IncidentCompanion
Untangling the intrusion is the hard part. The report shouldn’t be.
A self-hosted workspace for security incident investigation and root-cause analysis. Written for SOC, MXDR and incident-response analysts.
# Docker with Compose v2, and a shell. $ git clone https://github.com/pureidlelabs/IncidentCompanion.git $ cd IncidentCompanion $ ./docker/secrets.sh $ docker compose up --build
Just want to have a quick look? Open the demo ↗
AGPL-3.0-only, under Docker Compose, on your own hardware. No releases yet.
02 · A case
Collect it, correlate it, and the document comes out of it.
- Collect
- Correlate
- Report
- Case
03 · How it's built
Specs first, then the code.
I write the specifications. An LLM writes most of the code from them.
Each one specified
Every capability has a spec saying what it must do and a design document saying how. A change starts as a written proposal.
Properties, not mechanisms
Short articles fixing what the system must be true of, in RFC language: “An installation with nothing configured MUST be complete, and MUST make no outbound request at all.”
The rules are executable
They read the source rather than the rendered page. One fails when a screen re-implements a shared block; another when a container draws anything itself.
04 · Development
Where it stands.
Early development
Not ready for real casework. No releases, no upgrade path, and a case format that moves under you.
AGPL-3.0-only
Run it, read it, change it and deploy it in your own environment, for any number of analysts, at no cost.
No release yet
The case format, the screens and the specs all keep moving until there is one. Watch the repository if you want to see it get there.