to deploy, no SDK to integrate, no waiting on a vendor. If your platforms write logs, you can investigate.
Collection modes
One-shot · post-hocContinuous custody · standing
Microsoft 365 / Copilot (Purview audit)10–30 min
AccessPurview "View-Only Audit Logs" (+ Sensitivity Label Reader)
./collect/targets/m365-unified-audit/collect.ps1 -Start 2025-07-13 -End 2025-07-15 -OutDir ./out
STAGE 02

Ingest — auto-detected, validated, and sealed on arrival.

Drop each export in. Agent Autopsy auto-detects the format, validates it against your incident window, and — this matters for evidence — refuses to guess when a file is ambiguous, instead of silently mis-parsing it.

Every record is committed to an append-only, SHA-256 hash-chained ledger the moment it lands. Custody doesn't start when you export a report; it starts at ingest. Coverage chips show exactly which requested sources have landed and which are still outstanding.

Why it matters: a tool that admits "I can't safely parse this" is a tool whose other answers you can believe.
Ingest evidence
Drop a log export here, or choose a file
JSON / JSONL / CloudTrail — any current connector format
✓ anthropic_api ✓ m365_unified_audit ✓ aws_cloudtrail ✓ idp_logs … llm_gateway
STAGE 03

Reconstruct — one fused timeline, and findings that state their confidence.

The engine normalizes every source into one time-ordered timeline of agent actions — model calls, tool use, sign-ins, role grants, file access, sends — filterable down to just the reads, the writes, or the egress. Non-human identities are badged on every row.

On top of the timeline, 36 detection rules surface findings as confidence-rated leads — severity and confidence, stated separately — each mapped to OWASP Agentic and MITRE ATT&CK so your SOC and your auditors speak the same language. Findings are leads for the examiner, not verdicts.

Why it matters: "critical / high-confidence, here's the technique reference" is a finding a CISO can act on and a board can understand.
Reconstructed timeline
09:02:00NHIAdd app role assignment · entra / Finance Copilotwrite
09:04:00NHIGetObject · s3 / customer-pii ledgerread
09:05:00NHISend · exchange / external recipientegress
Finding · confidence-rated lead
CRITICAL / HIGH F4 · Suspected data exfiltration (egress to external destination)

1 action sent data across the trust boundary — the materiality trigger for breach notification.

OWASP-Agentic: Data ExfiltrationATT&CK TA0010
STAGE 04

Correlate — one actor across every log, and the chain it ran.

The same agent looks like three different "users" in three different logs. Agent Autopsy resolves them into one actor — agent name, service principal, role ARN — with a stated confidence for every correlation, and renders the investigation graph across all your sources.

Findings then correlate into kill-chain phases — privilege escalation, collection, lateral movement, exfiltration, impact — with multi-agent cascade detection (injection at one agent propagating through delegation to another) and an incident severity score. Time-separated memory-poisoning chains — write → retrieve → act — are reconstructed too.

Why it matters: "three suspicious accounts" becomes "one compromised agent, five phases, here's the path" — the sentence your incident commander needs.
Cross-source identity resolution
finance-copilot-agent · anthropic_api svc-finance-copilot@… · m365 / entra role/FinanceCopilotRole · aws
one actorcorrelated · confidence high
Attack chain · 5 phases
privilege escalation collection lateral movement exfiltration impact
STAGE 05

Root cause — walk back to patient zero, honestly.

Agent Autopsy traces from impact back to the earliest enabling event — the one that, if removed, breaks the causal path. Not the earliest timestamp: a causal walk-back along attested links — parent lineage, delegation, memory provenance — with every hop labeled attested or inferred.

And it's honest about the edge of its knowledge. When the evidence is only inferential, it returns "undetermined, low confidence, here are the candidates" — it will not name a confident root it can't prove. In 3,240 benchmark cases it produced zero confident-wrong roots.

Why it matters: the first question counsel asks is "how did this start?" The second is "how sure are you?" This answers both — defensibly.
Evidence path · impact → root
Send → external · EGRESS
observed impact ← same_principal
GetObject · customer-pii
collection ← same_principal
delegate_task · orchestrator → finance-copilot
delegation lineage ← delegation
messages.create · injected instruction
patient zero — attested by source record ← parent_event_id
CONFIDENCE · stated per conclusion — ambiguity is reported, never papered over.
STAGE 06

Ask the analyst — answers assembled from evidence, with provenance.

Ask the case questions in plain English — how did this start, what was exfiltrated, how far did it spread — and get answers assembled from deterministic queries over the reconstruction, each one carrying its provenance back to the underlying events.

This is not a chatbot riffing on your incident. No model sits between you and the evidence. Every claim in every answer traces to ledger entries you can open.

Why it matters: executives get answers in seconds — and every answer survives the follow-up question "show me."
Ask the analyst · grounded Q&A
how did this start what was exfiltrated how far did it spread evidence of prompt injection?
Egress at 09:05:00 — Send to an external recipient by finance-copilot-agent, carrying data read from the customer ledger one minute earlier.provenance: events 9aed5d30 · fb4e750a · ledger-verified
STAGE 07

Hand off — evidence anyone can verify without trusting you. Or us.

The product of a forensic tool is the artifact you hand off. One click each: the examiner report for counsel and the board; EU AI Act Art. 73 and Art. 12 regulatory artifacts; STIX 2.1 and raw JSON for your SIEM; and the sealed .case bundle — Ed25519-signed, with the private key never leaving your side.

Anyone holding the bundle — opposing counsel, an insurer, a regulator, a court — can re-verify the entire hash chain and signature themselves, with the embedded public key alone. Verification is free, forever, for everyone. That's the point.

Why it matters: your investigation doesn't ask to be believed. It invites verification — which is what "evidence-grade" actually means.
Chain of custody
Hash chain INTACT · SIGNED — third-party verifiable

Ed25519 · signer Todd Nelson · private key kept outside the bundle

ledger tip: 42bd4602476f976f258ce400e673b317fc8f92b0…
⬇ Examiner report Sealed .case · signed EU AI Act Art. 73 Art. 12 attestation STIX 2.1
Why it holds up

Built for the room where your findings get challenged.

Agentless & air-gap capable

Nothing to install in production. Evidence never leaves your environment — there is no "send us your logs."

Honest confidence

Every link labeled attested or inferred. Every conclusion carries its confidence. Ambiguity is stated, not papered over.

Independently verifiable

Hash-chained ledger, Ed25519-signed bundles, free verification for any third party. No trust required — by design.

Measurably validated

A 3,240-case known-truth benchmark, proven non-circular, with results reproducible under evaluation. Read the methodology →

See the whole investigation yourself.

The evidence room is one real incident, fully reconstructed — decode the payloads, trace the cross-source graph, walk the root cause back to patient zero, and open the sealed report. Not a tour. The actual output.