Live PID forensics TUI for blue teams
piddigger is a read-only /proc investigator for a single running process.
It captures identity, open files and deleted-but-open files, sockets,
memory maps, namespaces, capabilities and seccomp, threads and environment,
runs triage heuristics, and watches a live activity timeline.
.
Optional, opt-in live capture wraps strace, ltrace, perf, bpftrace, tcpdump,
gdb and gcore. Every artifact is copied into a write-once evidence case with
SHA-256 hashes and an append-only chain-of-custody log.
Live PID forensics TUI for blue teams
piddigger is a read-only /proc investigator for a single running process.
It captures identity, open files and deleted-but-open files, sockets,
memory maps, namespaces, capabilities and seccomp, threads and environment,
runs triage heuristics, and watches a live activity timeline.
.
Optional, opt-in live capture wraps strace, ltrace, perf, bpftrace, tcpdump,
gdb and gcore. Every artifact is copied into a write-once evidence case with
SHA-256 hashes and an append-only chain-of-custody log.
Live PID forensics TUI for blue teams
piddigger is a read-only /proc investigator for a single running process.
It captures identity, open files and deleted-but-open files, sockets,
memory maps, namespaces, capabilities and seccomp, threads and environment,
runs triage heuristics, and watches a live activity timeline.
.
Optional, opt-in live capture wraps strace, ltrace, perf, bpftrace, tcpdump,
gdb and gcore. Every artifact is copied into a write-once evidence case with
SHA-256 hashes and an append-only chain-of-custody log.