DFIRe From €825/mo · Free plan 9.1 Visit SandsBytes
sandsbytes.com
What it is
SandsBytes is a cybersecurity investigation and incident response case-management platform for triage, threat hunting, evidence, indicators of compromise, and reporting. Its three products divide that work: Sands Investigate converts forensic artifacts into searchable, ECS-normalized records, enriches them with threat intelligence and external lookups, and flags indicator matches and suspicious patterns. Sands Manage supports collaborative cases with evidence, timelines, findings, task assignment, indicator tracking, and automated reports. Reports can be produced as PDF or DOCX files from configured templates. Sands Flow offers visual playbooks for enrichment pipelines, alert routing, and service-level escalation. Workflows can connect with external HTTP APIs, databases, queues, and file storage. The Hunt interface supports dashboard and table analysis, pivot filtering, CSV export, and bulk tagging. Deployment is self-hosted on 64-bit Ubuntu 20.04.6 LTS or later, accessed with Chrome, Firefox, or Edge; minimum resources are 6 CPU cores, 16 GB RAM, and 100 GB free storage. A license key expires after its specified validity period, and access is rejected until renewal. Pricing is on request.
Spec sheet
- Purpose
- SandsBytes is a cybersecurity investigation and incident response platform for triaging incidents, hunting threats, documenting findings, managing evidence and IOCs, and generating structured reports.Read 2 Oct 2026 · sandsbytes.com
- Intended users
- SandsBytes identifies incident response teams, SOC analysts, digital forensics specialists, MSSPs, and security consultancies as its intended users.Read 2 Oct 2026 · sandsbytes.com
- Deployment
- The platform is deployed as a containerized stack on Ubuntu Linux 20.04.6 LTS or later, with Docker Engine and Docker Compose.Read 2 Oct 2026 · sandsbytes.com
- Integrations
- Workflows can connect to external systems such as HTTP APIs, databases, queues, and file storage.Read 2 Oct 2026 · sandsbytes.com
- Support
- The maker directs customers to [email protected] for deployment sizing questions and unresolved support issues.Read 2 Oct 2026 · sandsbytes.com
- Headquarters
- Riyadh, Saudi ArabiaRead 28 Sep 2026 · sandsbytes.com
- API integration
- A SandsBytes workflow component calls registered product HTTP API endpoints using the workflow's security context.Read 2 Oct 2026 · sandsbytes.com
- Artifact analysis
- Sands Investigate parses and normalizes forensic artifacts, enriches them with external threat intelligence, and detects IOC matches and suspicious patterns.Read 2 Oct 2026 · sandsbytes.com
- Case management
- Sands Manage supports team collaboration, case correlation, task assignment, evidence tracking, timelines, IOC tracking, and automated reports.Read 2 Oct 2026 · sandsbytes.com
- Data processing
- Customers remain data controllers for incident data, while SandsBytes acts as a processor under the customer's instructions and Data Processing Agreement.Read 1 Oct 2026 · sandsbytes.com
- Deployment requirements
- The documented minimum deployment requires 6 CPU cores, 16 GB RAM, and 100 GB of free storage.Read 2 Oct 2026 · sandsbytes.com
- Forensic parsing
- Sands Investigate transforms disparate triage artifacts into ECS-normalized, searchable records.Read 1 Oct 2026 · sandsbytes.com
- Hunting
- The Hunt interface offers dashboard and table views, record pivots, CSV export, and bulk tagging of records.Read 2 Oct 2026 · sandsbytes.com
- License limitation
- A license key has a specified validity period and the application rejects access after expiration until the key is renewed.Read 1 Oct 2026 · sandsbytes.com
- Minimum resources
- The documented minimum deployment resources are 6 CPU cores, 16 GB RAM and 100 GB free storage.Read 1 Oct 2026 · sandsbytes.com
- Product purpose
- SandsBytes is a cybersecurity investigation and incident response case management platform for triage, threat hunting, evidence, IOCs and reports.Read 1 Oct 2026 · sandsbytes.com
- Products
- The platform includes Sands Investigate for digital forensics and threat hunting, Sands Manage for incident case management, and Sands Flow for security workflow automation.Read 2 Oct 2026 · sandsbytes.com
- Report formats
- Case reports can be generated as PDF or DOCX files using configured templates.Read 2 Oct 2026 · sandsbytes.com
- Security and privacy
- SandsBytes says customers remain the data controller for incident data and that SandsBytes processes it as a data processor under customer instructions and a Data Processing Agreement.Read 2 Oct 2026 · sandsbytes.com
- Security controls
- Deployment instructions call for setting unique secrets for authentication, internal service communication, database access, and SMTP credential encryption.Read 2 Oct 2026 · sandsbytes.com
- Security statement
- SandsBytes says it implements technical and organizational measures against unauthorized access, alteration, disclosure or destruction.Read 1 Oct 2026 · sandsbytes.com
- Support scope
- Support covers the latest release and releases launched within the previous 12 months, excluding customer or third-party content such as parsers, enrichers, feeds and evidence.Read 1 Oct 2026 · sandsbytes.com
- Supported environment
- The documented operating system requirement is Linux Ubuntu 20.04.6 LTS or later on 64-bit hardware, accessed through Chrome, Firefox or Edge.Read 1 Oct 2026 · sandsbytes.com
- Target users
- SandsBytes is designed for incident response teams, SOC analysts, digital forensics specialists, MSSPs and security consultancies.Read 1 Oct 2026 · sandsbytes.com
- Threat intelligence
- Sands Investigate enriches artifacts with threat intelligence and external lookups and detects IoC hits and suspicious patterns.Read 1 Oct 2026 · sandsbytes.com
- Workflow automation
- Sands Flow uses visual playbooks to run enrichment pipelines, route alerts, and escalate cases when service-level agreements are breached.Read 2 Oct 2026 · sandsbytes.com
Strong points and limits
Strong points
- Normalizes forensic artifacts into searchable records.
- Collaborative cases include evidence, timelines, and tasks.
- Reports can be generated as PDF or DOCX.
- Visual playbooks support routing and escalation.
- Workflows connect to APIs, databases, queues, and storage.
Limits
- Self-hosting requires at least 6 CPU cores.
- Minimum deployment needs 16 GB RAM and 100 GB storage.
- Deployment requires Ubuntu 20.04.6 LTS or later.
- Access stops when the license key expires.
Who it suits
SandsBytes is designed for incident response teams, SOC analysts, digital forensics specialists, MSSPs, and security consultancies. It suits organizations able to deploy and maintain the documented self-hosted Linux stack.
Verdict
SandsBytes brings artifact analysis, case management, and workflow automation into one self-hosted platform. Buyers should account for its specified Linux environment, minimum resources, and expiring license key.
Where Specifiction places it
- Incident Response Software#16 of 217.3
Alternatives to SandsBytesAll alternatives →
DFIRe From €825/mo · Free plan 9.1 Visit 
Binalyze AIR 8.8 Visit 
DFIR-IRIS Free plan 8.7 Visit 
Forendi From $199/mo 8.3 Visit 
LimaCharlie From $3/mo · Free plan 8.2 Visit