nightHawk

Leverages Elasticsearch's parent-child document model to handle millions of documents efficiently, as designed for large-scale forensic data ingestion and presentation.

Consolidates multiple audit types into a single view per endpoint, addressing the challenge of managing hundreds of investigations from one pane of glass.

Includes timelining, interactive process trees, and global search for comprehensive analysis, as highlighted in the Key Features section.

Supports both Mandiant Redline and FireEye HX audit files with concurrent or sequential uploads, though with resource limitations noted in the README.