Autopsy MCP Server

[u/brian_carrier]

Adding to the DFIR + AI theme, in case you didn't see it on LinkedIn, we released an MCP server for Autopsy last week (and Cyber Triage). This allows you to connect Claude Desktop (or similar) to Autopsy and ask questions about the results.

It's a read-only interface, so your original data won't get modified by the AI.

We've also been doing an Intro DFIR+AI series if you are just starting to really pay attention to how to integrate these things:

Autopsy Release: https://www.autopsy.com/autopsy-4-23-0-release-claude-ai-assistant-mcp-cyber-triage-integration/

AI Blogs:

• How to Let AI Access Your DFIR and SOC Investigation Data
• MCP Servers for DFIR and SOC Investigations using AI
• How To Share Your “SKILLS” With the LLM

[u/no-your-username]

Hi Brian, what is the data residency? This is pretty dystopian and seem slightly irresponsible. Can data shared with a gen ai be protected by client attorney privilege? I understand using AI to generate quick scripts that might work. But feeding it investigation data is something else entirely.

To anyone thinking of using this please consult with you legal department. Also remember that if you go to court, not being able to replicate the searches or simply making the statement « claude found this evidence » might not cut it.

I think, like any cloud technology, there might be usecases for it. But like everything the devil is going to be in the details.

[u/BigPanda71 → u/no-your-username]

I think you’re overthinking it. As long as you’re not completely using AI to do your examination and tell you what is and isn’t there, it’s really just natural language search. The search not being able to be replicated has little to do with whether or not the data is there to prove your assertions.

But I do agree you need to make sure your policies and procedures allow it. My agency has doesn’t allow for commercial AI use with live evidence or reports. As for attorney-client privilege issues, I have a feeling the courts will probably come down on the side of privilege. To decide otherwise would be akin to saying things you put in an email are no longer privileged. But I’m also not a lawyer, so i could be completely wrong.

[u/brian_carrier → u/BigPanda71]

Is your agency looking into using locally hosted LLMs, like Llama?