→ Module Catalog

33 modules. Add the ones you need.

Every module below runs inside Nadirion Desktop, which is $150 per user per year and includes the four Triage modules and the eight Host Utilities. The other 21 are add-ons at $50 per user per year, or $100 for Premium modules. Each card says what the module does, its main limitation, and its price. Add modules to a license to see a running total, then send it to us. Free tools cover some of the same ground, and the comparison below names them.

Browse the Catalog See the Price List

Intelligence

Extract indicators from reports, look them up in services you hold keys for, keep them in a shared repository, and follow public advisories.

3 modules

INT-01

Intelligence Processor

Extracts indicators from raw text, files, and URLs, normalizes them, and looks them up in the services you hold API keys for.

Extracts IP addresses, domains, URLs, email addresses, hashes, CVEs, and filenames, and re-fangs defanged indicators
Runs VirusTotal, AbuseIPDB, and Hybrid Analysis lookups in parallel
Exports the normalized set as JSON, CSV, or STIX 2.1
Limit: Extraction is pattern-based, so review the results for false matches before sharing them. Lookups are limited by your API plans' quotas.

GUI + console
Uses your API keys

INT-02

IOC Vault

A shared repository of indicators and threat-actor records, stored in a database file encrypted with AES-256-GCM.

AES-256-GCM encryption of the database at rest
CSV, Excel, STIX, and MISP import and export, plus a SentinelOne IOC Management export
Team sync through a network share, with protection against concurrent writes
Limit: Sync works through a shared folder you provide, which suits a small team; it is not a replacement for a platform such as MISP or OpenCTI. Encryption covers the database, not files you export from it.

GUI + console
AES-256-GCM at rest

INT-03

Intelligence Feed

Security news, government advisories, and CVE announcements from public feeds, gathered into one list.

Polls RSS, Atom, and JSON feeds across cyber, advisory, and vulnerability sources
Tags severity, extracts CVE identifiers, and flags items that match your watchlist
Search, priority filters, and export to TXT, CSV, JSON, or HTML
Limit: It is only as current and complete as the public feeds it reads. Severity tags help you sort; they are not an assessment of your exposure.

GUI + console

Forensics

Read-only review of files, email, processes, browsers, persistence, execution history, and event logs. Every score lists the rules behind it. Most of these modules are Windows-first.

11 modules

FOR-01

File Analysis

Static checks on a suspicious file before anyone opens it.

Hashes, entropy, and checks for a MIME type that doesn't match the file extension
Filename anomalies, embedded string signals, and VirusTotal and Hybrid Analysis lookups by hash (the file itself is never uploaded)
Suggests whether the file looks benign or needs escalation, with the checks behind that suggestion
Limit: Nothing is executed, so packed or new malware can look benign. A hash with no lookup results tells you nothing either way.

GUI + console
Read-only
Uses your API keys

FOR-02

Email Analysis

Rule-based phishing review of .eml and .msg files. It never renders HTML, follows links, or opens attachments.

SPF, DKIM, and DMARC alignment; Received-chain analysis; and lookalike-domain and BEC Reply-To checks
Each finding names its rule, a severity, and a MITRE ATT&CK technique
An overall rating, from Benign through Likely Phishing to Malicious, shown with the findings that produced it
Limit: Because nothing is opened or followed, payloads and landing pages are only flagged through indicators such as file type and URL. Mail sent from a compromised legitimate account can pass every authentication check.

GUI + console
Opt-in enrichment

FOR-03

Process Analysis

Scores running processes and shows the rules behind each score.

Hash and signature status for each process binary
Each process's listening and established network connections
Baseline comparison and exportable reports for handoff
Limit: A live snapshot that is most complete on Windows. It sees only what is running when you look, and malware that injects into or imitates a signed process can score low.

GUI + console
Windows-first

FOR-04

Browser Analysis

History, downloads, and search terms from Chromium- and Firefox-based browsers, with entries worth a closer look flagged.

Edge, Chrome, Brave, Vivaldi, and Firefox on every platform; Opera, Opera GX, Waterfox, and LibreWolf on Windows
Flags URL shorteners, paste sites, tunneling and remote-access services, and risky downloads
Full Scan reads every profile on the host, including history kept in Volume Shadow Copies
Limit: Full Scan is Windows-only. Private browsing and cleared history leave little to read, and a flag marks a category of site, not intent.

