Upload forensics-timeline Space

README.md

@@ -1,12 +1,81 @@
 ---
 title: Forensics Timeline Builder
-emoji: 🦀
-colorFrom: pink
-colorTo: red
+emoji: 🔍
+colorFrom: indigo
+colorTo: purple
 sdk: gradio
-sdk_version: 6.5.1
+sdk_version: 4.44.0
+python_version: "3.10"
 app_file: app.py
 pinned: false
+license: apache-2.0
+tags:
+  - cybersecurity
+  - forensics
+  - dfir
+  - incident-response
+  - timeline
+  - ayinedjimi-consultants
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# Forensics Timeline Builder - Interactive Investigation Tool
+
+An interactive forensic investigation timeline generator that helps security professionals build comprehensive incident response timelines with forensic artifact recommendations and MITRE ATT&CK technique mappings.
+
+## Features
+
+- **Interactive Timeline Visualization**: Gantt chart-based incident response timelines with color-coded phases
+- **Multiple Incident Types**: Support for Ransomware, Data Breach, Insider Threat, APT, Malware Infection, Account Compromise, Web Compromise, and Supply Chain Attacks
+- **Forensic Artifacts**: Detailed recommendations for artifact collection including:
+  - Registry keys and locations
+  - Event logs
+  - Memory dumps and analysis
+  - File system artifacts
+  - Network captures
+  - Tool recommendations
+- **MITRE ATT&CK Mapping**: Relevant MITRE ATT&CK techniques for each incident type
+- **Bilingual Support**: Full English and French interface
+- **Markdown Export**: Export complete incident response timelines as formatted Markdown
+- **Incident Response Phases**:
+  - Preparation
+  - Detection & Analysis
+  - Containment
+  - Eradication
+  - Recovery
+  - Post-Incident
+
+## Deep Resources
+
+This tool links to comprehensive forensics articles:
+
+- [Memory Forensics](https://ayinedjimi-consultants.fr/forensics/memory-forensics.html) - Advanced memory analysis techniques
+- [Registry Forensics](https://ayinedjimi-consultants.fr/forensics/registry-forensics.html) - Windows registry examination
+- [NTFS Forensics](https://ayinedjimi-consultants.fr/forensics/ntfs-forensics.html) - File system analysis
+- [DFIR Tools Comparison](https://ayinedjimi-consultants.fr/forensics/dfir-tools-comparison.html) - Comprehensive tools review
+- [Amcache & Shimcache](https://ayinedjimi-consultants.fr/forensics/amcache-shimcache.html) - Program execution artifacts
+- [ETW & WPR Forensics](https://ayinedjimi-consultants.fr/forensics/etw-wpr-forensics.html) - Event tracing analysis
+- [Evasion & Anti-Forensic](https://ayinedjimi-consultants.fr/forensics/evasion-antiforensic.html) - Evasion techniques
+- [Telemetry Forensics](https://ayinedjimi-consultants.fr/forensics/telemetry-forensics.html) - Telemetry analysis
+- [Windows Server 2025 Forensics](https://ayinedjimi-consultants.fr/forensics/windows-server-2025-forensics.html) - Server-specific forensics
+- [Forensics Report Templates](https://ayinedjimi-consultants.fr/forensics/forensics-report-templates.html) - Report templates
+- [Livre Blanc: Anatomie d'une Attaque Ransomware](https://ayinedjimi-consultants.fr/livre-blanc-anatomie-attaque-ransomware.html) - Ransomware analysis whitepaper
+
+## How to Use
+
+1. Select your language (English or Francais)
+2. Choose an incident type from the dropdown
+3. Click "Generate Timeline" to create the visualization
+4. Explore the different tabs:
+   - **Timeline Visualization**: Interactive Gantt chart of phases and tasks
+   - **Forensic Artifacts**: Detailed artifact collection guidance
+   - **MITRE ATT&CK**: Relevant techniques for the incident type
+   - **Export**: Export the complete timeline as Markdown
+   - **Resources**: Links to comprehensive forensics articles
+
+## Author
+
+Created by [Ayinedjimi Consultants](https://ayinedjimi-consultants.fr/bio.html) - Your Digital Forensics and Incident Response Partner
+
+## License
+
+Apache License 2.0

app.py

@@ -0,0 +1,1100 @@
+import gradio as gr
+import plotly.express as px
+import pandas as pd
+from datetime import datetime, timedelta
+import json
+
+# Define incident types and their timelines
+INCIDENT_DATA = {
+    "Ransomware": {
+        "en": {
+            "phases": {
+                "Preparation": {
+                    "duration_days": 14,
+                    "tasks": [
+                        {"task": "Network reconnaissance", "duration": 3},
+                        {"task": "Vulnerability scanning", "duration": 4},
+                        {"task": "Credential gathering", "duration": 5},
+                        {"task": "Lateral movement setup", "duration": 2}
+                    ]
+                },
+                "Detection & Analysis": {
+                    "duration_days": 2,
+                    "tasks": [
+                        {"task": "Alert detection", "duration": 0.5},
+                        {"task": "Initial investigation", "duration": 1},
+                        {"task": "Scope determination", "duration": 0.5}
+                    ]
+                },
+                "Containment": {
+                    "duration_days": 4,
+                    "tasks": [
+                        {"task": "Isolate affected systems", "duration": 1},
+                        {"task": "Disable network shares", "duration": 1},
+                        {"task": "Block C2 communications", "duration": 1},
+                        {"task": "Reset credentials", "duration": 1}
+                    ]
+                },
+                "Eradication": {
+                    "duration_days": 7,
+                    "tasks": [
+                        {"task": "Remove malware", "duration": 2},
+                        {"task": "Patch vulnerabilities", "duration": 3},
+                        {"task": "Remove backdoors", "duration": 2}
+                    ]
+                },
+                "Recovery": {
+                    "duration_days": 10,
+                    "tasks": [
+                        {"task": "Restore from backups", "duration": 5},
+                        {"task": "System validation", "duration": 3},
+                        {"task": "User retraining", "duration": 2}
+                    ]
+                },
+                "Post-Incident": {
+                    "duration_days": 5,
+                    "tasks": [
+                        {"task": "Incident report", "duration": 2},
+                        {"task": "Lessons learned", "duration": 2},
+                        {"task": "Policy updates", "duration": 1}
+                    ]
+                }
+            },
+            "artifacts": {
+                "Registry": {
+                    "keys": [
+                        "HKLM\\SYSTEM\\CurrentControlSet\\Services",
+                        "HKLM\\SOFTWARE\\Microsoft\\Windows\\Run",
+                        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
+                        "HKLM\\SYSTEM\\CurrentControlSet\\Control\\CrashControl"
