docs: expand investigation and DFIR portfolio

[egrexsec]

Summary

• evolve the portfolio toward endpoint, identity, network, cloud, and DFIR investigations
• preserve all existing detection and purple-team content and URLs
• add investigation domain indexes, DFIR method indexes, case-study lanes, and reusable workflows
• add the canonical 21-step lifecycle and MAY-IR-001 through MAY-IR-005 roadmap
• distinguish Live validated supporting scenarios from Installed investigation notes and Planned MAY-IR cases
• document private evidence boundaries, AI-assisted analysis controls, and non-provisioning AWS alignment

Validation

• python3 playbook validate — passed
• Sigma lint/conversion and fixture tests — passed; one pre-existing non-failing annotation warning remains
• previous-scenario validation — 12/12 passed
• python3 -m unittest discover -s tests -v — 10 passed
• Markdown link validation and git diff --check — passed

Boundaries

• no detection content removed or reorganized
• no schema or automation source changes
• no raw forensic evidence
• no AWS provisioning
• open PRs feat: validate T1546.003 WMI event subscriptions #22 and feat: implement threat-informed detection cycle 1 #23 are not prerequisites for this change

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b8c6a60825

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require analysis before marking memory triage Verified

When a known image has merely been acquired but never analyzed, this criterion permits the combined memory acquisition-and-triage capability to be promoted to Verified. That contradicts the repository-wide definition that Verified means the workflow was exercised successfully and dfir/memory/README.md, which requires reproducible processing and recovery of expected artifacts. Require reproducible analysis and artifact recovery here so acquisition-only testing cannot advertise untested triage as Verified.

Useful? React with 👍 / 👎.