The DFIR Report

https://thedfirreport.com/

Real-world intrusion case studies. RSS at https://thedfirreport.com/feed/ also works. 2026-05-08 audit: 5 dated articles Sep 2025 - Apr 22 2026. (v2.55: rss_url verified — use `python3 tools/fetch_source.py feed https://thedfirreport.com/feed/ [N]`) | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → rss: python3 tools/fetch_source.py feed https://thedfirreport.com/feed/ 5 (then webfetch the per-article URL for full body — webfetch works on article pages). AVOID: Low cadence (~1-2 posts/month) — do not expect daily freshness; the feed lag is the publisher's pace, not a fetch failure.. | 2026-07-05 admiralty audit: B (HIGH->B) — original DFIR intrusion research, first-hand telemetry; stays active, no change. Low cadence (~1-2/month) is the publisher's pace, not a fetch failure; drill the per-article URL via webfetch for full body.