GUI + console
Full Scan: Windows

FOR-05

Service Analysis

Lists installed services and flags those with traits worth a closer look.

Status, start type, and binary path for every service
Flags unsigned binaries (Windows), user-writable or unusual paths, and missing descriptions
Windows services and Linux systemd units in full
Limit: macOS launchd jobs are listed with status only. The traits it flags are common in malicious services and also in poorly packaged legitimate ones.

GUI + console
Read-only

FOR-06

Scheduled Task Analysis

Lists scheduled tasks, cron jobs, and systemd timers, and flags entries that look like persistence.

Task Scheduler on Windows, cron and systemd timers on Linux, cron on macOS
Flags unusually frequent triggers and actions that run unsigned, user-writable, or LOLBin binaries
Lists entries that are disabled but still present
Limit: On macOS it reads cron only, not launchd. Legitimate updater and admin tasks often trip the same flags.

GUI + console
Read-only

FOR-07

Registry & Persistence Analysis

Parses live or exported Windows registry hives for persistence entries and user activity.

Run keys, AppInit_DLLs, Winlogon, IFEO, LSA packages, and COM hijack candidates
UserAssist, RecentDocs, and ShellBags activity
Works on exported hives or finds them on the host
Limit: Windows registry only. It checks the locations listed above, not every autostart point Windows supports.

GUI + console
Windows artifacts

FOR-08

Execution Evidence Analysis

A single what-ran-and-when timeline built from Prefetch, Amcache, and BAM/DAM.

Point it at exported artifacts or let it find them on the host
Merges every source into one scored timeline
Read-only, with scans running in the background
Limit: Windows only. Each source has gaps (Prefetch, for example, is often disabled on servers), so a program missing from the timeline may still have run.

GUI + console
Windows artifacts

FOR-09

Event Log & Logon Analysis

Summarizes logon and execution activity from Security, Sysmon, and PowerShell event logs.

Logon-session report that flags bursts of failed logons, a common sign of password guessing
Scores process-creation and PowerShell script-block events
Cross-references findings exported from other modules
Limit: Windows logs only, and only what was recorded. Without Sysmon or script-block logging enabled, or with small default log sizes, much of the evidence may never have been written.

GUI + console
Windows logs

FOR-10

AI Analysis

Scores photos, video, text, and code for signs of generative-AI creation or editing, and shows the evidence behind each score.

Provenance (such as C2PA Content Credentials), artifact, and heuristic evidence tiers; the strongest tier present caps the score
Scores based on style alone stop at 70/100; a higher score needs evidence that names a generator
Scores “created” and “edited” separately, so a retouched camera photo isn't labeled synthetic
Limit: Detecting AI-generated content is unreliable across the industry, for this module and every other tool. Expect false positives and false negatives, especially for text, code, and re-encoded media. Provenance metadata is easily stripped, so its absence means nothing. Treat every score as advisory evidence, never as a determination.

GUI + console
Read-only
Advisory scores

FOR-11

Network Connection Forensics

A point-in-time record of this host's connections, listening ports, and network neighbors.

Live inbound and outbound connections
Firewall rules and listening-port exposure
ARP table and the DNS resolver cache (Windows)
Limit: A single snapshot, so short-lived connections between snapshots are missed. The DNS cache is read on Windows only and holds only recent lookups.

GUI + console
Read-only

Triage

Work on a suspect host: sweep it for indicators of compromise, cut it off from the network, collect from it with a USB kit, or write boot media for it. All four are included with Nadirion Desktop.

4 modules · included

TRI-01

Malware Scan

A heuristic sweep that correlates persistence, execution, event-log, network, and file-hiding indicators on a host. It is not antivirus: it has no signature database and no real-time protection.

Quick Scan in the app, or a Full Scan through the bundled PowerShell collector
Blocklist matching and optional VirusTotal lookups
Remediation asks for confirmation, quarantines or disables rather than deleting, and re-checks each item afterward
Limit: Findings are leads to review. Expect false positives on admin and remote-access tools, and misses for malware that avoids the places it checks. Windows-first; checks on macOS and Linux are narrower. Use it alongside antivirus or EDR, not instead of either.

GUI + console
Windows-first
Not antivirus

✓ Included with Nadirion Desktop

TRI-02

Secure Host

Cuts a host off from the network with a block-by-default firewall policy, then restores the previous configuration when you're done.

