Triager: An Open-Source Platform for Automated Forensic Triage and Investigation - Souza, Cristian H. M.; Chavarro, Eduardo O.; Batista, Daniel M. (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais Estendidos do XXVI Simpósio Brasileiro de Cibersegurança, 2026)
Digital Forensics and Incident Response (DFIR) investigations commonly require analysts to process heterogeneous Windows artifacts, execute multiple specialized parsers, normalize their outputs, and correlate evidence across several endpoints under strict time constraints. This paper presents Triager, an open-source DFIR automation and investigation platform for Windows triage collections. Triager orchestrates evidence extraction, performs artifact analysis, normalizes results into CSV files, and organizes the findings in a consistent investigation-ready structure. The Web Console imports these results into per-case databases and provides multi-case and multi-machine management, indexed search, filtering, cross-host correlation, unified timelines, IOC scanning, AI-assisted analysis, evidence export, and report generation. By integrating evidence processing and investigation management, Triager reduces repetitive operational work while preserving the use of specialized forensic parsers for artifact extraction.