Skip to content
SPECIFICTION
Get listed

Dagobert

github.com

WebLinuxAPISelf-hosted
Visit github.com
Spec score 7.6 #12 of 21 in Incident Response Software

What it is

Dagobert is a free, MIT-licensed workspace for digital forensics and incident response investigations. Teams can keep multiple cases in separate workspaces with role-based, per-case access managed in the interface. Records cover timelines, assets, indicators, evidence, malware, tasks, notes and comments, with CSV import and export. A cross-case dashboard includes a MITRE ATT&CK heatmap, unified timeline, evidence and indicator tracking, and a lateral-movement graph. Reports are generated from supplied Word, Excel or Calc, Writer, and Impress templates in DOCX, ODS, ODT and ODP formats. Background jobs can process evidence with Hayabusa, Zircolite, Chainsaw, Plaso and Dissect. Indicator enrichment can query VirusTotal, AbuseIPDB and Hybrid Analysis, while timelines exchange with Timesketch. Hooks trigger automations on record changes. An authenticated read-only MCP endpoint exposes case data. Local accounts and OIDC are supported. The project is a Go binary backed by SQLite, with Docker self-hosting instructions.

Spec sheet

Purpose
Dagobert provides incident response teams a shared workspace for forensic investigations, including findings, timelines, tasks, notes, and report generation.Read 7 Oct 2026 · github.com
Intended users
The product document identifies DFIR consultants working cases for outside clients as its primary audience and internal CIRT/SOC teams as a secondary audience.Read 7 Oct 2026 · github.com
Deployment
The project describes itself as a single Go binary backed by SQLite and provides Docker-based installation instructions for self-hosting.Read 7 Oct 2026 · github.com
Integrations
Indicator enrichment can query VirusTotal, AbuseIPDB, and Hybrid Analysis, and Dagobert can exchange timelines with Timesketch.Read 7 Oct 2026 · github.com
Support
The README directs users to open a GitHub issue for questions and bug reports.Read 7 Oct 2026 · github.com
License
The repository states that Dagobert is released under the MIT License.Read 7 Oct 2026 · github.com
Maker
The repository owner’s GitHub profile identifies the maker as Thomas Kastner.Read 7 Oct 2026 · github.com
Authentication
Users can sign in with built-in local accounts or an OIDC provider; OIDC auto-provisioning is optional.Read 7 Oct 2026 · github.com
Automation
Hooks can trigger automations when records are created or updated, with conditions written as expr expressions.Read 7 Oct 2026 · github.com
Automation and API
Hooks can trigger automations on record creation or updates, and an authenticated HTTP MCP endpoint exposes case data read-only to MCP clients.Read 7 Oct 2026 · github.com
Case management
It supports multiple investigations in separate workspaces with role-based, per-case access control managed in the UI.Read 7 Oct 2026 · github.com
Commercial status
The product document says there is no commercial offering, pricing, or support tier.Read 7 Oct 2026 · github.com
Evidence processing
Background evidence-processing jobs can use Hayabusa, Zircolite, Chainsaw, Plaso, and Dissect.Read 7 Oct 2026 · github.com
Investigation features
Features include a cross-case dashboard with a MITRE ATT&CK heatmap, a unified timeline, evidence and indicator tracking, and a lateral movement graph.Read 7 Oct 2026 · github.com
Investigation records
Teams can track timelines, assets, indicators, evidence, malware, tasks, notes, and comments, with CSV import and export for structured records.Read 7 Oct 2026 · github.com
License and releases
The repository identifies the project as MIT-licensed and its releases page states that there are no releases.Read 7 Oct 2026 · github.com
MCP access
An authenticated, read-only MCP endpoint exposes case data to MCP clients using an API key created in the UI.Read 7 Oct 2026 · github.com
Reporting
It generates reports from user-provided Word, Excel/Calc, Writer, and Impress templates in DOCX, ODS, ODT, and ODP formats.Read 7 Oct 2026 · github.com
Reports
It generates reports from user-supplied Word, Excel/Calc, Writer, and Impress templates in .docx, .ods, .odt, and .odp formats.Read 7 Oct 2026 · github.com
Security controls
The configuration reference says secure cookies and the Strict-Transport-Security header are enabled by default, and describes a compressed and decompressed archive size limit of 10 GiB each.Read 7 Oct 2026 · github.com
Security guidance
The README warns against exposing Dagobert directly to the internet and recommends deploying it behind an HTTPS reverse proxy with access restricted to the team.Read 7 Oct 2026 · github.com

Strong points and limits

Strong points

  • Separate investigations with per-case role access
  • MITRE ATT&CK heatmap and unified timeline
  • Reports from common office templates
  • Evidence-processing tool integrations
  • Authenticated read-only MCP endpoint

Limits

  • No commercial offering, pricing or support tier
  • No published releases
  • README advises against direct internet exposure
  • Self-hosted deployment requires team security controls

Who it suits

It is aimed primarily at DFIR consultants handling outside-client cases and secondarily at internal CIRT or SOC teams. It suits organizations comfortable deploying and securing a self-hosted, open-source system.

Verdict

Dagobert provides a broad case workspace and integrations without a commercial fee. Deployment, security configuration and support remain the team's responsibility, and the repository lists no releases.

Where Specifiction places it

Alternatives to DagobertAll alternatives →