Blocks inbound and outbound traffic by default, allowing loopback and an optional address such as your jump host
Snapshots the firewall configuration before changing it; Restore puts that snapshot back
Exact restore on Windows and Linux; best-effort on macOS
Limit: It relies on the host's own firewall, so anything running with administrator rights on the host can undo it. On Linux the policy covers IPv4 only. Needs administrator rights.

GUI + console
Reversible
Requires admin rights

✓ Included with Nadirion Desktop

TRI-03

Triage Kit USB

Builds an incident-response collection kit on a USB drive, with collectors that need nothing installed on the host.

Standalone Windows and Linux/macOS collectors that need nothing installed, plus a portable console of the command-line modules for hosts with Python 3
Collectors write their results to the kit, not to the host
A SHA-256 manifest of collected files, and a Verify Kit check that re-hashes them to show whether anything changed
Limit: Running any collector leaves some traces on the host, such as process and log entries. The manifest shows whether files changed after collection; it does not replace your own chain-of-custody procedures.

GUI + console
SHA-256 manifest

✓ Included with Nadirion Desktop

TRI-04

USB ISO Burner

Writes a live-boot ISO or an OS installer to a USB drive, checking the image before writing and reading the drive back afterward.

Raw (DD) mode for hybrid ISOs; file-copy mode for Windows installers, with Secure Boot support
Checks the image against a checksum you supply before writing, and reads the drive back afterward
Offers only removable drives, re-identified at write time
Limit: The pre-write check is only as good as the checksum you supply, so take it from the publisher, not the download mirror. Writing erases the target drive and needs administrator rights.

GUI + console
Requires admin rights

✓ Included with Nadirion Desktop

Cryptography

Offline decoding, layer peeling, and hash-type suggestions for encoded and obfuscated text.

1 module

CRY-01

Decoder

An offline workbench for encoded, obfuscated, and hashed text.

21 codecs, from Base64 and Base85 to Morse, ROT47, and gzip
Auto-peel strips nested layers and reports each one it removed
Ranks likely hash algorithms and tries dictionary recovery, including salted schemes
Limit: Hash identification ranks the formats that fit; many algorithms share a length, so it is a suggestion. Dictionary recovery works only if the plaintext is in your wordlist.

GUI
Fully offline

Quantum

Inventory the RSA and elliptic-curve cryptography that a large quantum computer is expected to break, and plan a move to post-quantum algorithms.

1 module

QNT-01

Cryptographic Inventory

Flags RSA and elliptic-curve cryptography in code, keys, certificates, and configuration, then drafts a phased plan for moving to post-quantum algorithms.

Scans code, keys and certificates, TLS/SSH/VPN configuration, dependencies, and (opt-in) live endpoints
Scores harvest-now, decrypt-later exposure against published timelines such as NIST IR 8547 and CNSA 2.0
A four-wave migration plan with HTML, CSV, CycloneDX CBOM, and SARIF exports
Limit: Pattern-based: it can miss cryptography behind wrappers or inside compiled code, and it flags some non-security uses. Exposure scores and waves are planning estimates, not a compliance assessment.

GUI + console
CI-ready

Identity

Keep records of your research personas, and build open-source search queries about a person of interest.

2 modules

IDN-01

Persona Manager

Keeps records of the research personas you use for investigative work in one place.

Alias, email address, username, VPN IP, and social-platform handles for each persona
Notes kept alongside each profile
Profiles are stored locally on the workstation
Limit: A record-keeping tool. Keeping personas separate online still depends on your own tradecraft.

GUI + console

IDN-02

Identity Lookup

Builds person-focused web search queries from the details you know and gathers the results for review.

Builds targeted queries from a name, username, age, location, school, or employer
Runs the searches through SerpAPI with your key
Collects the open-source results for one person of interest in one place
Limit: Search-engine results only. Results for common names mix different people, so every match needs your confirmation. Use it only where you have a lawful basis to research the person.

GUI + console
Needs SerpAPI key

Network

Reachability, route paths, and local network topology from the analyst's workstation.

3 modules

NET-01

Uptime Monitor

Recurring reachability and latency checks for the hosts you list, with history.

Repeated reachability checks for the hosts you list
Latency tracking with status history
Runs from the analyst's own workstation
Limit: Checks run from your workstation, so they reflect your network path and stop when the workstation does. Not a replacement for a monitoring service.

GUI + console

NET-02

Route Mapper

Traceroute with a hop-by-hop view.