+                    ],
+                    "tools": ["Registry Explorer", "RegRipper", "Volatility"]
+                },
+                "Event Logs": {
+                    "keys": [
+                        "Security Event Log (4688, 4689, 4625)",
+                        "System Event Log (1000, 1001)",
+                        "Application Event Log",
+                        "Sysmon Logs (Process creation, Network connection)"
+                    ],
+                    "tools": ["Event Viewer", "LogParser", "Volatility"]
+                },
+                "Memory": {
+                    "keys": [
+                        "RAM dump (hiberfil.sys, memory.dmp)",
+                        "Process memory (running processes)",
+                        "Kernel memory (malware hooks)",
+                        "Network connections in memory"
+                    ],
+                    "tools": ["Volatility", "WinDbg", "DumpIt"]
+                },
+                "File System": {
+                    "keys": [
+                        "Ransomware note files",
+                        "Encrypted file extensions",
+                        "Modified timestamps (MFT)",
+                        "Deleted files ($Recycle.Bin)"
+                    ],
+                    "tools": ["FTK Imager", "Autopsy", "EnCase"]
+                },
+                "Network": {
+                    "keys": [
+                        "Network traffic captures",
+                        "Firewall logs",
+                        "DNS query logs",
+                        "NetFlow data"
+                    ],
+                    "tools": ["Wireshark", "tcpdump", "Zeek"]
+                }
+            },
+            "mitre_techniques": [
+                "T1566.002 - Phishing: Spearphishing Link",
+                "T1190 - Exploit Public-Facing Application",
+                "T1078 - Valid Accounts",
+                "T1570 - Lateral Tool Transfer",
+                "T1486 - Data Encrypted for Impact",
+                "T1570 - Lateral Tool Transfer"
+            ]
+        },
+        "fr": {
+            "phases": {
+                "Preparation": {
+                    "duration_days": 14,
+                    "tasks": [
+                        {"task": "Reconnaissance du reseau", "duration": 3},
+                        {"task": "Scan de vulnerabilites", "duration": 4},
+                        {"task": "Collecte d'identifiants", "duration": 5},
+                        {"task": "Configuration du mouvement lateral", "duration": 2}
+                    ]
+                },
+                "Detection & Analysis": {
+                    "duration_days": 2,
+                    "tasks": [
+                        {"task": "Detection d'alerte", "duration": 0.5},
+                        {"task": "Investigation initiale", "duration": 1},
+                        {"task": "Determination de la portee", "duration": 0.5}
+                    ]
+                },
+                "Containment": {
+                    "duration_days": 4,
+                    "tasks": [
+                        {"task": "Isolation des systemes affectes", "duration": 1},
+                        {"task": "Desactivation des partages reseau", "duration": 1},
+                        {"task": "Blocage des communications C2", "duration": 1},
+                        {"task": "Reinitialisation des identifiants", "duration": 1}
+                    ]
+                },
+                "Eradication": {
+                    "duration_days": 7,
+                    "tasks": [
+                        {"task": "Suppression de logiciels malveillants", "duration": 2},
+                        {"task": "Correction des vulnerabilites", "duration": 3},
+                        {"task": "Suppression des portes derriere", "duration": 2}
+                    ]
+                },
+                "Recovery": {
+                    "duration_days": 10,
+                    "tasks": [
+                        {"task": "Restauration a partir des sauvegardes", "duration": 5},
+                        {"task": "Validation du systeme", "duration": 3},
+                        {"task": "Formation des utilisateurs", "duration": 2}
+                    ]
+                },
+                "Post-Incident": {
+                    "duration_days": 5,
+                    "tasks": [
+                        {"task": "Rapport d'incident", "duration": 2},
+                        {"task": "Lecons apprises", "duration": 2},
+                        {"task": "Mise a jour des politiques", "duration": 1}
+                    ]
+                }
+            },
+            "artifacts": {
+                "Registre": {
+                    "keys": [
+                        "HKLM\\SYSTEM\\CurrentControlSet\\Services",
+                        "HKLM\\SOFTWARE\\Microsoft\\Windows\\Run",
+                        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
+                        "HKLM\\SYSTEM\\CurrentControlSet\\Control\\CrashControl"
+                    ],
+                    "tools": ["Registry Explorer", "RegRipper", "Volatility"]
+                },
+                "Journaux d'evenements": {
+                    "keys": [
+                        "Journal de securite (4688, 4689, 4625)",
+                        "Journal systeme (1000, 1001)",
+                        "Journal d'application",
+                        "Journaux Sysmon (Creation de processus, Connexion reseau)"
+                    ],
+                    "tools": ["Observateur d'evenements", "LogParser", "Volatility"]
+                },
+                "Memoire": {
+                    "keys": [
+                        "Image RAM (hiberfil.sys, memory.dmp)",
+                        "Memoire de processus (processus en cours)",
+                        "Memoire du noyau (crochets de logiciels malveillants)",
+                        "Connexions reseau en memoire"
+                    ],
+                    "tools": ["Volatility", "WinDbg", "DumpIt"]
+                },
+                "Systeme de fichiers": {
+                    "keys": [
+                        "Fichiers de note de rancongiciel",
+                        "Extensions de fichiers chiffres",
+                        "Horodatages modifies (MFT)",
+                        "Fichiers supprimes ($Recycle.Bin)"
+                    ],
+                    "tools": ["FTK Imager", "Autopsy", "EnCase"]
+                },
+                "Reseau": {
+                    "keys": [
+                        "Captures de trafic reseau",
+                        "Journaux de pare-feu",
+                        "Journaux de requetes DNS",
+                        "Donnees NetFlow"
+                    ],
+                    "tools": ["Wireshark", "tcpdump", "Zeek"]
+                }
+            },
+            "mitre_techniques": [
+                "T1566.002 - Phishing: Lien de spear-phishing",
+                "T1190 - Exploitation d'application exposee publiquement",
+                "T1078 - Comptes valides",
+                "T1570 - Transfert lateral d'outils",
+                "T1486 - Donnees chiffrees pour impact",
+                "T1570 - Transfert lateral d'outils"
+            ]
+        }
+    },
+    "Data Breach": {
+        "en": {
+            "phases": {
+                "Preparation": {
+                    "duration_days": 21,
+                    "tasks": [
+                        {"task": "Target identification", "duration": 5},
+                        {"task": "Social engineering", "duration": 8},
+                        {"task": "Access establishment", "duration": 5},
+                        {"task": "Data exfiltration setup", "duration": 3}
+                    ]
+                },
+                "Detection & Analysis": {
+                    "duration_days": 3,
+                    "tasks": [
+                        {"task": "Unusual access detected", "duration": 0.5},
+                        {"task": "Data movement analysis", "duration": 1.5},
+                        {"task": "Compromised accounts identified", "duration": 1}
+                    ]
+                },
+                "Containment": {
+                    "duration_days": 2,
+                    "tasks": [
+                        {"task": "Revoke access tokens", "duration": 0.5},
+                        {"task": "Block data exfiltration", "duration": 0.5},
+                        {"task": "Alert users", "duration": 1}
+                    ]
+                },
+                "Eradication": {
+                    "duration_days": 5,
+                    "tasks": [
+                        {"task": "Close unauthorized access points", "duration": 2},
+                        {"task": "Remove stolen data", "duration": 2},
+                        {"task": "Patch vulnerabilities", "duration": 1}
+                    ]
+                },
+                "Recovery": {
+                    "duration_days": 7,
+                    "tasks": [
+                        {"task": "Restore security controls", "duration": 3},
+                        {"task": "Credential reset", "duration": 2},
+                        {"task": "System verification", "duration": 2}
+                    ]
+                },
+                "Post-Incident": {
+                    "duration_days": 10,
+                    "tasks": [
+                        {"task": "Breach notification", "duration": 3},
+                        {"task": "Regulatory compliance", "duration": 4},
+                        {"task": "Customer communication", "duration": 3}
+                    ]
+                }
+            },
+            "artifacts": {
+                "Event Logs": {
+                    "keys": [
+                        "Account logon events (4624, 4625)",
+                        "Privileged use (4672)",
+                        "Object access (4660, 4663)",
+                        "Sysmon network connections"
+                    ],
+                    "tools": ["Event Viewer", "LogParser", "Splunk"]
+                },
+                "Database": {
+                    "keys": [
+                        "Database audit logs",
+                        "Query execution logs",
+                        "User access logs",
+                        "Data export records"
+                    ],
+                    "tools": ["Database native tools", "SQL Profiler", "Splunk"]
+                },
+                "Network": {
+                    "keys": [
+                        "Firewall logs (data egress)",
+                        "Proxy logs",
+                        "DLP alerts",
+                        "Network flow data"
+                    ],
+                    "tools": ["Wireshark", "Zeek", "Splunk"]
+                },
+                "File System": {
+                    "keys": [
+                        "File access timestamps",
+                        "Copy operations",
+                        "Deleted recovery files",
+                        "Temp file artifacts"
+                    ],
+                    "tools": ["FTK Imager", "Autopsy", "EnCase"]
+                },
+                "Memory": {
+                    "keys": [
+                        "Active network connections",
+                        "Running processes",
+                        "Loaded modules",
+                        "Open files"
+                    ],
+                    "tools": ["Volatility", "WinDbg", "ProcessMonitor"]
+                }
+            },
+            "mitre_techniques": [
+                "T1040 - Traffic Capture or Redirection",
+                "T1557 - Man-in-the-Middle",
+                "T1111 - Multi-Stage Channels",
+                "T1020 - Automated Exfiltration",
+                "T1041 - Exfiltration Over C2 Channel",
+                "T1567 - Exfiltration Over Web Service"
+            ]
+        },
+        "fr": {
+            "phases": {
+                "Preparation": {
+                    "duration_days": 21,
+                    "tasks": [
+                        {"task": "Identification de la cible", "duration": 5},
+                        {"task": "Ingenierie sociale", "duration": 8},
+                        {"task": "Etablissement d'acces", "duration": 5},
+                        {"task": "Configuration d'exfiltration", "duration": 3}
+                    ]
+                },
+                "Detection & Analysis": {
+                    "duration_days": 3,
+                    "tasks": [
+                        {"task": "Acces anormal detecte", "duration": 0.5},
+                        {"task": "Analyse des mouvements de donnees", "duration": 1.5},
+                        {"task": "Comptes compromis identifies", "duration": 1}
+                    ]
+                },
+                "Containment": {
+                    "duration_days": 2,
+                    "tasks": [
+                        {"task": "Revoquer les jetons d'acces", "duration": 0.5},
+                        {"task": "Bloquer l'exfiltration", "duration": 0.5},
+                        {"task": "Alerter les utilisateurs", "duration": 1}
+                    ]
+                },
+                "Eradication": {
+                    "duration_days": 5,
+                    "tasks": [
+                        {"task": "Fermer les points d'acces non autorises", "duration": 2},
+                        {"task": "Supprimer les donnees volees", "duration": 2},
+                        {"task": "Corriger les vulnerabilites", "duration": 1}
+                    ]
+                },
+                "Recovery": {
+                    "duration_days": 7,
