One incident, one window
A phishing email gets reported. It looks like it led to a compromised account and data leaving the network. Run down the whole thing, from the reported email to the exact records touched, without leaving GraphDagger, and without holding a dozen open windows in your head.
Email Forensics
Parse the reported message. SPF, DKIM and DMARC all fail, the sender is spoofed. The routing chain and phishing check flag a malicious link and an attachment.
File Triage
Hash the attachment, run YARA rules and pull strings and IOCs, surfacing an encoded config and a candidate command-and-control domain.
Data Transform
Deobfuscate that config with a decode-and-extract recipe, revealing the full C2 URL and callback interval.
Playwright Inspector
Replay the victim's captured browser trace to watch the credential-harvest page load and the exact requests it fired.
Network Recon
Run WHOIS, DNS and SSL checks on the C2 domain and port-scan the host: registered three days ago, a single open port.
Geo Map
Plot the C2 endpoints and the internal hosts talking to them to see how far the incident reaches.
Packet Capture
Filter live traffic to the C2 addresses and confirm the regular beaconing on the wire.
Web Debugger
Intercept the HTTPS to the C2 and read what's actually leaving in the request bodies.
Auth Inspector
Decode the session token riding that traffic; the security audit flags the weak signing that let it be forged.
API Client
Replay a request with the stolen token to confirm exactly what the attacker could reach.
Remote Terminal
SSH into the auth server, tail the application log live, and pull the full log file back over SFTP.
Log Explorer
Ingest that log with the proxy and firewall logs, group by pattern and use the timeline to pin the initial-access moment and every affected session.
Database Client
Query the session database for every token issued to the attacker's address, scoping exactly which accounts and records were touched.
Thirteen tools, one session, nothing copied between windows, nothing lost in the gaps between them.
The fourteenth, audio analysis, sits this one out. Not every case needs every tool, and GraphDagger doesn't pretend otherwise.