macfor Analyze

Overview

macfor Analyze transforms collected artifacts into actionable intelligence. Built on SurrealDB's graph database, it enables relationship-based threat hunting and timeline reconstruction across every artifact source macfor Collector produces.

Planned features

Graph-powered analysis

Visualise relationships between artifacts, users, and activities. Traverse connections to uncover hidden patterns, with SurrealQL queries on top.

Unified timeline

Correlate events across every artifact source. Filter by time range, user, or activity type — and export to CSV or downstream forensic tools.

Browser correlation

Cross-browser analysis across Safari, Chrome, Firefox, and Edge, with URL deduplication, visit-frequency analysis, and download/cookie linkage.

Investigation workspaces

Organise evidence by case. Add notes and tags to artifacts and share findings with team members.

Reporting

Generate PDF reports for stakeholders with customisable templates, executive summaries, and supporting technical detail.

API access

Programmatic access to the case graph for custom integrations and bulk reporting workflows (Enterprise).

Architecture

┌─────────────────────────────────────────────────┐
│                  Web Interface                  │
│              (SvelteKit + D3.js)                │
├─────────────────────────────────────────────────┤
│                   GraphQL API                   │
│                  (gqlgen + Go)                  │
├─────────────────────────────────────────────────┤
│                    SurrealDB                    │
│           (Document + Graph Database)           │
├─────────────────────────────────────────────────┤
│              Evidence Containers                │
│            (macfor Collector Output)            │
└─────────────────────────────────────────────────┘

Integration with Collector

macfor Analyze is designed to work seamlessly with evidence containers produced by macfor Collector. Import a .zip evidence file to begin analysis — no transformation step required.

# Collect artifacts
sudo macfor collect --output case-001.zip

# Import into Analyze (coming soon)
macfor-analyze import case-001.zip --case "Investigation 2026-001"

Early access

We're currently developing macfor Analyze in private beta. Sign up to be notified when early access becomes available — or contact us to learn more about the roadmap.