-- PROJECT / DarkHound Public repo · 2026
<- Projects

DarkHound

Digital Forensics & Incident Response (DFIR)

DarkHound is a security hunting platform with a web UI, SSH-based asset sessions, configurable hunt modules, AI-assisted analysis, findings, timelines, enrichments, and executive report generation.

Product screens

Source images ->
DarkHound session view showing hunt execution activity and findings workflow.
Live hunt session
DarkHound configurable hunting interface with module and execution options.
Configurable hunt modules
DarkHound report screen showing generated investigation reporting content.
AI-assisted report output
DarkHound login screen with the product name and authentication form.
Application entry point

Highlights

  • Asset manager with SSH credentials, sudo support, and CSV import/export.
  • Hunt module CRUD and execution with step orchestration.
  • AI executive report generation with streaming output.
  • Findings, timelines, and enrichment events over WebSocket.
  • Docker-based dev environment with Postgres, Vault, backend, and frontend.

Skills

FastAPIReactTypeScriptPostgreSQLWebSocketDockerVault

Builder note

This is the most direct expression of DFIR experience as product: codified hunts, remote sessions, enrichment, and reporting stitched into one platform.

System shape

The architecture combines a Python API, React UI, Postgres persistence, Alembic migrations, optional Vault integration, and WebSocket-driven visibility.