+                    "tasks": [
+                        {"task": "Restaurer les controles de securite", "duration": 3},
+                        {"task": "Reinitialisation des identifiants", "duration": 2},
+                        {"task": "Verification du systeme", "duration": 2}
+                    ]
+                },
+                "Post-Incident": {
+                    "duration_days": 10,
+                    "tasks": [
+                        {"task": "Notification de violation", "duration": 3},
+                        {"task": "Conformite reglementaire", "duration": 4},
+                        {"task": "Communication avec les clients", "duration": 3}
+                    ]
+                }
+            },
+            "artifacts": {
+                "Journaux d'evenements": {
+                    "keys": [
+                        "Evenements de connexion au compte (4624, 4625)",
+                        "Utilisation privilegiee (4672)",
+                        "Acces aux objets (4660, 4663)",
+                        "Connexions reseau Sysmon"
+                    ],
+                    "tools": ["Observateur d'evenements", "LogParser", "Splunk"]
+                },
+                "Base de donnees": {
+                    "keys": [
+                        "Journaux d'audit de la base de donnees",
+                        "Journaux d'execution des requetes",
+                        "Journaux d'acces des utilisateurs",
+                        "Enregistrements d'exportation de donnees"
+                    ],
+                    "tools": ["Outils natifs de base de donnees", "SQL Profiler", "Splunk"]
+                },
+                "Reseau": {
+                    "keys": [
+                        "Journaux de pare-feu (sortie de donnees)",
+                        "Journaux proxy",
+                        "Alertes DLP",
+                        "Donnees de flux reseau"
+                    ],
+                    "tools": ["Wireshark", "Zeek", "Splunk"]
+                },
+                "Systeme de fichiers": {
+                    "keys": [
+                        "Horodatages d'acces aux fichiers",
+                        "Operations de copie",
+                        "Fichiers de recuperation supprimes",
+                        "Artefacts de fichier temporaire"
+                    ],
+                    "tools": ["FTK Imager", "Autopsy", "EnCase"]
+                },
+                "Memoire": {
+                    "keys": [
+                        "Connexions reseau actives",
+                        "Processus en cours d'execution",
+                        "Modules charges",
+                        "Fichiers ouverts"
+                    ],
+                    "tools": ["Volatility", "WinDbg", "ProcessMonitor"]
+                }
+            },
+            "mitre_techniques": [
+                "T1040 - Capture ou redirection du trafic",
+                "T1557 - Attaque de l'homme au milieu",
+                "T1111 - Canaux multi-etapes",
+                "T1020 - Exfiltration automatisee",
+                "T1041 - Exfiltration sur canal C2",
+                "T1567 - Exfiltration sur service Web"
+            ]
+        }
+    },
+    "Insider Threat": {
+        "en": {
+            "phases": {
+                "Preparation": {
+                    "duration_days": 7,
+                    "tasks": [
+                        {"task": "Motivation analysis", "duration": 2},
+                        {"task": "Access planning", "duration": 3},
+                        {"task": "Data targeting", "duration": 2}
+                    ]
+                },
+                "Detection & Analysis": {
+                    "duration_days": 4,
+                    "tasks": [
+                        {"task": "Behavioral anomaly detection", "duration": 1},
+                        {"task": "User activity analysis", "duration": 1.5},
+                        {"task": "Data exfiltration confirmation", "duration": 1.5}
+                    ]
+                },
+                "Containment": {
+                    "duration_days": 1,
+                    "tasks": [
+                        {"task": "Account suspension", "duration": 0.5},
+                        {"task": "Data access revocation", "duration": 0.5}
+                    ]
+                },
+                "Eradication": {
+                    "duration_days": 3,
+                    "tasks": [
+                        {"task": "Remove access credentials", "duration": 1},
+                        {"task": "Recover exfiltrated data", "duration": 2}
+                    ]
+                },
+                "Recovery": {
+                    "duration_days": 5,
+                    "tasks": [
+                        {"task": "Restore access controls", "duration": 2},
+                        {"task": "Audit other user activities", "duration": 2},
+                        {"task": "Data integrity verification", "duration": 1}
+                    ]
+                },
+                "Post-Incident": {
+                    "duration_days": 14,
+                    "tasks": [
+                        {"task": "Legal proceedings", "duration": 7},
+                        {"task": "Security awareness training", "duration": 3},
+                        {"task": "Policy enforcement review", "duration": 4}
+                    ]
+                }
+            },
+            "artifacts": {
+                "Event Logs": {
+                    "keys": [
+                        "Logon/Logoff events (4624, 4634)",
+                        "Privileged activity (4672, 4648)",
+                        "File access logs (4660, 4663)",
+                        "Object deletion (4659)"
+                    ],
+                    "tools": ["Event Viewer", "Splunk", "ELK Stack"]
+                },
+                "User Behavior": {
+                    "keys": [
+                        "Email activity logs",
+                        "File access patterns",
+                        "Unusual working hours",
+                        "Data bulk downloads"
+                    ],
+                    "tools": ["UEBA tools", "Splunk", "Insider Threat tools"]
+                },
+                "Endpoint": {
+                    "keys": [
+                        "USB device connections",
+                        "Process execution",
+                        "Network connections",
+                        "Clipboard contents"
+                    ],
+                    "tools": ["Volatility", "ProcessMonitor", "Wireshark"]
+                },
+                "Network": {
+                    "keys": [
+                        "Email server logs",
+                        "FTP/SFTP activity",
+                        "Cloud storage access",
+                        "Web proxy logs"
+                    ],
