tsale / jevline

git clone https://github.com/tsale/jevline.git

Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.