Open-Source DFIR · Beta · pre-V1

HEIMDALL DFIR

ᚺ · ᛟ · ᚱ · ᚾ · see the invisible, hunt the unknown

An incident should not turn into ten browser tabs, three terminals and a half-broken spreadsheet at 2 a.m. Heimdall takes the evidence, parses the artifacts and keeps timeline, hunting, memory and network context in the same view. It runs on your server. The data stays with you.

⭐ Star on GitHub Run the stack →
—Stars —Forks —Commits —Issues
analyst@soc — heimdall
analyst@soc:~$ git clone https://github.com/RaiseiX/Heimdall-DFIR.git
Cloning into 'Heimdall-DFIR'… done.
analyst@soc:~$ cd Heimdall-DFIR && bash start.sh
[✓] Docker stack up: db · redis · minio · elasticsearch · ollama
[✓] Heimdall ready → http://localhost
0
Forensic modules
0
Event IDs documented
0
Self-hosted
0
Telemetry
Why Heimdall exists
A real investigation should not start with fighting your tools.

When a host is compromised, the clock is already running. A lot of DFIR work still looks like a patchwork: EVTX in one place, memory somewhere else, timeline rebuilt by hand, notes in a file nobody can find later.

The other option is usually a closed suite that keeps case data in a vendor cloud. For sensitive logs, memory dumps or client evidence, that is not always an option.

  • ✕Disconnected tools (EZTools, Volatility, Wireshark, grep) all telling part of the story.
  • ✕Hours burned gluing timelines together from windows, CSV exports and copy-paste.
  • ✕Context disappears fast. Which artifact? Which host? Which case? Easy to lose the thread.
  • ✕Commercial suites are expensive and often cloud-first. Your evidence is no longer fully in your hands.
  • ✕Collaboration turns into email, screenshots and chat messages, not a shared audit-ready workspace.
The answer

Everything in one place, on your box

Heimdall puts the case in one interface you control. The rules are simple:

Self-hosted by default

One bash start.sh starts the stack on your hardware. Evidence does not leave your infra.

Zero telemetry

No tracking, no phone-home, no required account. What lands on the machine stays on the machine.

Everything correlated

Import a collection and the artifacts, timeline, memory, network and detections stay tied to the right case.

Local AI, not cloud

The Ollama copilot is optional and runs on-site. It helps with the case without shipping evidence to an external API.

Forensic hygiene

Hash-chain audit ledger, chain of custody, UTC timestamps. Findings need to survive review.

Open source

MIT license, readable code end to end. No black box around your evidence.

Capabilities

What the tool actually does

From raw import to final report, without switching tools at every step.

Cases & evidence

Each investigation keeps its evidence, notes, hashes, sensitive actions and chain of custody in one place.

Artifact parsing

Drop a KAPE, Velociraptor or CyLR archive. EVTX, MFT, Prefetch, LNK, Shellbags, Amcache and registry data are processed with EZTools and Hayabusa.

Super Timeline

One shared timeline for artifacts. Dynamic columns, grouping, filters, search, bookmarks and CSV export.

Threat hunting

YARA, Sigma, Hayabusa, TAXII/STIX feeds, IOC enrichment and confidence scoring across one evidence item or the whole case.

Memory forensics

VolWeb, Volatility 3, workers and MinIO storage. Pull processes, connections and fileless traces out of a RAM dump.

Network & lateral movement

Interactive graph, 4624/4648/Kerberos events, beaconing, DGA and MITRE ATT&CK context when the logs support it.

Local copilot

Optional Ollama assistant, offline. It reads the case, answers with available context and helps draft a report without a cloud call.

Notes & reports

Notes, pins, analyst presence and forensic PDF generation with section selection.

Knowledge base

Built-in docs for Windows/Linux artifacts, Event IDs, attack patterns and tooling cheat sheets.

How it flows

From raw evidence to a conclusion

One pipeline, five stages. Every step runs inside your own container stack.

