01
Host Telemetry And Triage
Collect Windows process, network, file, WHIDS, OSSEC/HIDS, and incident signals into one analyst-readable operating picture.
Windows telemetry / malware triage / governed response
ShadowLabturns signalinto action.
A local security operations platform for host telemetry, suspicious-process investigation, file and malware analysis, antivirus containment, ATT&CK coverage, enterprise casework, and audit-ready response.
Local security operations surfaceTelemetry, cases, evidence, and response moving in one workflow
Core Capabilities
Windows defense work arranged like an operations atlas, not a dashboard dump.
ShadowLab separates the noise into rooms: telemetry, process intelligence, persistence, file analysis, network, antivirus containment, ATT&CK, evidence, casework, and controlled response. Each room keeps the next analyst action visible.
02
File And Malware Analysis
Combine native Detect It Easy, PE fallback, local YARA, memory tradecraft rules, sandbox traces, and AI-assisted triage.
03
Containment And Casework
Move from verdicts and quarantine into enterprise cases with assignments, approvals, notes, evidence pins, exports, and audit history.
Pipeline
A case moves forward only when the evidence and policy move with it.
The response path is intentionally governed. Every enrichment, ATT&CK mapping, approval, mutation, containment action, and export remains attached to the final record.
Ingest host signals
Windows process, file, network, WHIDS, OSSEC/HIDS, packet, and incident telemetry enter a normalized backend model.
Investigate behavior
Process trees, strings, internals, persistence artifacts, sandbox traces, and PE structure turn raw activity into evidence.
Fuse verdicts
YARA, memory rules, trusted-publisher checks, antivirus providers, heuristics, and enrichment feed a consensus-aware verdict.
Map ATT&CK context
Incidents and cases are enriched with ATT&CK coverage, tactic heat, Navigator layers, and Workbench-oriented exports.
Control response
Quarantine, rollback, network blocker controls, approvals, signed mutations, and policy gates keep impact-heavy actions governed.
Export the record
Reports, audit mirrors, artifact bundles, case notes, graph context, and timeline context move into handoff-ready output.
Platform
A product archive that reads like an operator console.
The screens are product-real surfaces from the lab: dashboards, WHIDS, HIDS, overview, processes, persistence, file analysis, network, graph, timeline, antivirus, artifacts, enterprise, and security operations.
Room 01 / Command
Platform posture is visible before the incident starts.
The dashboard wall condenses platform health, threat posture, auth state, telemetry freshness, and investigation summaries into one operator view.
Room 02 / Monitor
Live operations need a calm first read.
Overview gives the analyst a high-signal incident brief with monitor output, telemetry posture, and the current detection story.
Room 03 / Processes
Process behavior is where intent starts to show.
Profiling, process-tree review, strings, internals, YARA, memory analysis, sandbox traces, AI triage, and response context stay together.
Room 04 / Persistence
Persistence is treated as a remediation map.
Scheduled tasks, services, registry footholds, and startup artifacts are grouped by risk so cleanup is deliberate instead of cosmetic.
Room 05 / File Analysis
Malware analysis becomes a decision surface.
Native Detect It Easy, optional DiE binaries, PE fallback, file/process submission, highlights, and YARA context sit in one focused workspace.
Room 06 / Network
Network telemetry is converted into response context.
Connection review, packet capture, ARP discovery, blocker controls, and host inventory are separated by privilege so visibility does not become unsafe action.
Room 07 / Graph
Every host, process, and artifact has a place in the map.
Relationships are treated as evidence, not decoration. The graph makes the next investigative move legible.
Room 08 / Timeline
Incidents are reconstructed as a story with timestamps.
Actions, detections, and analyst notes line up into a response narrative the team can trust.
Room 09 / Antivirus
Containment is governed by provider consensus.
Provider health, verdict history, quarantine, response actions, rules, lists, webhooks, and trusted-publisher logic keep containment explainable.
Room 10 / History
Past incidents become an audit instrument.
Incident, action, auth, and audit history stay available for retrospective investigation and operational review.
Room 11 / Artifacts
Evidence is stored like it may be challenged later.
Reports, telemetry exports, collected evidence, files, hashes, screenshots, and investigation output remain attached to the record.
Room 12 / Enterprise
Cases scale when ownership is visible.
Enterprise Ops and Enterprise Intel manage assignments, tasks, approvals, notes, stories, evidence pins, ATT&CK coverage, and exports.
Room 13 / Security Ops
Readiness is measured before pressure arrives.
Integrity, observability, secrets, YARA health, retention, audit export, policy posture, origin controls, and reporting are operational controls.
Room 14 / WHIDS
Windows host telemetry gets its own lane.
WHIDS manager sync, report ingest, artifact pull, scheduler state, IoCs, rules, and enterprise pivots are available from one surface.
Room 15 / HIDS
Host intrusion signals are normalized for investigation.
OSSEC/HIDS alert streams, live ingest, host state, rule matches, file changes, and response planning are connected to incidents.
Room 16 / About
The product explains itself without becoming a brochure.
The about surface keeps profile, FAQ, and platform framing close to the product so credibility follows the interface instead of replacing it.
Stack
The system is built like a local security platform, not a single-purpose script.
01FastAPI Routes
02PySide6 Operator Console
03SQLite / PostgreSQL
04YARA + YARAify
05Detect It Easy
06WHIDS / OSSEC HIDS
07Antivirus Providers
08RBAC + Signed Requests
Built byUlfat Ibadov
Conversation
ShadowLab is Ulfat Ibadov's focused lab for defensible cyber decisions.
Ulfat Ibadov created ShadowLab as a Windows-first cybersecurity operations platform for detection engineering, malware triage, incident response practice, enterprise casework, and evidence-led investigations.
ShadowLab is a Windows-first cybersecurity operations platform built around a local FastAPI backend and a PySide6 desktop operator console. It is made for cybersecurity engineers, detection engineers, threat hunters, incident responders, malware analysts, and developers who need telemetry, cases, response, and evidence to stay connected.
It is intended for owned, isolated lab environments where response actions, packet inspection, ARP discovery, network blocker controls, and malware-analysis workflows can be tested responsibly.