Introduction

Siftbench is artifact-parsing-as-a-service with an agentic analyst on top. Upload forensic artifacts — a registry hive, a browser database, a Velociraptor triage package — and minutes later get normalized, browsable evidence in purpose-built explorers, plus agents that answer investigative questions with mandatory, clickable citations.

A human reviews every conclusion. Nothing ships to a report that an analyst didn't accept.

The core loop

1. Upload a triage package or individual artifacts into a case.
2. Parse — deterministic parsers repair dirty hives, replay SQLite WAL frames, and normalize timestamps.
3. Explore — purpose-built explorers and a unified timeline make verification instant.
4. Ask — deploy an agent against the case with a bounded set of tools.
5. Review — accept or reject each proposed finding; citations open the exact evidence record.

What Siftbench is not

• Not a collector (we ingest KAPE, Velociraptor, UAC, CyLR, and EDR acquisitions).
• Not a full-disk carving suite at MVP.
• Not an EDR or SIEM.
• Not autonomous — agents never accept their own findings.