Recording Analysis in the Notebook

The Notebook records findings and analysis goals for your current Sidekick workspace. Notebook entries are accessible from the Sidekick Resources sidebar and are saved in Sidekick's workspace database. See Persistence for how to keep them when closing and reopening a binary.

The Notebook is organized around entries. Each entry represents a distinct analysis goal or line of inquiry. Within an entry you can record:

• TaskItems — specific steps you plan to take or are tracking
• Outcomes — findings and artifacts you have discovered while pursuing the entry
• Blockers — requests for outside input that Sidekick cannot resolve itself

Entries can also carry analysis_context: structured intermediate analysis state used by Sidekick tools, agents, and scripts. It is separate from outcomes and blockers, and it is not currently shown in the Resources UI.

Sidekick reads the Notebook as context when responding to your messages in Chat, and automatically updates its understanding of your analysis as you record findings and complete entries.

Opening the Notebook

The Notebook lives in Sidekick Resources. See Browsing Workspace Resources for an overview of the sidebar's browse list and detail layout, search, and shared context-menu actions.

In the browse list, each notebook row shows the entry description and counts of its findings, artifacts, open blockers, and dependencies. Selecting a notebook entry shows its full detail in Resources — header, SUMMARY (for closed entries), BLOCKERS and TASKS (only when present), OUTCOMES, and references.

Code references inside the entry detail (addresses and symbols in outcome prose, and the REFERENCES chips) navigate Binary Ninja to the referenced code location.

Session Briefing

The Session Briefing is Sidekick's rolling case file for the current workspace. Open it from the Memory tab of a workspace in the Sidekick tab: choose Plugins > Sidekick > Show Workspaces, select the workspace, then click Memory.

The briefing view is organized into up to seven sections; empty sections are hidden:

• Goal — the durable analysis mission
• Status — how complete the goal is in plain language
• Needs your input — open blockers you haven't answered yet, stating what Sidekick needs from you
• Key findings — the durable conclusions the next analyst must know
• Current focus — active work or current attention, when any
• Open questions — critical unresolved issues, when any
• Wayfinding — binary/system landmarks, functions, flows, sinks, and data sources

Source links appear inline on the findings and wayfinding bullets they support when the briefing actor can cite notebook entries or outcomes.

Creating Entries

Each workspace has its own notebook entries; you do not need to create a separate Notebook first.

Notebook entries are created by Sidekick as it works. Ask in Chat (for example, "Track the authentication flow as a notebook entry" or "Add a task to check all callers of validate_token") and Sidekick records the entry, tasks, and outcomes with provenance. The Resources sidebar has no input box for creating entries.

Example: recording findings from a chat response

You can use the same Chat workflow to record useful conclusions from an answer you have already received:

1. In the conversation containing the answer, ask Sidekick to record them. For example: "Record the supported findings from your previous answer in a notebook entry named Authentication flow. Include the code references and any remaining uncertainty." If you want to use an existing entry, name it or include its link in the request.
2. Wait for Sidekick to finish recording the results. Open Sidekick Resources from Binary Ninja's sidebar and select the entry. In a narrow sidebar, double-click it or choose Show Details to open its detail view.
3. Under OUTCOMES, click a finding's card to expand it and review its evidence record, properties, chats, and references. New outcomes start as draft; background validation may verify or reject them, or leave them as drafts if more evidence is needed. The workspace's Findings tab marks a verified finding with a filled flag.

For a report you can save as a file, ask for an artifact instead: "Save the analysis in your previous answer as a Markdown report artifact in the Authentication flow notebook entry." Choose View on the resulting artifact card to read the report without leaving Binary Ninja, or Export… from its menu to save a copy to a location you choose. File actions depend on the artifact's type. Artifact outcomes are also available on the workspace's Artifacts tab.

Recording findings or creating a report is a new Chat request and uses the Sidekick service. Chat has no Save to Notebook button. To preserve the exact message text without another AI request, hover over the response, choose Copy, and paste it into your own document. A notebook finding or generated report may summarize or reorganize the answer.

Before closing a standalone raw binary, save it as a .bndb to preserve its notebook. See Persistence.

Managing Entries

Viewing an entry

Select an entry in the browse list to show its detail in Resources. In a narrow sidebar, double-click the entry, press Enter, or choose Show Details from its context menu. The detail shows:

• The entry description (double-click to edit inline)
• A SUMMARY section (for closed entries that have a summary)
• A depends on line (link icon) linking the entries this one depends on (shown only when dependencies exist)
• BLOCKERS and TASKS (each only when present), followed by OUTCOMES

Renaming an entry

Double-click the entry description in the detail view to edit it inline; press Enter or click away to save. Notebook entries do not have a Rename item in the right-click menu.

Searching entries

Type in the search box at the top of the browse list. Search matches against the entry description, status, relevant domains, task descriptions, and outcome titles and descriptions. A deeper content search also looks inside the entry's text.