Collect

KAPE · CyLR
Velociraptor · RAM

Parse

EZTools · Hayabusa
Volatility 3

Correlate

Super Timeline
Network graph

Hunt

YARA · Sigma
IOC · scoring

AI & Report

Ollama copilot
Forensic PDF

PostgreSQLRedis · BullMQMinIO (S3)ElasticsearchOllamaTraefik · TLSDocker Compose
Who it's for

Built for the people on call

CSIRT

Incident responders

Triage fast, correlate across hosts, and keep a clean chain of custody under pressure.

SOC

Blue teams

Hunt with YARA / Sigma, map lateral movement, and document detections in one place.

DFIR

Forensic consultants

Self-hosted means client evidence stays on your own kit, and the reports come out polished.

EDU

Students & labs

A free, full-stack DFIR environment to learn the craft on real artifacts.

Why Heimdall

Why bother with another tool?

Free scripts are free, but you end up being the integration layer. Commercial suites are slick, but they cost real money and your data lives in their cloud. Heimdall sits in between: a proper platform you run yourself.

It's yours

Self-hosted, full stop. Nothing gets uploaded, nothing's handed to a third party, nothing's tracked. That really matters when the evidence is legally bound.

One window, not twelve

Disk, memory, network, timeline, hunting and reporting, all in the same app. No more losing your train of thought between a dozen terminals and spreadsheets.

Open & free

MIT-licensed. No seats, no quotas, nothing behind a paywall. Read the code, change it, run it forever, whether that's a whole team or one lab.

AI that stays offline

The optional Ollama copilot runs on your machine. It reads the case and helps draft the report without sending a byte to anyone's API.

How it compares

Three ways to run a case

Loose open tools, a cloud suite, or Heimdall. Here's the honest comparison.

Capability
Scattered tools
Cloud suite
Heimdall
Unified timeline across artifacts
Manual / spreadsheet
Yes
Automatic
Memory · disk · network together
Separate tools
Usually
One app
Threat hunting (YARA · Sigma)
CLI, per file
Built-in
Per case, scored
Data stays on your infra
Depends
Vendor cloud
Always
AI copilot
—
Cloud API
Local (Ollama)
Source code
Varies
Closed
Open (MIT)
Cost
Free but slow
$$$ per seat
Free
Workflow

From collection to conclusion

01

Collect & import

Generate a collection agent or drop a KAPE / Velociraptor / CyLR archive. Heimdall detects and parses the artifacts on ingest.

02

Correlate & hunt

Pivot through the Super Timeline, run YARA/Sigma, map the network and lateral movement, and let the AI copilot connect the dots.

03

Report & preserve

Pin evidence, write analyst notes, and export a premium forensic PDF, with hash-chain integrity preserved throughout.

Under the hood

Runs wherever Docker runs

One bash start.sh and the whole stack comes up in Docker. No cloud account, no telemetry, nothing leaving your network.

React + ViteNode · ExpressPostgreSQLRedis · BullMQMinIO (S3)Ollama (local LLM)Volatility 3 · VolWebHayabusa · EZToolsDockerTraefik v3 · TLS
Stands on giants

Built on tools you already trust

No point reinventing EZTools or Volatility. Heimdall just wires them together and stays out of your way.

EZToolsVolatility 3HayabusaYARASigmaVolWebElasticsearchMinIOOllamaDockerTraefikTAXII / STIX EZToolsVolatility 3HayabusaYARASigmaVolWebElasticsearchMinIOOllamaDockerTraefikTAXII / STIX
Security & privacy

Your evidence stays yours

Heimdall is built for data you can't afford to leak. Keeping it on your turf isn't a setting you flip on. It's just how the thing works.

100% self-hosted

The full stack runs on your own server with one bash start.sh. No SaaS, no managed backend, no external dependency to investigate.

Zero telemetry

Heimdall phones no one. No analytics, no usage pings, no crash uploads. Nothing leaves the box unless you explicitly send it.

