Unified launcher
Every module you own in one window, grouped by workflow stage. Reorder the categories to match how your team works.
→ The Platform
Nadirion Desktop:
Nadirion Desktop is the base application every module runs in: a launcher, a keyboard-driven console that runs modules by name, in-app guidance, settings, and in-place updates checked against a SHA-256 hash. It is $150 per user per year and includes the four Triage modules and the eight Host Utilities. It was previously released as the Threat Operations Toolset.
03Platforms, each with its own native package
33Modules it can host; 12 come with it
Ctrl + FSearch modules by what they do
SHA-256Hash checked before an update is applied
01 Included
What every license includes
These are included with Nadirion Desktop, regardless of which add-on modules you choose, and every module relies on them. So are the four Triage modules and the eight Host Utilities.
Search by what you're hunting
The search box matches module names, descriptions, and the terms analysts actually use, such as "autoruns", "netstat", and "evtx". Enter opens the first match.
Command Console
Run modules by name, headless or windowed, alongside safe shell-style utilities and an offline MITRE ATT&CK lookup.
Knowledge Base
Press F1 for guidance on every module: what it reads, what it flags, and what to corroborate before acting on its findings.
Settings & keys
Themes, bundled typefaces, color-vision modes for protanopia, deuteranopia, and tritanopia, display scaling, and API keys stored in the operating system's keyring.
Module health & updates
Per-module dependency checks with remediation steps (press F5 to re-check), and in-place updates checked against a SHA-256 hash before they are applied.
02 Command Console
Every module,
The console runs inside the desktop or as a standalone shell. Each module you license has its own command, and most can run headless directly in the console.
Two ways to run the same thing
A module's window and its console command share a single engine, so results are consistent either way.
Changes need confirmation
Shell-style commands are emulations that never spawn a real shell. Anything that changes a host requires --yes, and real shell passthrough stays off until you enable it.
Goes where the host is
With Triage Kit USB, standalone collectors run from a USB drive on a machine with nothing installed, and a portable console of the command-line modules runs anywhere Python 3 is available.
03 Add-on Modules
How the modules fit in
Add-on modules are $50 each per user per year, or $100 for Premium modules. They share the launcher and console; a few pass results directly to one another, and the rest export JSON or CSV.
Same window, same console
An add-on opens from the launcher under its category and runs by name from the console, with the same shortcuts as everything else.
Modules that hand off
Indicators from Intelligence Processor and Email Analysis can be sent directly to IOC Vault, and other forensic modules export JSON or CSV for handoff.
Add any time
Start with the module your work needs today, and add more to the same subscription later.
Browse all 33 modules, with a description, main limitation, and price for each.
04 Install
Packages and platforms
A native package for each desktop platform, with no Python installation or other runtime required. Once installed, Nadirion Desktop updates itself in place.
| Platform | Package | Installs as | Updates |
|---|---|---|---|
| WINDOWS | Setup wizard (.exe), x86_64 | Per-user installation with no administrator rights required; Desktop and Start menu shortcuts | In place, checked against a SHA-256 hash |
| MACOS | Disk image (.dmg), x86_64 | Drag to Applications | In place for the standalone binary, checked against a SHA-256 hash; the app bundle updates by downloading the new .dmg |
| LINUX | Archive (.tar.gz), x86_64 | Install script places it in ~/.local/bin with an application-menu launcher | In place, checked against a SHA-256 hash |
Nothing else to install
Each package is self-contained. Optional extras, such as ffmpeg for audio and video conversion, are detected automatically when present.
Admin only when needed
Day-to-day use runs under a standard user account. Modules that write entire drives or change the firewall, such as USB ISO Burner and Secure Host, require Nadirion Desktop to be run as an administrator (or with sudo).
Where your data lives
Settings and caches are stored in a per-user folder on the workstation. IOC Vault keeps its database, encrypted with AES-256-GCM, wherever you choose, such as a team share. API keys are stored in the operating system's keyring.
Platform notes
Several forensic modules read Windows-only artifacts, such as registry hives, Prefetch, and event logs, and a few are best-effort on macOS. Each module's catalog entry notes its platform limits.
→ Next Step
See which modules fit your work.
Browse the catalog and add modules to a license, or book a demo and we'll walk you through Nadirion Desktop as it applies to your work.