Closing an entry

Sidekick closes an entry when it finishes a line of work, recording a resolution (Completed, Partially completed, Infeasible, or Deferred) and an optional summary. The summary appears in the SUMMARY section of the entry detail. There is no right-click action to complete, abandon, or reactivate an entry; ask Chat to do so.

Deleting an entry

Right-click an entry and choose Delete; Sidekick asks Delete '<title>'? before removing it. Deletion is permanent.

Working with Tasks

TaskItems are specific steps tracked within an entry. They appear in the Tasks section of the detail view; entries without tasks omit the section.

Adding a task

Ask in Chat (for example, "Add a task to check all callers of validate_token") and Sidekick adds it as a task on the entry. Adding a task is how you steer the work: describe the result you want and a thread that picks it up will record the outcome with full provenance.

Cycling task status

Each task has a clickable status icon. Click it to cycle the task through pending, in_progress, and completed, then back to pending.

Icon	Status
Gray square	pending
Yellow dotted square	in_progress
Green checked square	completed
Red crossed square	blocked

A blocked status is set by Sidekick, not by clicking. Clicking a blocked task returns it to pending. Completed and blocked tasks are dimmed. When all of an entry's tasks are completed, they fold into a single "N completed tasks" row; click it to expand.

Removing a task

Hover over a task, click the trash button on the right, and click Remove Task in the confirmation.

Working with Outcomes

Outcomes capture knowledge discovered while pursuing an entry. Each outcome has a kind, a title, an optional description, a confidence score, a status lifecycle, and thread-level provenance for creation and validation.

Outcome kinds

Kind	Purpose
finding	A reusable, anchored fact about the binary (for example, "Function at 0x401000 uses XOR encryption")
artifact	A concrete deliverable produced by the work — YARA signature, report, proof-of-concept, generated script

Blockers

A blocker records something Sidekick needs from you before it can continue, such as a missing file or a decision. Blockers are separate from outcomes and appear in their own BLOCKERS section above TASKS. Open blockers show a Needs: ... line; resolved or withdrawn blockers show Resolved: ... or Withdrawn: ... with the recorded resolution. Sidekick creates and resolves blockers; answer one from the question banner in the Sidekick tab, which sends your reply to the chat that asked.

How outcomes are created

In the plugin UI, ask Sidekick in Chat to create an outcome. Sidekick records its supporting evidence, confidence, and creating thread; validation threads can add their results later. To steer an investigation toward a result you want, ask Chat to add a task describing it (for example, "determine whether the blob at 0xa640c is encrypted"). You can also ask it to record findings from an existing answer.

Editing an outcome description

Open the entry in Sidekick Resources, click the outcome's title to expand it, then double-click its description to edit the text. If it has no description yet, double-click Add description. Click away to save your changes, or press Escape to cancel.

This edits the description locally and does not change the outcome's validation status. If your correction changes the claim or its supporting evidence, ask Chat to review it.

Outcome status lifecycle

In Chat, outcomes follow this status lifecycle:

draft <-> verified
draft, verified -> rejected

• draft — initial state on creation
• verified — confirmed and in use; can be moved back to draft if the outcome needs to be reopened for review
• rejected — determined to be invalid or withdrawn (requires a reason); rejected outcomes cannot be moved back to draft or verified through Chat

Rejecting an outcome does not automatically reject outcomes that link to it. When the Notebook Validation actor rejects an outcome, it also rejects the outcomes in the same entry that link to it.

Outcome status transitions are made automatically by Sidekick, mainly by the Notebook Validation actor. Each outcome is a card. The collapsed card shows a kind icon (a flag for findings, or the artifact's file-type icon), the title, a byline with the outcome's type and when it was created or last changed, and the properties Sidekick generates for it. Click the card to expand it and see the description (labelled Evidence record on a finding), any artifact file details, a contested by line for rejected outcomes, and CHATS and REFERENCES chips. Rejected titles are struck through. The card does not show its status; the workspace's Findings tab marks verified findings.

Sidekick fills in an outcome's properties itself in the background, a short while after the outcome is recorded or its claim changes, so a new card may show none at first.

Removing an outcome

Hover over an outcome card, click the × at its top right, and click Remove Outcome in the confirmation.

Outcome provenance

Outcomes track thread-level provenance:

• The Chat thread that created the outcome, when known.
• The validation threads that have checked that specific outcome.
• The threads that rejected the outcome (contested it), when known.

In an expanded card, the CHATS chips link the thread that created the outcome, followed by any validating threads. A rejected outcome shows a red ✗ contested by line with the contesting thread and the rejection rationale. Referenced functions and types appear as chips under a REFERENCES label. The expand all / collapse all toggle in the OUTCOMES header expands or collapses every card.

