Forensics Visualization Toolkit (FVT)
Investigators and cybersecurity analysts in law enforcement agencies
Category
Cybersecurity & threat detection
Owner partner
AEGIS
Related use cases
UC1.4.X
Tool summary
Which alerts belong to the same incident? FVT brings security alerts into one case view, groups related events, and shows timelines, graphs and explanations so investigators can check the result against the source alerts.
The challenge
Security teams face more alerts than they can inspect by hand. Signs of an attack can sit among ordinary log events, and it is hard to see which alerts belong to the same incident or which system they concern. Reviewing them one by one is slow, and a shorter list still does not explain how the events fit together.
What it does
FVT helps investigators work through security alerts from monitoring tools. It brings related alerts together as incidents and shows them in one case view, with dashboards, timelines and graphs of the systems and events involved. Each incident can carry a classification and a short explanation linked back to the alerts that produced it. Severity is shown with colour coding, and filters can be applied per case. Investigators review the result and keep the final judgement themselves.