A Sanity Check for AI-Generated Cyber Attack Reconstructions

Cyber Autopsy is a new forensic investigation tool designed to help analysts reconstruct cyber incidents using structured data rather than relying on unverified AI narratives. By integrating Sanity as a content layer, the project creates a queryable, graph-based knowledge base that preserves the provenance of evidence, events, and claims. This approach allows investigators to maintain a clear chain of evidence, distinguish between confirmed and inferred facts, and enforce temporal cutoffs to prevent future knowledge from leaking into past scenarios. The system includes an MCP-compatible server and a forensic-themed web interface, enabling agents to perform grounded, verifiable investigations. By modeling incidents as linked documents, Cyber Autopsy ensures that reasoning remains inspectable and transparent, providing a robust framework for teaching analysts and evaluating AI agents on their ability to handle calibrated uncertainty in complex security environments.