Color-coded hops along the path
Per-hop latency, with crossings between internal, DMZ, and external networks highlighted
Shows which network boundaries a path crosses when you are scoping an incident
Limit: It sees what traceroute sees: many routers and firewalls drop or rate-limit probes, so missing hops are common, and real traffic can take a different path.

GUI + console

NET-03

Network Mapper

Lists hosts on the local network and flags those that don't match the segments you declare.

Neighbor-table discovery plus an optional bounded ping sweep
Classifies hosts against the network segments you declare
Flags loops, bridging, shadow subnets, and device vendors that don't belong on a segment
Limit: Local segments only, and only hosts that answer or appear in the neighbor table. Vendor names come from MAC address prefixes, which randomized or spoofed addresses defeat.

GUI + console

Host Utilities

Inventory and maintenance for the machine you are working on. Anything that changes the host asks for confirmation first. All eight are included with Nadirion Desktop.

8 modules · included

HST-01

Driver Update Manager

Lists drivers and applies updates through the operating system's own update mechanism.

Windows drivers, Linux kernel modules, and macOS kernel extensions
Version for each, plus signature status on Windows and Linux
No bundled vendor database; updates come from the operating system
Limit: It can only offer updates the operating system's update channel provides, so vendor-only drivers and firmware won't appear.

GUI + console
Confirms changes

✓ Included with Nadirion Desktop

HST-02

File Organizer

Groups a folder's files and subfolders by naming convention or file type.

Sort by type, by name pattern, or both
Preview the result before any files are moved
Changes apply only after you confirm
Limit: Moving files can break shortcuts and paths that other programs rely on, so check the preview before confirming.

GUI + console
Confirms changes

✓ Included with Nadirion Desktop

HST-03

Startup Manager

Lists startup entries and enables or disables them reversibly.

Run keys, Startup folders, and auto-start services on Windows
XDG autostart and systemd on Linux; launchd on macOS
Every disable can be undone
Limit: It covers the locations listed above, not every autostart point an operating system supports.

GUI + console
Reversible

✓ Included with Nadirion Desktop

HST-04

System Health Snapshot

A quick snapshot of CPU, memory, disk, battery, and uptime.

Capture host state before and after triage
Records values without flagging or scoring anything
Run it again afterward to compare the two
Limit: It records; comparing two snapshots is up to you.

GUI + console
Read-only

✓ Included with Nadirion Desktop

HST-05

Disk Space Analyzer

Lists the largest files and folders, stale temp files, and installer leftovers.

Largest files and folders under any root
Stale temp and cache items, plus orphaned installers in Downloads
Deletes only what you confirm
Limit: “Stale” and “orphaned” are judged by age and location, so check each item before deleting it.

GUI + console
Confirms changes

✓ Included with Nadirion Desktop

HST-06

Duplicate File Finder

Finds duplicate files by content hash and removes the redundant copies.

Groups by size first, then hashes only same-size files
Keep the first, oldest, or newest copy of each group
The last remaining copy can never be deleted
Limit: Matches identical content only; near-duplicates such as resized images or re-saved documents aren't found.

GUI + console
Confirms changes

✓ Included with Nadirion Desktop

HST-07

Software Inventory & Patch Checker

Lists installed software and updates it through the host's package manager.

Reads each platform's own package database
Flags versions with an update available
Updates through winget, apt, dnf, yum, or Homebrew
Limit: It sees only software the package database knows about, so portable and manually installed programs may be missing or show no update status.

GUI + console
Confirms changes

✓ Included with Nadirion Desktop

HST-08

File Conversion Kit

Converts files across image, spreadsheet, document, audio, and video formats.

A built-in file browser and a queue you review before anything runs
Images, CSV/XLSX/JSON, TXT/DOCX/PDF, and audio and video through ffmpeg
Offers only the output formats that every queued file can be converted to
Limit: Document conversion keeps the text and loses the layout. Audio and video need ffmpeg installed on the workstation.

GUI + console

✓ Included with Nadirion Desktop

In Development

Modules still being built and not sold yet. Both will be Premium modules ($100 per user per year) when released. Ask, and we'll let you know when they ship, or see everything in development.

2 modules

DEV-01

Intelligence Map

Plot geolocated threat activity across an interactive world map.

In development
Not yet sold
Premium when released

Ask to hear when it ships

DEV-02

Investigation Queue

Track analyst cases from intake through triage to closure, with an optional shared team queue.

