> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> Network topology and data flow of the triage-llm-lab.

## Network Topology

```
                    🌐 Internet / Anthropic API
                            │
   ┌─────────────────┐   Host-only 192.168.56.0/24
   │ VM1 — Ubuntu    │──────────┬──────────────────┐
   │ Claude Code     │          │                  │
   │ MCP Servers     │          ▼                  ▼
   │ NAT + Host-only │  ┌───────────────┐  ┌──────────────┐
   └─────────────────┘  │ VM2 — REMnux  │  │ VM3 — SIFT   │
                         │ .56.20        │  │ .56.30        │
                         │ Static Anal.  │  │ Mem Forensics │
                         │ Ghidra Docker │  │ Disk Forensics│
                         └───────────────┘  └──────────────┘
                              VM4 — Windows 10 (.56.40) — future
```

> [!WARNING]
>
> **VM1 is the only machine with internet access.** Samples are transferred to REMnux via SCP and never executed on VM1. Evidence for forensics is placed on SIFT under `/cases/`. The LLM orchestrates all analysis remotely over SSH.

## Data Flow — Malware Analysis

```
1. Analyst types prompt in Claude Code (VM1)
       │
2. Claude calls virustotal MCP
       │  → download sample → ~/downloads/sample.zip (VM1)
       │
3. Claude calls remnux-ssh MCP
       │  → scp sample.zip → /home/remnux/intake/ (VM2)
       │  → unzip with password: infected
       │  → run triage / static / Ghidra tools on VM2
       │
4. Claude synthesizes results
       └  → produces structured analysis report
```

## Data Flow — Digital Forensics

```
1. Analyst places evidence on SIFT (/cases/)
       │
2. Claude calls sift-ssh MCP
       │  → triage_memory / triage_disk
       │  → memory_malfind / memory_pslist / memory_netscan
       │  → timeline_create / disk_list_files / carve_files
       │
3. Claude cross-references IOCs with virustotal MCP
       │
4. Carved executables transferred to REMnux for static analysis
       └  → produces forensic report
```

## Network Adapter Configuration

| VM | Adapter 1 | Adapter 2 |
| - | - | - |
| VM1 — Ubuntu | NAT (internet) | Host-only VMnet1 (`192.168.56.10`) |
| VM2 — REMnux | Host-only VMnet1 (`192.168.56.20`) | — |
| VM3 — SIFT | Host-only VMnet1 (`192.168.56.30`) | — |
| VM4 — Windows *(future)* | Host-only VMnet1 (`192.168.56.40`) | — |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.