From triage collections to a defensible attacker timeline.
Sootmark ingests KAPE and Velociraptor collections, disk images and EDR exports from every host in the case, builds one timeline, and helps your team turn it into findings you can defend. Every finding is one click from its raw bytes. Runs on your workstation or your own server. Nothing leaves your environment.
Windows · macOS · Linux · Works air-gapped · Built with IR consultants in mind
| Time (UTC) | Artifact | Host | Event |
|---|---|---|---|
| 03:11:58 | EVTX 4624 | WS-042 | Logon type 10 · svc_backup from 10.0.4.17 |
| 03:12:07 | Prefetch | WS-042 | RCLONE.EXE executed · run count 3 |
| 03:12:07 | AmCache | WS-042 | rclone.exe first seen · SHA1 4f2e…a91c |
| 03:12:09 | EVTX 4688 | WS-042 | rclone.exe copy \\FS01\finance remote: |
| 03:14:51 | EVTX 4624 | FS01 | Logon type 3 from WS-042 · svc_backup |
| 03:15:02 | USN | FS01 | 1,284 files renamed → *.locked |
Highrclone.exe execution indicated
Indicated by Prefetch (run count 3, last 03:12:07) and Security 4688 (03:12:09). rclone.conf defines a remote of type mega.
The problem
Real cases are forty hosts, three analysts and a deadline.
Today that means a collector, a dozen single-purpose parsers, a CSV viewer, an EVTX hunter, a shared spreadsheet for the attacker timeline and a notes file nobody else can read. Or a heavyweight suite priced per seat.
- Hours of processing before the first real answer
- Findings scattered across CSVs, screenshots and notes
- Corroboration across artifacts done by hand
- The timeline for counsel rebuilt in a spreadsheet every evening
How it works
From collection to deliverable
- 01
Point it at the evidence
KAPE or Velociraptor collections, E01 and VHDX images, EDR and firewall exports, or output from tools you already use. Nothing is copied. Everything is hashed.
- 02
Let it run overnight
Every host is parsed in parallel, on one machine or several. Ingest resumes after a crash or a reboot. High-severity hits show up in minutes.
- 03
Investigate as a team
One timeline across hosts. Pivot, stack, follow logon sessions, triage hits. Assign hosts to analysts and see what nobody has looked at yet.
- 04
Deliver
A curated attacker timeline, tables inserted into your own Word template, a briefing for counsel, an evidence export. Every row traceable to its source.
Features
Everything between collection and report
One workbench replaces the stitching of parsers, CSV viewers, hunters and spreadsheets. It fits between the collector you already use and the report you already write.
One timeline, every host
Every event from every artifact and host in one fast grid: filters, group-by, pinned columns, colour rules, a density histogram and context ±N around any row.
Sessions
Logon IDs, RDP sessions and cloud tokens threaded into activity sessions, so you follow the attacker instead of reading rows.
Hits you can triage
Sigma rules and hunts run during ingest. Each hit shows why it matched. Disposition hits in bulk and tune the noise per case or per firm.
Findings, positive and negative
Point findings, activity intervals and "no evidence of X in the available data" statements, each with its evidence and its coverage.
The attacker timeline
A curated, versioned list of what happened, with the approved wording per row. The deliverable counsel asks for every evening.
IOCs and sweeps
Collect indicators as you go and export sweeps for Velociraptor, Defender, CrowdStrike or YARA to check the rest of the estate.
Built for real cases
Forty hosts. Three analysts. Collections still arriving.
Most tools are designed around one image on one laptop. Sootmark is designed around the case you actually get.
Many hosts, many collections
Pre- and post-containment collections, re-collections and EDR exports per host, with host identities resolved across names, IPs and sensor IDs.
Unattended, resumable ingest
Queue the whole case at night. Work continues after a crash or a Windows Update reboot, and no completed work is ever lost.
Your team, your server
Run the engine on a workstation, a lab server or inside the client's own cloud. Analysts connect from a browser or the desktop app.
Scale out with spare machines
Add workers to parse where the evidence sits. Only results travel. Workers are free: you pay per analyst, not per CPU.
Trust
Built for findings you can defend
A forensic tool is only worth what you can explain to a client, an insurer, counsel or a court.