+                    "tools": ["Zeek", "Splunk", "Wireshark"]
+                },
+                "File System": {
+                    "keys": [
+                        "File modification times",
+                        "Access control lists",
+                        "Deleted file recovery",
+                        "Shadow copies"
+                    ],
+                    "tools": ["FTK Imager", "Autopsy", "EnCase"]
+                }
+            },
+            "mitre_techniques": [
+                "T1005 - Data Staged Local",
+                "T1020 - Automated Exfiltration",
+                "T1048 - Exfiltration Over Alternative Protocol",
+                "T1567 - Exfiltration Over Web Service",
+                "T1030 - Data Transfer Size Limits",
+                "T1123 - Audio Capture"
+            ]
+        },
+        "fr": {
+            "phases": {
+                "Preparation": {
+                    "duration_days": 7,
+                    "tasks": [
+                        {"task": "Analyse de la motivation", "duration": 2},
+                        {"task": "Planification de l'acces", "duration": 3},
+                        {"task": "Ciblage des donnees", "duration": 2}
+                    ]
+                },
+                "Detection & Analysis": {
+                    "duration_days": 4,
+                    "tasks": [
+                        {"task": "Detection d'anomalie comportementale", "duration": 1},
+                        {"task": "Analyse de l'activite des utilisateurs", "duration": 1.5},
+                        {"task": "Confirmation d'exfiltration de donnees", "duration": 1.5}
+                    ]
+                },
+                "Containment": {
+                    "duration_days": 1,
+                    "tasks": [
+                        {"task": "Suspension du compte", "duration": 0.5},
+                        {"task": "Revocation d'acces aux donnees", "duration": 0.5}
+                    ]
+                },
+                "Eradication": {
+                    "duration_days": 3,
+                    "tasks": [
+                        {"task": "Supprimer les identifiants d'acces", "duration": 1},
+                        {"task": "Recuperer les donnees exfiltrees", "duration": 2}
+                    ]
+                },
+                "Recovery": {
+                    "duration_days": 5,
+                    "tasks": [
+                        {"task": "Restaurer les controles d'acces", "duration": 2},
+                        {"task": "Audit des autres activites utilisateur", "duration": 2},
+                        {"task": "Verification de l'integrite des donnees", "duration": 1}
+                    ]
+                },
+                "Post-Incident": {
+                    "duration_days": 14,
+                    "tasks": [
+                        {"task": "Procedures judiciaires", "duration": 7},
+                        {"task": "Formation de sensibilisation a la securite", "duration": 3},
+                        {"task": "Examen de l'application de la politique", "duration": 4}
+                    ]
+                }
+            },
+            "artifacts": {
+                "Journaux d'evenements": {
+                    "keys": [
+                        "Evenements de connexion/deconnexion (4624, 4634)",
+                        "Activite privilegiee (4672, 4648)",
+                        "Journaux d'acces aux fichiers (4660, 4663)",
+                        "Suppression d'objets (4659)"
+                    ],
+                    "tools": ["Observateur d'evenements", "Splunk", "Stack ELK"]
+                },
+                "Comportement de l'utilisateur": {
+                    "keys": [
+                        "Journaux d'activite de la messagerie",
+                        "Modeles d'acces aux fichiers",
+                        "Heures de travail inhabituelles",
+                        "Telechargements en masse de donnees"
+                    ],
+                    "tools": ["Outils UEBA", "Splunk", "Outils de menace interieure"]
+                },
+                "Point terminal": {
+                    "keys": [
+                        "Connexions de periferiques USB",
+                        "Execution de processus",
+                        "Connexions reseau",
+                        "Contenu du presse-papiers"
+                    ],
+                    "tools": ["Volatility", "ProcessMonitor", "Wireshark"]
+                },
+                "Reseau": {
+                    "keys": [
+                        "Journaux du serveur de messagerie",
+                        "Activite FTP/SFTP",
+                        "Acces au stockage en nuage",
+                        "Journaux proxy Web"
+                    ],
+                    "tools": ["Zeek", "Splunk", "Wireshark"]
+                },
+                "Systeme de fichiers": {
+                    "keys": [
+                        "Temps de modification des fichiers",
+                        "Listes de controle d'acces",
+                        "Recuperation de fichiers supprimes",
+                        "Copies fantome"
+                    ],
+                    "tools": ["FTK Imager", "Autopsy", "EnCase"]
+                }
+            },
+            "mitre_techniques": [
+                "T1005 - Donnees preparees localement",
+                "T1020 - Exfiltration automatisee",
+                "T1048 - Exfiltration sur protocole alternatif",
+                "T1567 - Exfiltration sur service Web",
+                "T1030 - Limites de taille de transfert de donnees",
+                "T1123 - Capture audio"
+            ]
+        }
+    },
+    "APT": {
+        "en": {
+            "phases": {
+                "Preparation": {
+                    "duration_days": 60,
+                    "tasks": [
+                        {"task": "Intelligence gathering", "duration": 15},
+                        {"task": "Vulnerability research", "duration": 20},
+                        {"task": "Tool development", "duration": 15},
+                        {"task": "Infrastructure setup", "duration": 10}
+                    ]
+                },
+                "Detection & Analysis": {
+                    "duration_days": 30,
+                    "tasks": [
+                        {"task": "Initial indicators", "duration": 5},
+                        {"task": "Attribution analysis", "duration": 15},
+                        {"task": "Threat actor identification", "duration": 10}
+                    ]
+                },
+                "Containment": {
+                    "duration_days": 14,
+                    "tasks": [
+                        {"task": "Isolate compromised systems", "duration": 3},
+                        {"task": "Block C2 infrastructure", "duration": 3},
