----------------
🛠️ Tool
===================
IRDoc is a self-hostable, open-core incident response documentation platform designed for SOC analysts, IR engineers, and MSSPs. It provides a structured workspace to document an incident from initial detection through the final report, replacing the fragmented workflow of switching between a ticket system, a Word document, and a SharePoint folder.
🔹 Key Features
• Timeline-first workspace: Chronological event logging across detection, analysis, containment, evidence, and communications phases. This approach ensures that the report is built progressively as the investigation unfolds.
• IOC management: Automated tracking and detection of IPs, domains, hashes, emails, and URLs within the platform. This eliminates the need to maintain separate IOC lists.
• Evidence attachments: Drag-and-drop or paste screenshots directly into the incident timeline. This keeps visual evidence contextually aligned with the investigation steps.
• Task management: Phase-grouped tasks generated from incident templates. Analysts can track containment and remediation actions without leaving the workspace.
• Inbound webhook API: Create cases from ServiceDesk Plus, Jira, or any system capable of POSTing JSON. This allows seamless integration with existing alerting pipelines.
• Investigation graph: Visual relationship map linking IOCs, timeline entries, and attached evidence. This provides a quick overview of how different components of the incident interact.
• Self-hosted architecture: Incident data remains on the deploying organization's infrastructure, addressing data residency and privacy concerns.
🔹 Technical Implementation
The core repository is licensed under AGPL-3.0. The project integrates automated security scanning, including CodeQL, secret scanning, dependency audits, and an OpenSSF Scorecard. The maintainers state they aim to release patches for critical vulnerabilities within 24 hours of confirmation. Inbound webhooks allow integration with existing ticketing systems, ensuring IRDoc can act as a dedicated documentation layer rather than a replacement for alerting or case creation.
🔹 Use Cases
Primary use cases include structured IR case management for SOCs that require strict data residency via self-hosting. It is also suited for MSSPs needing a structured documentation framework that can map relationships between indicators and evidence across multiple client incidents. The visual investigation graph is particularly useful for complex incidents involving multiple overlapping IOCs.
🔹 Limitations
The core is free under AGPL-3.0, but the open-core model implies there may be paid features or enterprise extensions not detailed in the repository. The repository does not specify the underlying database or deployment framework in the provided summary, though documentation is available at their docs site. Performance under high concurrency is not documented.
🔹 tool
#IncidentResponse #SOC #OpenSource #DFIR
🔗 Source:
✅🎯🙄