Analysis Context

Notebook entries may also store analysis_context: durable, machine-readable intermediate state such as scope blocks, candidate lists, partition rules, or coverage manifests. This data is meant for tooling and automation rather than for direct human browsing in the sidebar.

Use analysis_context when Sidekick or a script needs to carry structured working state forward across turns or sessions without pretending that the state is already a finding, artifact, or blocker.

analysis_context is available through the scripting and tool surfaces, but it is not currently rendered in the Notebook detail surface.

Dependencies Between Entries

Entries can reference other entries they depend on. Dependencies are informational — they help you track relationships between analysis goals but are not enforced. Use dependencies when one entry's outcome is a prerequisite for another — for example, if "Investigate loader" must complete before "Identify entry point" can begin.

Dependencies appear as a depends on edge line in the detail view header, right below the entry's provenance line. Each linked entry is clickable and opens that entry's detail view. The line appears only when the entry has dependencies.

Adding a dependency

When an entry already has dependencies, click the + at the end of the depends on line; the dialog shows all other entries — select one and click Add. The first dependency on an entry is normally established by Sidekick while it works; ask for it in Chat.

Removing a dependency

Click the × button next to the dependency link on the depends on line.

Navigating to Threads

Every outcome tracks the Chat threads that created and validated it. The chat chips on an expanded outcome card, and its ✗ contested by line, navigate to those conversations in the Sidekick Chat sidebar. The Tasks card in the Sidekick tab also links each open entry to the chat driving it.

This lets you trace how Sidekick's analysis in Chat contributed to outcomes recorded in the Notebook.

How Sidekick Uses the Notebook

Sidekick integrates with the Notebook in several automated ways:

• Context for Chat — the Chat Assistant reads active notebook entries and their outcomes to inform its responses. You do not need to repeat findings you have already recorded.
• Structured working state — Sidekick tools and scripts can read an entry's analysis_context to resume intermediate state such as scope and candidate sets without recomputing it.
• Outcome validation — when a new finding or artifact outcome is added as a draft, the Notebook Validation actor checks it against its evidence. It promotes the outcome to verified, rejects it with a reason, or leaves it as a draft when the evidence is insufficient to decide. When it rejects an outcome, it also rejects linked outcomes and re-checks dependent entries. The validating threads appear on the outcome card.
• Session briefing synthesis — the Analysis Briefings actor continuously updates a session-level briefing from notebook activity and recent chats. You can review that briefing on the Memory tab of a workspace in the Sidekick tab; the Memory tab is read-only and the briefing is rewritten automatically as your notebook and chats change. To influence it, record findings, tasks, or blockers in the Notebook through Chat.

Working offline

You can browse existing notebook entries and make local edits offline, including renaming entries, editing outcome descriptions, changing task status, and deleting items. Creating entries, tasks, or outcomes through Chat requires the Sidekick service. Background validation and session briefing synthesis also require the service.

Persistence

Notebook changes are saved automatically in Sidekick's workspace database (workspaces.db). For saved .bndb files and project workspaces, entries, tasks, outcomes, and analysis_context are preserved across Binary Ninja sessions. Reopening the saved file or selecting the same project workspace restores its notebook.

For standalone files that are not part of a Binary Ninja project, each file gets its own workspace, so the notebook is scoped to that file.

Save a standalone raw binary before closing it

A standalone raw binary that has never been saved as a .bndb has a temporary workspace. Closing it deletes that workspace's data, including its notebook. If it contains your chats or other work, Sidekick asks Save Sidekick Workspace Before Closing? and offers Save BNDB and Close…, Close and Delete Workspace, or Cancel. Choosing Save BNDB and Close… saves a .bndb and then closes the file, keeping the workspace.

The .bndb stores the standalone file's workspace identity; notebook content remains in Sidekick's local database. To transfer the notebook to another machine, export workspace data as described in Sharing Analysis Data. See Data Storage for more on workspace lifecycle.

Notebook in the Sidekick Tab

In the Sidekick tab's Monitor view, click a workspace's Open tasks count for its Tasks card: the open notebook entries grouped as Blocked (with what Sidekick needs from you), In progress, and Not started, each with its tasks and a chip that opens the chat driving it. The full entry is in the Resources sidebar. The workspace's Findings tab lists its findings, and the Artifacts tab its artifact outcomes.

Tips

• Tell Chat your analysis intent before asking it to investigate; Sidekick records it as an entry. This gives the Chat Assistant explicit context about what you are trying to accomplish.
• Use finding outcomes for reusable, anchored facts you can point future work at. Use artifact outcomes for concrete deliverables (YARA signatures, reports, PoCs). When Sidekick is stuck on something only you can supply, it records a blocker; answer it from the Sidekick tab's question banner.
• When a line of investigation is finished, ask Chat to close the entry with an appropriate resolution. Closed entries remain accessible and their outcomes continue to inform Chat, but they no longer appear as active work.
• To focus Chat on a specific entry, mention it in your message or paste its link.