Analyst tools
Nadirion Desktop runs analysis modules from one launcher and one command console on Windows, macOS, and Linux. Add the modules your work needs: host triage, artifact and log review, email and indicator analysis, a post-quantum cryptography inventory, and a few network and host utilities.
01 How It Works
Buy the desktop.
An incident responder, a SOC analyst, and someone inventorying cryptography for a post-quantum migration need different tools. Each starts with Nadirion Desktop and adds only the modules their work needs.
-
01
Start with Nadirion Desktop
The base license, $150 per user per year: launcher, search, Command Console, Knowledge Base, settings, in-place updates, and 12 included modules (Triage and Host Utilities).
-
02
Add modules
Add any of the other 21 modules: $50 each per user per year, or $100 for Premium modules.
-
03
Install once
Windows installer, macOS disk image, or Linux archive. Your modules open from the launcher and by name from the console.
-
04
Add more later
Add modules to your subscription at any time, without reinstalling.
02 The Modules
Eight categories,
Modules are grouped by the stage of work they serve, the same way the launcher groups them. Open a category to see what each module does, its main limitation, and its price.
Intelligence
Extract, enrich, store, and track indicators and threat reporting.
- Intelligence Processor
- IOC Vault
- Intelligence Feed
Forensics
Read-only review of files, email, processes, persistence, and logs. Mostly Windows-first.
- Email Analysis
- Registry & Persistence Analysis
- AI Analysis
Triage
Sweep a suspect host for indicators, isolate it, collect from it, or write boot media for it.
- Malware Scan
- Secure Host
- Triage Kit USB
Quantum
Flag RSA and elliptic-curve use in code and configuration, and draft a migration plan.
- Cryptographic Inventory
- CycloneDX CBOM & SARIF
Cryptography
Decode text, unwrap nested encodings, and suggest likely hash types, all offline.
- Decoder
- 21 codecs & auto-peel
Identity
Records of your research personas, and open-source search queries about a person.
- Persona Manager
- Identity Lookup
Network
Reachability monitoring, route tracing, and local topology mapping.
- Uptime Monitor
- Route Mapper
- Network Mapper
Host Utilities
Inventory and maintenance for the machine you're working on.
- Startup Manager
- Software Inventory & Patch Checker
- Disk Space Analyzer
03 Inside the Desktop
Click through it,
Every module has its own window, and nearly every one also has a headless mode you can run by name from the Command Console. Both share the same engine, so results match whichever way you work.
Search by what you're hunting
Type "autoruns", "evtx", or "netstat" and the launcher finds the module that does it. Enter opens the first match.
Keyboard first
Ctrl+F searches, Ctrl+` opens the console, F1 opens the Knowledge Base, and Ctrl+W closes any window.
Scriptable where it counts
Cryptographic Inventory runs in CI against a baseline and fails the build on new findings.
04 How It's Built
How the modules behave
The same rules apply across modules: show the reasoning behind each score, ask before changing a host, and keep a way to undo changes where the platform allows. None of this replaces your own judgment or your organization's procedures.
Offline-first
Most modules never touch the network. Enrichment through VirusTotal, AbuseIPDB, Hybrid Analysis, or SerpAPI uses your own API keys, stored in the operating system's keyring.
Explainable
Scores list the rules that produced them: rule-level rationale for processes, a severity and MITRE ATT&CK technique for each email finding, and evidence tiers for AI Analysis. A score summarizes those rules; it is not a verdict.
Read-only by default
Analysis modules read and report. Anything that changes a host asks for confirmation in the window and requires --yes in the console.
Reversible
Secure Host snapshots the firewall configuration before isolating a machine. Startup Manager changes can be undone, and Malware Scan quarantines or disables items rather than deleting them. Where a restore is best-effort, as with Secure Host on macOS, the catalog says so.
Hash-checked
USB ISO Burner checks the image against a checksum you supply before writing and reads the drive back afterward. Triage kits write a SHA-256 manifest, and updates are checked against a SHA-256 hash before they are applied.
Cross-platform
Windows, macOS, and Linux, though several forensic modules read Windows-only artifacts. Each catalog entry states its platform limits.
Free tools such as Sysinternals Autoruns, CyberChef, Hayabusa, Nmap, and Rufus cover much of the same ground. What Nadirion adds is one interface and console for all of it, scores that show their rules, offline operation, and changes that can be undone. See the overlap, module by module.
06 About Nadirion
A small company, named for a point of reference.
The nadir is the point directly beneath an observer, opposite the zenith: a fixed point of reference. Nadirion is a small software company founded by Andrew Cole, with a team of fewer than ten people.
Nadirion Desktop is built around a few rules: show the reasoning behind each score, ask before changing a host, and keep changes reversible where the platform allows. Two more modules are in development; nothing is sold until it ships.
→ Next Step
Build your license.
Pick modules in the catalog to see a running total, then send the selection to us. Demos are available on request.