Hash-chain audit ledger

An HMAC-signed audit trail records sensitive actions, so the chain of custody stays tamper-evident and verifiable.

Hardened access

Role-based access control, dynamic JWT sessions, inactivity logout and automatic case retention keep the platform locked down.

Get started

Up and running in minutes

Requires Docker & Docker Compose. Secrets are generated automatically on first run.

# Clone & launch the full stack
$ git clone https://github.com/RaiseiX/Heimdall-DFIR.git
$ cd Heimdall-DFIR
$ bash start.sh

# Optional: local AI copilot (Ollama)
$ docker compose exec ollama ollama pull qwen2.5:3b
# then pick it in Operations → AI
Roadmap

Where it's headed

Heimdall's still in Beta. Here's what already works, what I'm building right now, and what's left before a stable 1.0.

Shipped done

  • Automated artifact parsing (EVTX · MFT · Prefetch · LNK · Shellbags · Amcache · USN…)
  • Super Timeline: grouping, filters, bookmarks, CSV
  • Threat engine: YARA · Sigma · Hayabusa with ATT&CK scoring
  • Network Intelligence: topology, beaconing, DGA, lateral movement
  • Local AI copilot v2: triage · analysis · narrative agents
  • Memory forensics: VolWeb · Volatility 3
  • Security hardening: HMAC ledger, RBAC, retention
  • Premium forensic PDF reports

In progress now

  • RDP Bitmap Cache parsing (bmc-tools)
  • SIEM forwarding: syslog / webhook
  • Instance banner & PROD/LAB environment badge
  • Admin console refocus → “Operations”
  • Anti-false-positive tuning groundwork
FAQ

Questions, answered

Is it really free?
Yes. Heimdall is open-source under the MIT license. No seats, no quotas, no paywalled modules. Clone it, self-host it, and use it for a whole team or a single lab.
Do I need a GPU?
No. The local AI copilot runs on Ollama in CPU mode with lightweight models like qwen2.5:3b or qwen3.5:4b. A GPU just makes inference faster. It's optional, and so is the copilot itself.
Which artifacts does it parse?
Windows EVTX, MFT, Prefetch, LNK, Shellbags, Amcache, registry hives, USN journal, UserAssist and more, automatically on import (EZTools · Hayabusa). Memory images are handled by Volatility 3 / VolWeb. Network activity is reconstructed from Sysmon and event logs.
Is my data sent anywhere?
Never. Heimdall is 100% self-hosted with zero telemetry: no analytics, no crash reports, no cloud calls. Your evidence stays on your infrastructure unless you explicitly export it.
Is it production-ready?
Heimdall is in active Beta (pre-V1). It's already capable end to end, but it's evolving fast, so use your judgment on critical engagements and keep your own backups. The roadmap above shows what's stabilizing toward 1.0.
What do I need to run it?
Docker and Docker Compose on a single host. A bash start.sh brings up the whole stack and generates secrets on first run. Elasticsearch and the AI model are the heaviest pieces, so plan for a few GB of RAM per active component.
The mission

I got tired of running investigations across a dozen tools that ignore each other, and of watching the polished alternative ship your evidence off to someone else's cloud. So Heimdall keeps the whole case in one place, on hardware you control. That's really the whole idea.

ᚺ — See the invisible. Hunt the unknown.
Get involved

It's all in the open, so jump in

Code, a bug report, or just an idea you want to throw out there. All of it's welcome.

Report a bug

Hit something odd? Open an issue with steps to reproduce. Even a rough one helps move the project forward.

Send a pull request

New parser, detection rule, fix or doc, all welcome. Fork it, build it, open a PR.

Star & share

Not a coder? A star boosts visibility and helps other analysts discover the project. It genuinely matters.
MIT License Self-hosted · 0 telemetry Docker native Beta · pre-V1

Run your next case on Heimdall

It's open-source and MIT-licensed. If it's useful, star it. If something's broken, tell me. If you want to pitch in, even better.

⭐ Star on GitHub Report an issue