+                        {"task": "Hunt for backdoors", "duration": 5},
+                        {"task": "Reset all credentials", "duration": 3}
+                    ]
+                },
+                "Eradication": {
+                    "duration_days": 21,
+                    "tasks": [
+                        {"task": "Remove all malware", "duration": 7},
+                        {"task": "Eliminate persistence mechanisms", "duration": 7},
+                        {"task": "Patch all vulnerabilities", "duration": 7}
+                    ]
+                },
+                "Recovery": {
+                    "duration_days": 30,
+                    "tasks": [
+                        {"task": "Rebuild systems from scratch", "duration": 15},
+                        {"task": "Restore from verified clean backups", "duration": 10},
+                        {"task": "Comprehensive testing", "duration": 5}
+                    ]
+                },
+                "Post-Incident": {
+                    "duration_days": 60,
+                    "tasks": [
+                        {"task": "Detailed forensics report", "duration": 20},
+                        {"task": "Threat intelligence sharing", "duration": 15},
+                        {"task": "Enhanced monitoring deployment", "duration": 15},
+                        {"task": "Security posture improvement", "duration": 10}
+                    ]
+                }
+            },
+            "artifacts": {
+                "System Registry": {
+                    "keys": [
+                        "HKLM\\SYSTEM\\CurrentControlSet\\Services",
+                        "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
+                        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU",
+                        "HKLM\\SYSTEM\\Select"
+                    ],
+                    "tools": ["Registry Explorer", "RegRipper", "Volatility"]
+                },
+                "Event Logs": {
+                    "keys": [
+                        "Security logs (all event types)",
+                        "System logs (driver installations)",
+                        "Sysmon logs (complete)",
+                        "PowerShell logs"
+                    ],
+                    "tools": ["Event Viewer", "Splunk", "ELK Stack"]
+                },
+                "Memory": {
+                    "keys": [
+                        "Full memory dump",
+                        "Process memory analysis",
+                        "DLL injection points",
+                        "Rootkit detection"
+                    ],
+                    "tools": ["Volatility", "WinDbg", "MemoryTools"]
+                },
+                "File System": {
+                    "keys": [
+                        "MFT analysis",
+                        "USN Journal",
+                        "File slack space",
+                        "Alternate data streams"
+                    ],
+                    "tools": ["FTK Imager", "Autopsy", "EnCase"]
+                },
+                "Network": {
+                    "keys": [
+                        "Network traffic (pcap)",
+                        "DNS query logs",
+                        "Firewall logs (all)",
+                        "Proxy logs (complete)"
+                    ],
+                    "tools": ["Wireshark", "Zeek", "Splunk"]
+                }
+            },
+            "mitre_techniques": [
+                "T1595 - Active Scanning",
+                "T1592 - Gather Victim Host Information",
+                "T1199 - Trusted Relationship",
+                "T1566 - Phishing",
+                "T1190 - Exploit Public-Facing Application",
+                "T1021 - Remote Services",
+                "T1059 - Command and Scripting Interpreter"
+            ]
+        },
+        "fr": {
+            "phases": {
+                "Preparation": {
+                    "duration_days": 60,
+                    "tasks": [
+                        {"task": "Collecte de renseignements", "duration": 15},
+                        {"task": "Recherche de vulnerabilites", "duration": 20},
+                        {"task": "Developpement d'outils", "duration": 15},
+                        {"task": "Configuration d'infrastructure", "duration": 10}
+                    ]
+                },
+                "Detection & Analysis": {
+                    "duration_days": 30,
+                    "tasks": [
+                        {"task": "Indicateurs initiaux", "duration": 5},
+                        {"task": "Analyse d'attribution", "duration": 15},
+                        {"task": "Identification de l'acteur menace", "duration": 10}
+                    ]
+                },
+                "Containment": {
+                    "duration_days": 14,
+                    "tasks": [
+                        {"task": "Isoler les systemes compromis", "duration": 3},
+                        {"task": "Bloquer l'infrastructure C2", "duration": 3},
+                        {"task": "Chasse aux portes derriere", "duration": 5},
+                        {"task": "Reinitialiser tous les identifiants", "duration": 3}
+                    ]
+                },
+                "Eradication": {
+                    "duration_days": 21,
+                    "tasks": [
+                        {"task": "Supprimer tous les logiciels malveillants", "duration": 7},
+                        {"task": "Eliminer les mecanismes de persistance", "duration": 7},
+                        {"task": "Corriger toutes les vulnerabilites", "duration": 7}
+                    ]
+                },
+                "Recovery": {
+                    "duration_days": 30,
+                    "tasks": [
+                        {"task": "Reconstruire les systemes a partir de zero", "duration": 15},
+                        {"task": "Restaurer a partir de sauvegardes verifiees propres", "duration": 10},
+                        {"task": "Tests exhaustifs", "duration": 5}
+                    ]
+                },
+                "Post-Incident": {
+                    "duration_days": 60,
+                    "tasks": [
+                        {"task": "Rapport forensique detaille", "duration": 20},
+                        {"task": "Partage de renseignements sur les menaces", "duration": 15},
+                        {"task": "Deploiement d'une surveillance amelioree", "duration": 15},
+                        {"task": "Amelioration de la posture de securite", "duration": 10}
+                    ]
+                }
+            },
+            "artifacts": {
+                "Registre systeme": {
+                    "keys": [
+                        "HKLM\\SYSTEM\\CurrentControlSet\\Services",
+                        "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