Local by design
No upload and no telemetry. Runs air-gapped. Any future lookup service will be opt-in, per case, and logged.
Raw bytes beside every interpretation
Every record shows its source file, offset, hash, and the parser and version that read it.
It describes. You conclude.
The tool says "Prefetch shows 3 runs", never "execution confirmed". Artifact caveats are built in, like ShimCache showing presence, not execution.
Nothing hidden silently
Every exclusion, suppressed rule and de-duplication is named, counted, reversible, and exportable as an appendix.
Reproducible
Cases record engine, parser, rule and time-zone database versions, so a peer can re-run the same evidence and get the same output.
Open-source parsers
The parsers will be open source: read the code, check the tests, reproduce any record independently. No black-box AI decides anything.
Workflow
Fits the pipeline you already have
Keep your collector, your EDR and your report template. Sootmark replaces the processing and analysis in between.
Takes in
- KAPE (folder, zip, VHDX)
- Velociraptor
- E01 / VHDX / raw
- Defender XDR
- Firewall & VPN logs
- Microsoft 365
- Google Workspace
- ESXi logs
- EZ Tools / Hayabusa / Plaso
Hands off to
- Your DOCX template
- XLSX / CSV
- Briefing slides
- Evidence package
- Timesketch
- Velociraptor / KQL / YARA sweeps
- STIX / MISP
Case templates
- Ransomware
- ESXi ransomware
- VPN / edge device
- BEC · Microsoft 365
- BEC · Google Workspace
- Web server
- Malware
Pricing
Simple pricing, no sales call
Buy with a card in the middle of an incident. Monthly plans for contractors.
Free
€0
Single-artifact parsers in the browser.
- One artifact type at a time
- Runs in your browser, no upload
- Great for quick checks
Pro
€99/month
For the solo analyst. Or €990/year.
- Unlimited hosts and collections
- Timeline, sessions, hits and findings
- Attacker timeline and report tables
- Desktop app on Windows, macOS, Linux
Team
€1,490/seat/year
For IR firms and MSSPs.
- Everything in Pro
- Self-hosted server for the whole team
- Unlimited processing workers
- Review mode and shared hunt packs
Offline
Custom
For air-gapped and accredited labs.
- Signed offline license and updates
- Version pinning and validation packs
- Perpetual license + maintenance
Planned pricing, shown for early access. Subject to change before launch. Free licenses planned for students, academia and law enforcement.
FAQ
Questions analysts ask
Does my evidence ever leave my environment?
No. Parsing, the timeline, hunts and reports run on your own machines: a workstation, your lab server, or a VM inside the client's cloud. There is no upload step and no telemetry.
Can a team work the same case?
Yes. Run the Sootmark server on a workstation or server you control. Analysts connect from a browser or the desktop app, hosts are assigned, and everyone sees the same timeline, findings and attacker timeline.
How big a case can it handle?
It is designed for cases of around 40 hosts and a few hundred million events on a single workstation, with ingest that runs unattended overnight and resumes after a crash. Add spare machines as workers to go faster.
What can I load?
KAPE output (folder, zip or VHDX), Velociraptor offline collections, E01 and raw images, EDR exports, firewall and VPN logs, Microsoft 365 and Google Workspace logs, and output from EZ Tools, Hayabusa and Plaso.
Does it write the report for me?
No, on purpose. It fills your own Word template with the tables that take hours by hand (attacker timeline, IOCs, hosts, evidence hashes, exclusions) and exports briefings and evidence packages. The narrative and conclusions stay yours.
Does it use AI?
Not to conclude anything. If we add AI assistance, it will run locally, be clearly labelled, point to the records it relies on, and never write findings or report text on its own.
Does it replace AXIOM or X-Ways?
For intrusion and BEC cases, it aims to replace the processing and analysis stitched together from free tools. For deep single-image examinations, many analysts will keep their current suite, and Sootmark exports to it.
When can I use it?
Sootmark is in active development. Join the waitlist for early access and to help shape the first release.
Stop rebuilding the timeline in a spreadsheet.
Join the waitlist for early access. We'll only email you about Sootmark.
Join the waitlist