Features

96.7% Accuracy

Parses Nmap XML output to identify open ports, running services and software versions. Cross-references findings against CVE data and generates evidence-based exploit recommendations grounded in your actual scan. No invented vulnerabilities.

• Service and version fingerprinting
• CVE cross-referencing
• Metasploit module suggestions
• Evidence-based attack chain planning

10/10 Accuracy

Analyses BloodHound JSON output to map Active Directory attack paths, identify privilege escalation opportunities and recommend lateral movement techniques. Cites specific findings from your enumeration data rather than generic AD advice.

• AD attack path identification
• Privilege escalation opportunities
• Kerberoasting / AS-REP roasting detection
• Domain dominance path planning

9.2/10 Accuracy

Analyses NetExec (formerly CrackMapExec) output for SMB enumeration results, credential spraying outcomes, share discovery and Active Directory findings. Recommends next steps in the attack chain based on what was discovered.

• SMB enumeration analysis
• Credential spray result interpretation
• Share and permission discovery
• Attack chain next-step guidance

8.13/10 Accuracy

Analyses Volatility 3 memory forensics output to identify malicious processes, suspicious network connections, injected code and persistence mechanisms. Builds structured incident response workflows based on your specific memory dump findings.

• Process tree analysis and anomaly detection
• Network connection identification
• Injected code and shellcode detection
• Persistence mechanism identification
• IR workflow recommendations

9.84/10 Accuracy

Analyses YARA rule match output to identify malware families, assess threat severity and build incident response workflows. The highest accuracy tool in the Syd suite. It consistently identifies the right malware family and recommends appropriate response steps.

• Malware family identification
• Threat severity assessment
• IOC extraction from matches
• IR workflow and containment steps
• Threat hunting follow-up suggestions

Available Now

Analyses packet capture output for anomalous traffic patterns, protocol abuse, C2 communication signatures and data exfiltration indicators. Extracts IOCs and correlates network activity with known attack techniques.

• Anomalous traffic identification
• C2 communication detection
• Protocol abuse analysis
• IOC extraction from traffic
• Data exfiltration indicators

Enterprise

Network security monitor log analysis. Interprets Zeek logs (conn, dns, http, ssl, files) to identify suspicious network behaviour, lateral movement and threat indicators across your network traffic.

• Connection log threat analysis
• DNS anomaly detection
• SSL/TLS certificate analysis
• Lateral movement identification

Enterprise

Windows event log threat hunting analysis. Interprets Chainsaw output to correlate suspicious log entries with known attack techniques, MITRE ATT&CK mappings and threat intelligence.

• Event log threat correlation
• MITRE ATT&CK technique mapping
• Suspicious activity timeline building
• Attack pattern identification

Enterprise

IDS/IPS alert analysis. Interprets Suricata alert logs to prioritise detections, identify false positives, correlate multi-stage attacks and recommend tuning or response actions.

• Alert prioritisation and triage
• False positive identification
• Multi-stage attack correlation
• Rule tuning recommendations

Enterprise

Windows System Monitor log analysis. Interprets Sysmon events (process creation, network connections, registry changes, file operations) to identify malicious behaviour and build attack timelines.

• Process creation anomaly detection
• Registry modification analysis
• Network connection behaviour
• Attack timeline reconstruction

Enterprise

Command-line Wireshark analysis. Interprets TShark filtered output for network forensics, identifying protocol anomalies, credential capture in traffic and evidence of lateral movement or exfiltration.

• Protocol anomaly identification
• Credential in-traffic detection
• Lateral movement evidence
• Exfiltration indicator analysis

Enterprise

Digital forensics platform assistance. Helps interpret disk image artefacts, deleted file recovery findings, timeline analysis and browser history for digital forensics investigations and legal proceedings.

• Disk artefact interpretation
• Deleted file analysis guidance
• Timeline analysis assistance
• Evidence documentation support

Enterprise

Ransomware protection and detection analysis. Interprets Raccine detections and blocked shadow copy deletion attempts, helping IR teams understand ransomware behaviour and containment options.

• Ransomware behaviour analysis
• Shadow copy deletion detection
• Containment recommendations

Generate structured security assessment reports from your Syd analysis sessions. Compile findings, recommendations and evidence into a professional deliverable, all offline.

Manage, filter and generate custom wordlists for password attacks. Integrates with Hashcat and NetExec workflows.

Secure offline credential management for engagement-captured credentials. Encrypted local storage with no cloud sync.

Examine and contextualise digital forensic artefacts (registry keys, prefetch files, shellbags) with AI-assisted interpretation.

Rapid assessment and categorisation of files for incident response. Identify suspicious files, scripts and executables quickly during live engagements.