Open source, self-hosted
IncidentCompanion
A self-hosted workspace for security incident investigation and root-cause analysis.
- Status
- In development
- Licence
- AGPL-3.0
- Runs on
- Docker
- Data
- Your server
What it is
When you investigate a security incident, the findings end up scattered: a timeline in one place, the affected machines in another, screenshots in a folder, and the report written from memory at the end. IncidentCompanion keeps all of it in one case, and produces the report from it.
- One case, one workspace: timeline, machines, accounts, malware and evidence together.
- Two analysts on one case. Edits appear on everyone's screen, and a conflicting save asks before it overwrites.
- Evidence is hashed as you attach it, and stays with the case.
- The report is the point: a chronology that survives the paste into Word.
- Self-hosted. It runs on your machine or your server, and nothing leaves it.
Written for SOC, MXDR and incident-response analysts. NIS2, DORA and GDPR where they apply.
Before you start
This is early development and it is not ready for real casework. There are no releases and no upgrade path: the case format changes without warning, and the app refuses data from an older format.
Licence
AGPL-3.0-only. The source, the issues and the quick start are on GitHub.