skills.rest
rjonhaas
rjonhaasCOMMUNITY
Explore all skills by this author →
GitHub

Daedalus — Adaptive Artifact Handler

Detects forensic artifact classes and maps them to SIFTics phase scripts.

1|Updated Apr 25, 2026
Search Tags:#script generation#dfir#phase orchestration#artifact detection#triage automation#evidence-driven routing#bash workflow
One-click install
npx skills add https://github.com/rjonhaas/SIFTics --skill daedalus-adaptive-artifact-handler
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Daedalus — Adaptive Artifact Handler
Source: https://github.com/rjonhaas/SIFTics/tree/main/skills/daedalus
Command: npx skills add https://github.com/rjonhaas/SIFTics --skill daedalus-adaptive-artifact-handler

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Daedalus prevents wasted DFIR triage effort by ensuring analysis scripts run only when the corresponding evidence artifact is actually present, while also closing gaps when new or variant artifacts appear in a case.

Core Features & Use Cases

  • Deterministic evidence routing: Ensures phases execute based on artifact presence, avoiding irrelevant web, email, or domain work when evidence does not support it.
  • Domain extension for variants: When an artifact belongs to an existing script’s domain but isn’t covered by that script’s handler list, Daedalus extends the owning script with a new section and updates the handler registry.
  • Gap creation for new artifact types: When an artifact has no handler and no owning domain script, Daedalus generates a new SIFTics-compatible phase script, validates it, and registers it in the triage run plan.
  • ISC handoff via run plan: Produces a validated run plan for the Investigation Section Chief, which then sequences the indicated phase scripts without Daedalus executing analysis itself.

Quick Start

Ask the Investigation Section Chief to invoke Daedalus at the start of the case (after Phase 0 evidence fingerprinting) by providing the case root path and mounted evidence path, so it can return the validated run plan to execute.

Frequently Asked Questions about Daedalus — Adaptive Artifact Handler

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate DFIR triage to only run scripts when evidence artifacts are actually present?▼

Evidence-adaptive triage routing ensures DFIR phase scripts execute only when matching artifact classes are detected. Daedalus maps discovered artifacts to the correct SIFTics phase scripts, preventing wasted analysis effort on irrelevant web, email, or domain evidence.

How do I handle new or variant forensic artifacts not covered by existing triage scripts?▼

When new forensic artifact variants appear, gap analysis extends the owning domain script with a new section and updates the handler registry. If the artifact has no owning domain, a new SIFTics-compatible phase script is generated and syntax-validated.

What is the best way to generate and validate new bash workflow scripts for unexpected DFIR evidence classes?▼

Generating bash workflow scripts for unexpected DFIR evidence requires domain classification and extend-or-create decisions. Daedalus builds the new script, performs syntax validation, and registers it in the triage run plan for orchestrated execution.

Do I need an Investigation Section Chief to execute the triage run plan?▼

Yes, the Investigation Section Chief is required to execute the triage run plan. Daedalus builds the validated run plan and hands off the results, but it does not execute the phase scripts or perform analysis itself.

Can I use evidence-adaptive triage automation for cases with entirely new artifact classes?▼

Yes, evidence-adaptive triage automation handles entirely new artifact classes by performing handler discovery and gap creation. Daedalus generates a new SIFTics-compatible phase script, validates it, and registers it in the run plan.

When should I invoke artifact detection and phase orchestration during a DFIR case?▼

Invoke artifact detection and phase orchestration at the start of the case, after Phase 0 evidence fingerprinting. You provide the case root path and mounted evidence path so it can return the validated run plan to execute.

Related Skills

Explore More Software Engineering Skills→
yoyooyoooyoyooyooo
4

logix-perf-observability-loop

Maps performance requirements to runtime owner paths, pressure knobs, counters, and CI artifact gates.

Community
Advanced
66
18

fix-cops

Triage, investigate, and fix corpus false positives in nitrocop.

Community
Advanced
rjonhaasrjonhaas
1

Skill: CVE Attribution (Intel ICS)

Cross-reference investigation narratives and COP data to attribute CVEs.

Community
Advanced
rjonhaasrjonhaas
1

Triage Methodology (Phase Sequencing & Decision Engine)

Orchestrate DFIR triage by sequencing evidence-analysis phases across disk, memory, network, and application artifacts.

Community
Advanced