In development
Not yet sold
Premium when released

Ask to hear when it ships

→ Free Tools

Where free tools cover similar ground

Many of these jobs can be done with free, well-regarded tools, and for some work they are the better choice. What Nadirion adds is one interface and command console for all of it, scores that list the rules behind them, offline operation, and host changes that ask first and can be undone. Here is the overlap, module by module.

Nadirion module	Free tools with similar coverage	What Nadirion adds, and where the free tool goes further
Intelligence Processor	CyberChef's extraction operations; the VirusTotal and AbuseIPDB websites	Extraction, lookups, and STIX export in one pass, with results sent straight to IOC Vault.
IOC Vault	MISP, OpenCTI	No server to run: one AES-256-GCM-encrypted file on a share. MISP and OpenCTI do far more, including sharing between organizations.
Intelligence Feed	Any RSS reader; CISA and vendor advisory pages read directly	Watchlist matching and CVE extraction in the same app as your other tools.
File Analysis	Detect It Easy, ExifTool, VirusTotal hash search	The checks combined, with the reasoning shown, and nothing uploaded.
Email Analysis	Message-header analyzers such as Google Admin Toolbox Messageheader	Authentication, routing, and lookalike checks together, each mapped to MITRE ATT&CK, without rendering the message.
Process, Service, Scheduled Task, and Registry & Persistence Analysis; Startup Manager	Sysinternals Autoruns and Process Explorer (Windows); RegRipper	One scoring approach across platforms, with a reason for each flag. Autoruns covers more Windows autostart locations.
Execution Evidence and Event Log & Logon Analysis	Eric Zimmerman's tools (PECmd, AmcacheParser, EvtxECmd), Hayabusa, Chainsaw	Merged, scored timelines in the same interface. The free tools cover more artifacts, and Hayabusa and Chainsaw apply large Sigma rule sets.
Browser Analysis	Hindsight, NirSoft BrowsingHistoryView	Risk flags across Chromium and Firefox browsers, including Volume Shadow Copy history on Windows.
Network Connection Forensics	netstat or ss; Sysinternals TCPView	Connections, listening ports, ARP, and the DNS cache in one exportable snapshot.
Malware Scan	Autoruns with its VirusTotal check, Hayabusa or Chainsaw for logs, and the antivirus built into Windows (Microsoft Defender)	One sweep that correlates those sources, with remediation that can be undone. It does not replace antivirus or EDR.
Secure Host	The operating system's own firewall commands (netsh, nftables, pf); EDR network containment, if you have it	A snapshot first and a one-step restore. EDR containment is harder for an attacker on the host to undo.
Triage Kit USB	Velociraptor offline collector, CyLR	Built from the same app, with a SHA-256 manifest and a verify step. Velociraptor collects far more and scales to many hosts.
USB ISO Burner	Rufus, balenaEtcher, dd	A checksum check before writing and a read-back afterward, from the same app.
Decoder	CyberChef	The same app and console as your other modules; auto-peel reports each layer it removed. CyberChef has far more operations.
Cryptographic Inventory	CBOMkit, testssl.sh, ssh-audit	Code, configuration, and endpoint findings combined into one migration plan with CBOM and SARIF output.
AI Analysis	c2patool and the Content Credentials Verify site, for provenance	Artifact and heuristic tiers on top of provenance. Those extra tiers are less reliable than provenance, and the score says which tier it rests on.
Persona Manager; Identity Lookup	A password manager or spreadsheet; search engines used directly; Sherlock or WhatsMyName for usernames	Persona records and query building in one place. Sherlock and WhatsMyName check a username directly against hundreds of sites.
Uptime Monitor, Route Mapper, Network Mapper	Uptime Kuma, mtr or WinMTR, Nmap, arp-scan	Segment-aware flags in a shared console. Nmap and Uptime Kuma do much more.
Host Utilities	WinDirStat or ncdu, dupeGuru, winget, apt, or Homebrew used directly, ffmpeg, and the operating system's own driver updates	Confirm-before-change in the same app. Otherwise these overlap heavily with free tools.

Listed for comparison only; Nadirion is not affiliated with these projects. Check each tool's license before using it commercially.

→ Not Sure Yet?

Tell us about your work. We'll recommend the modules.

Describe what you investigate or maintain, and we'll suggest the modules that fit, including where a free tool may already cover the need.

Ask for a Recommendation See Pricing