A repeatable malware triage workflow
Start with a fingerprint, inspect the structure, and record what the evidence supports.
The notebook
Workflows
A first pass at a suspicious document
Preserve the original, identify the real format, and prepare structured notes for further analysis.
From indicators to a shareable report
Keep raw indicators intact while creating a readable, defanged version for a report.