Introducing Cycas: a scalable DFIR automation pipeline in Azure

Every incident response analyst has been there: the further an investigation progresses, the more evidence has quietly disappeared. The Windows Event log rolls over. The USN journal doesn't reach far enough back. And it's rarely just those two. So you want to preserve the most valuable artifacts at the very start of an engagement. And if the investigation later points you at something you didn't collect the first time, say IIS logs, you don't want to go back to the customer to ask for a second run. To do these collections, most incident response teams reach for Velociraptor. And for good reason: no open-source tool beats its live-response capability. You ask a precise question across all connected endpoints and get a fast answer back. But the drawback is that you have to decide upfront what to pull. And that is something that is hard to do, because you don't yet know which artifact will matter. So we set out to solve two problems: collecting everything up front, and then querying that bulk of data fast enough to actually investigate it. That's why we built Cycas. It ingests everything from Velociraptor into tables in an Azure Data Explorer (ADX) cluster: whether these are raw artifacts collected from 500 endpoints, or whether these are hunt results of 50.000 endpoints collected by the Velociraptor server. All the ingested data is queryable with Kusto Query Language (KQL), across every host at once. We've used it internally for a few years. And we decided this year to open-source it as we felt it was mature enough. We then started building a dashboard and an installer to ensure the community can easily use it as well. The solution will be open-sourced in August 2026, and we want BSides to be the first conference to showcase it. This talk will walk through what problems it solves, how it was engineered and how it handles extreme burst of data ingestion - and lastly, we will show a demo. Attendees will leave knowing how to setup scalable, queryable evidence preservation for their own engagements, and why "collect everything, analyse later" is finally practical with Velociraptor.