Why

During an investigation, the details pile up fast: timestamps, hosts, accounts, IPs, hashes, and where each piece of evidence came from. I wanted one place to keep a case organized instead of scattered notes.

What it does

• Cases: each one gets a case code, an incident type (ransomware, phishing, business email compromise, insider threat, and more), a severity from info to critical, and a status.
• Response phases: follows the incident response lifecycle: detection and analysis, containment, eradication, recovery, and post-incident review.
• Timeline: events with their own severity, searchable and filterable.
• Entities: hosts, user accounts, IPs, domains, file hashes, malware, network assets, and external parties, each tagged so they're easy to scan.
• Evidence: a log of what was collected (log excerpts, memory dumps, disk images, network captures, emails, and so on).
• Notes and export: free-form notes that save automatically, plus an export of the whole case.

Try it

Start a case and add a few events, entities, and evidence. Everything is saved only in your own browser.

Open it full screen ›