KANVAS
kanvas-ir.org
Spec sheet
- Purpose
- KANVAS is a desktop incident response case management tool for tracking and documenting investigations using SOD or similar spreadsheets.Read 5 Oct 2026 · github.com
- Free plan
- YesRead 22 Sep 2026 · kanvas-ir.org
- License
- The project repository identifies its license as GPL-3.0.Read 5 Oct 2026 · github.com
- Case collaboration
- Investigation files can reside on local machines or shared drives, with file locking to manage edits among multiple investigators.Read 5 Oct 2026 · github.com
- Knowledge tools
- Built-in references include Windows Event IDs, Microsoft Entra ID AppIDs, LOLBAS, Azure and Entra portals, and DLL hijacking information.Read 5 Oct 2026 · github.com
- Local operation
- The maker says KANVAS runs entirely on the user's machine without a web server, setup, or infrastructure.Read 5 Oct 2026 · kanvas-ir.org
- Lookup integrations
- The maker says lookup features require users to configure API keys such as VirusTotal and Shodan.Read 5 Oct 2026 · github.com
- Notable limits
- The incident timeline requires MITRE TTP mappings for each entry, and the maker notes that Flow Builder may have performance issues, especially on Windows.Read 5 Oct 2026 · github.com
- Reporting
- KANVAS generates a self-contained HTML report that can include timelines, lateral movement, Diamond Model, investigation summaries, and recommendations.Read 5 Oct 2026 · github.com
- Security frameworks
- The tool includes MITRE ATT&CK and D3FEND mapping and V.E.R.I.S. incident reporting.Read 5 Oct 2026 · github.com
- Spreadsheet requirement
- Users of their own spreadsheets must match the documented column names, and the maker recommends the slightly modified SOD template included with the package.Read 5 Oct 2026 · github.com
- STIX export
- KANVAS exports indicators of compromise in STIX 2.1 JSON format for use with threat intelligence platforms such as OpenCTI or MISP.Read 5 Oct 2026 · kanvas-ir.org
- Threat intelligence
- Lookup features cover IP reputation, domain and URL data, file hashes, CVEs, email breaches, and ransomware victim data.Read 5 Oct 2026 · github.com
- Visualizations
- It can create incident timelines, lateral movement visualizations, and MITRE Flow Builder diagrams, with image or CSV export for timeline and lateral movement views.Read 5 Oct 2026 · github.com
Plans and prices
KANVAS Free GPL-3.0 open-source project Read 5 Oct 2026 · github.com
Where Specifiction places it
- Case Management Software#112 of 1777.4
