One incident, one window

A phishing email gets reported. It looks like it led to a compromised account and data leaving the network. Run down the whole thing, from the reported email to the exact records touched, without leaving GraphDagger, and without holding a dozen open windows in your head.

1Triage the report

Email Forensics

Parse the reported message. SPF, DKIM and DMARC all fail, the sender is spoofed. The routing chain and phishing check flag a malicious link and an attachment.

2Break down the payload

File Triage

Hash the attachment, run YARA rules and pull strings and IOCs, surfacing an encoded config and a candidate command-and-control domain.

Data Transform

Deobfuscate that config with a decode-and-extract recipe, revealing the full C2 URL and callback interval.

Playwright Inspector

Replay the victim's captured browser trace to watch the credential-harvest page load and the exact requests it fired.

3Profile the threat

Network Recon

Run WHOIS, DNS and SSL checks on the C2 domain and port-scan the host: registered three days ago, a single open port.

Geo Map

Plot the C2 endpoints and the internal hosts talking to them to see how far the incident reaches.

4Confirm it live

Packet Capture

Filter live traffic to the C2 addresses and confirm the regular beaconing on the wire.

Web Debugger

Intercept the HTTPS to the C2 and read what's actually leaving in the request bodies.

Auth Inspector

Decode the session token riding that traffic; the security audit flags the weak signing that let it be forged.

API Client

Replay a request with the stolen token to confirm exactly what the attacker could reach.

5Scope it and keep the evidence

Remote Terminal

SSH into the auth server, tail the application log live, and pull the full log file back over SFTP.

Log Explorer

Ingest that log with the proxy and firewall logs, group by pattern and use the timeline to pin the initial-access moment and every affected session.

Database Client

Query the session database for every token issued to the attacker's address, scoping exactly which accounts and records were touched.

Thirteen tools, one session, nothing copied between windows, nothing lost in the gaps between them.

The fourteenth, audio analysis, sits this one out. Not every case needs every tool, and GraphDagger doesn't pretend otherwise.