+                        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU",
+                        "HKLM\\SYSTEM\\Select"
+                    ],
+                    "tools": ["Registry Explorer", "RegRipper", "Volatility"]
+                },
+                "Journaux d'evenements": {
+                    "keys": [
+                        "Journaux de securite (tous types d'evenements)",
+                        "Journaux systeme (installations de pilotes)",
+                        "Journaux Sysmon (complet)",
+                        "Journaux PowerShell"
+                    ],
+                    "tools": ["Observateur d'evenements", "Splunk", "Stack ELK"]
+                },
+                "Memoire": {
+                    "keys": [
+                        "Image memoire complete",
+                        "Analyse de memoire de processus",
+                        "Points d'injection DLL",
+                        "Detection de rootkit"
+                    ],
+                    "tools": ["Volatility", "WinDbg", "MemoryTools"]
+                },
+                "Systeme de fichiers": {
+                    "keys": [
+                        "Analyse MFT",
+                        "Journal USN",
+                        "Espace slack de fichier",
+                        "Flux de donnees alternatifs"
+                    ],
+                    "tools": ["FTK Imager", "Autopsy", "EnCase"]
+                },
+                "Reseau": {
+                    "keys": [
+                        "Trafic reseau (pcap)",
+                        "Journaux de requetes DNS",
+                        "Journaux de pare-feu (tous)",
+                        "Journaux proxy (complets)"
+                    ],
+                    "tools": ["Wireshark", "Zeek", "Splunk"]
+                }
+            },
+            "mitre_techniques": [
+                "T1595 - Numérisation active",
+                "T1592 - Collecter des informations sur l'hôte de la victime",
+                "T1199 - Relation de confiance",
+                "T1566 - Phishing",
+                "T1190 - Exploitation d'application exposée publiquement",
+                "T1021 - Services distants",
+                "T1059 - Interpréteur de commandes et de scripts"
+            ]
+        }
+    }
+}
+
+def build_timeline_dataframe(incident_type, language):
+    """Build timeline dataframe for Plotly visualization"""
+    data = INCIDENT_DATA[incident_type][language]
+    timeline_data = []
+    start_date = datetime(2024, 1, 1)
+    current_date = start_date
+
+    for phase_name, phase_info in data["phases"].items():
+        for task in phase_info["tasks"]:
+            task_name = task["task"]
+            duration = task["duration"]
+            end_date = current_date + timedelta(days=duration)
+
+            timeline_data.append({
+                "Phase": phase_name,
+                "Task": task_name,
+                "Start": current_date,
+                "End": end_date,
+                "Duration": duration
+            })
+
+            current_date = end_date
+
+    df = pd.DataFrame(timeline_data)
+    return df
+
+def create_gantt_chart(incident_type, language):
+    """Create Plotly Gantt chart"""
+    df = build_timeline_dataframe(incident_type, language)
+
+    colors = {
+        "Preparation": "#FF6B6B",
+        "Detection & Analysis": "#FFA500",
+        "Containment": "#FFD700",
+        "Eradication": "#90EE90",
+        "Recovery": "#87CEEB",
+        "Post-Incident": "#9370DB"
+    }
+
+    fig = px.timeline(
+        df,
+        x_start="Start",
+        x_end="End",
+        y="Phase",
+        color="Phase",
+        color_discrete_map=colors,
+        title=f"{incident_type} - Incident Response Timeline" if language == "en" else f"{incident_type} - Chronologie de la reponse aux incidents",
+        hover_data={"Task": True, "Duration": True},
+        labels={"Phase": "Phase" if language == "en" else "Phase", "Task": "Task" if language == "en" else "Tache", "Duration": "Days" if language == "en" else "Jours"}
+    )
+
+    fig.update_layout(height=500, hovermode="closest")
+    return fig
+
+def get_artifacts_text(incident_type, language):
+    """Generate artifacts collection guidance"""
+    data = INCIDENT_DATA[incident_type][language]
+    artifacts = data["artifacts"]
+
+    text = "# Recommended Forensic Artifacts\n\n"
+    if language == "en":
+        for artifact_category, artifact_info in artifacts.items():
+            text += f"## {artifact_category}\n\n"
+            text += f"**Registry Keys/Locations:**\n"
+            for key in artifact_info["keys"]:
+                text += f"- `{key}`\n"
+            text += f"\n**Recommended Tools:** {', '.join(artifact_info['tools'])}\n\n"
+    else:
+        for artifact_category, artifact_info in artifacts.items():
+            text += f"## {artifact_category}\n\n"
+            text += f"**Clés de registre/Emplacements:**\n"
+            for key in artifact_info["keys"]:
+                text += f"- `{key}`\n"
+            text += f"\n**Outils recommandés:** {', '.join(artifact_info['tools'])}\n\n"
+
+    return text
+
+def get_mitre_text(incident_type, language):
+    """Generate MITRE ATT&CK techniques"""
+    data = INCIDENT_DATA[incident_type][language]
+    techniques = data["mitre_techniques"]
+
+    title = "MITRE ATT&CK Techniques" if language == "en" else "Techniques MITRE ATT&CK"
+    text = f"# {title}\n\n"
+
+    for technique in techniques:
+        text += f"- {technique}\n"
+
+    return text
+
+def export_timeline_markdown(incident_type, language):
+    """Export complete timeline as Markdown"""
+    data = INCIDENT_DATA[incident_type][language]
+
+    md_text = f"# {incident_type} - Incident Response Timeline\n\n"
+
+    if language == "en":
+        md_text += "## Incident Response Phases\n\n"
+    else:
+        md_text += "## Phases de reponse aux incidents\n\n"
+
+    for phase_name, phase_info in data["phases"].items():
+        md_text += f"### {phase_name}\n"
+        md_text += f"**Duration:** {phase_info['duration_days']} days\n\n"
+        if language == "en":
+            md_text += "**Tasks:**\n"
+        else:
+            md_text += "**Taches:**\n"
+
+        for task in phase_info["tasks"]:
+            md_text += f"- {task['task']} ({task['duration']} days)\n"
+
+        md_text += "\n"
+
+    md_text += "\n" + get_artifacts_text(incident_type, language)
+    md_text += "\n" + get_mitre_text(incident_type, language)
+
+    return md_text
+
+def main():
+    with gr.Blocks(title="Forensics Timeline Builder", theme=gr.themes.Soft(primary_hue="indigo", secondary_hue="purple")) as demo:
+        gr.Markdown("""
+        # Forensics Timeline Builder - Interactive Investigation Tool
+
+        Build comprehensive incident response timelines with forensic artifact recommendations and MITRE ATT&CK mappings.
