Nemesis is an offensive security data processing platform by SpecterOps that ingests, enriches, analyzes, and alerts on files collected during red team and DFIR operations. The system is architected as a suite of microservices orchestrated via Dapr (pub/sub, workflows, state management), with services implemented in Python (FastAPI), Go (Titus secret scanner), and C# (ILSpy .NET decompiler). Key data flows: files are ingested via a CLI (supporting Cobalt Strike, Mythic, Outflank connectors) or REST API, then processed through a Dapr workflow that performs basic analysis (magic, hashes), runs pluggable enrichment modules (PE, .NET, Chromium/DPAPI decryption, YARA, SQLite, containers), invokes the Titus secret scanner, and finally publishes findings and alerts. A React frontend with Hasura GraphQL provides a dashboard for file browsing, enrichment status, YARA management, LLM-based triage agents, and reporting. The platform is deployment-agnostic with Docker Compose and Helm charts for k8s. Notable technical depth includes a standalone DPAPI decryption library (nemesis_dpapi) with multiple storage backends and write-once semantics, a rule-based file linking engine, and an AI agent framework using pydantic-ai and LiteLLM.