Content
# 🧠 AI-Assisted Triage Capstone – Incident Response Simulation
[](https://github.com/ByteBusterNikon/ai-assisted-triage-capstone)
**Author:** MCP Medic Triage Assistant
**Analyst:** David Bustos
**Date:** October 31, 2025
**Confidence Level:** 99% (Confirmed Simulated Compromise)
---
## 📄 Reports
- [Executive Summary (GitHub-Safe)](./Executive_Summary_GitHub_Final.md)
- [Full Report (Educational Version)](./Executive_Summary_Light_Unredacted.md)
- [Formal PDF Layout (For Printing)](./Executive_Summary_PDF_Formatted.md)
---
## 🎯 Repository Overview
This repository demonstrates a **simulated digital forensics and incident response (DFIR)** workflow powered by **AI-assisted triage and reporting**.
The project centers on a fictional Windows host, **win2.mcp.lab**, which experiences a multi-stage malware compromise.
It showcases how **LLMs and automated analysis tools** can enhance detection, investigation, and executive reporting during an incident.
Both public and full versions of the executive summary are provided, formatted for GitHub, Discord, and PDF export.
---
## ⚠️ Educational Disclaimer
> This repository is part of a **cybersecurity capstone exercise**.
> All systems, data, indicators, and network activity are **fictional** and designed for training purposes only.
> No real-world malware, infrastructure, or sensitive information is included.
---
## 📁 Folder Map
Explore the structure and supporting materials of this project.
Each section expands on different parts of the **AI-Assisted Triage & Incident Response** workflow.
| Folder | Description |
|:-------|:-------------|
| [📄 **reports/**](./reports) | Contains all formatted executive summaries and PDF-ready reports generated during the capstone. |
| [🧭 **docs/**](./docs) | Investigation notes, triage flowcharts, prompt logs, and methodology documentation. |
| [💾 **artifacts/**](./artifacts) | Simulated forensic artifacts, IOC samples, and hashes for educational reference. |
| [🖼️ **images/**](./images) | Visuals, diagrams, and storyboard panels used to illustrate investigation stages. |
> 🧠 *All content within this repository is fictional and created for educational demonstration purposes only.*
---
## 🧩 About the Capstone
This capstone combines host triage techniques with **AI-assisted analysis and reporting** using a simulated compromise scenario.
The objective is to test the analyst’s ability to:
- Identify persistence mechanisms
- Detect malicious process activity
- Recognize indicators of network-based compromise
- Summarize findings into an executive report
- Apply **prompt-engineering techniques** to enhance AI-assisted investigation
**Bonus:** Identify additional artifacts, obfuscation methods, and indicators using structured reasoning and automated summarization.
---
## 🤖 How This Simulates AI-Assisted IR Workflows
This project demonstrates how modern LLMs and DFIR tools like *Medic MCP* can:
1. Parse triage data and surface relevant anomalies.
2. Automate executive summary generation in Markdown/PDF formats.
3. Suggest containment and remediation steps using context-aware reasoning.
4. Provide stakeholder-ready communication templates that are concise and professional.
Through this workflow, analysts learn to integrate **human judgment with AI augmentation** — improving efficiency, consistency, and communication across the incident response lifecycle.
---
## 🧾 License & Usage
This repository is distributed for **educational and portfolio purposes only**.
Feel free to fork, study, or adapt this structure for your own DFIR learning and AI experimentation.
---
## 🧾 Repository File Guide
This repository contains multiple versions of the report to serve both educational and professional purposes.
| File | Purpose | Audience | Notes |
|------|----------|-----------|-------|
| `Executive_Summary_GitHub_Final.md` | Public-safe executive summary with redacted indicators | General / Portfolio | Primary file displayed on GitHub |
| `Executive_Summary_Light_Unredacted.md` | Educational full report with technical depth | Capstone / Mentors | Safe for GitHub, contains full analysis |
| `Executive_Summary_PDF_Formatted.md` | Print-ready formal report layout for PDF export | Instructors / Employers | Optimized for PDF formatting and presentation |
> All content is part of a **simulated educational exercise**.
> No real-world data, systems, or malware are represented.
---
_“AI doesn’t replace the analyst — it amplifies their insight.”_