+        """)
+
+        with gr.Row():
+            lang = gr.Radio(["English", "Francais"], value="English", label="Language")
+
+        with gr.Row():
+            incident_type = gr.Dropdown(
+                ["Ransomware", "Data Breach", "Insider Threat", "APT", "Malware Infection", "Account Compromise", "Web Compromise", "Supply Chain Attack"],
+                value="Ransomware",
+                label="Incident Type"
+            )
+
+        with gr.Row():
+            generate_btn = gr.Button("Generate Timeline", variant="primary")
+
+        with gr.Tab("Timeline Visualization"):
+            timeline_chart = gr.Plot(label="Incident Response Timeline")
+
+        with gr.Tab("Forensic Artifacts"):
+            artifacts_text = gr.Markdown(label="Recommended Artifacts")
+
+        with gr.Tab("MITRE ATT&CK"):
+            mitre_text = gr.Markdown(label="Techniques")
+
+        with gr.Tab("Export"):
+            export_output = gr.Textbox(label="Markdown Export", lines=20)
+            export_btn = gr.Button("Export as Markdown")
+
+        with gr.Tab("Resources"):
+            gr.Markdown("""
+            # Forensics Resources
+
+            ## In-Depth Articles
+            - [Memory Forensics](https://ayinedjimi-consultants.fr/forensics/memory-forensics.html)
+            - [Registry Forensics](https://ayinedjimi-consultants.fr/forensics/registry-forensics.html)
+            - [NTFS Forensics](https://ayinedjimi-consultants.fr/forensics/ntfs-forensics.html)
+            - [DFIR Tools Comparison](https://ayinedjimi-consultants.fr/forensics/dfir-tools-comparison.html)
+            - [Amcache & Shimcache](https://ayinedjimi-consultants.fr/forensics/amcache-shimcache.html)
+            - [ETW & WPR Forensics](https://ayinedjimi-consultants.fr/forensics/etw-wpr-forensics.html)
+            - [Evasion & Anti-Forensic](https://ayinedjimi-consultants.fr/forensics/evasion-antiforensic.html)
+            - [Telemetry Forensics](https://ayinedjimi-consultants.fr/forensics/telemetry-forensics.html)
+            - [Windows Server 2025 Forensics](https://ayinedjimi-consultants.fr/forensics/windows-server-2025-forensics.html)
+            - [Forensics Report Templates](https://ayinedjimi-consultants.fr/forensics/forensics-report-templates.html)
+            - [Livre Blanc: Anatomie d'une Attaque Ransomware](https://ayinedjimi-consultants.fr/livre-blanc-anatomie-attaque-ransomware.html)
+
+            ## Author
+            Created by [Ayinedjimi Consultants](https://ayinedjimi-consultants.fr/bio.html)
+            """)
+
+        def generate_content(selected_incident, selected_lang):
+            lang_code = "en" if selected_lang == "English" else "fr"
+
+            if selected_incident not in INCIDENT_DATA:
+                selected_incident = "Ransomware"
+
+            fig = create_gantt_chart(selected_incident, lang_code)
+            artifacts = get_artifacts_text(selected_incident, lang_code)
+            mitre = get_mitre_text(selected_incident, lang_code)
+
+            return fig, artifacts, mitre
+
+        def export_markdown(selected_incident, selected_lang):
+            lang_code = "en" if selected_lang == "English" else "fr"
+
+            if selected_incident not in INCIDENT_DATA:
+                selected_incident = "Ransomware"
+
+            return export_timeline_markdown(selected_incident, lang_code)
+
+        generate_btn.click(
+            fn=generate_content,
+            inputs=[incident_type, lang],
+            outputs=[timeline_chart, artifacts_text, mitre_text]
+        )
+
+        export_btn.click(
+            fn=export_markdown,
+            inputs=[incident_type, lang],
+            outputs=[export_output]
+        )
+
+        demo.load(
+            fn=generate_content,
+            inputs=[incident_type, lang],
+            outputs=[timeline_chart, artifacts_text, mitre_text]
+        )
+
+    demo.launch()
+
+if __name__ == "__main__":
+    main()

requirements.txt

@@ -0,0 +1,4 @@
+gradio==4.44.0
+huggingface_hub==0.24.7
+plotly==5.18.0
+pandas==2.1.4