Observed arrival · 2026-09-03
IncidentCompanion: A Case File for Intrusions
An open-source, self-hosted workspace for investigating security incidents, correlating evidence, and producing reports.
Field notes
The project models an investigation as a structured case rather than a loose collection of notes, with dedicated areas for timelines, entities, evidence, methods, impact, kill-chain coverage, compliance, and reporting. Its development process is unusually explicit: 20 capabilities have written specifications, 31 tests inspect source-level rules, and the stated installation path uses Docker Compose v2. The site also records meaningful limitations, including no releases, no upgrade path, and a moving case format.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue