Declare in 30 seconds
Type a name, pick a severity, name the commander. The incident is open and the activity log starts.
From the first phone call at 02:00 to the post-incident review three weeks later — every artefact in one place. The IR lead doesn't open seven tabs. The legal team gets a defensible record. The board gets a coherent timeline.
Type a name, pick a severity, name the commander. The incident is open and the activity log starts.
Pre-built playbook library covers ransomware, BEC, insider, OT. Or use your own — every playbook is versioned and owned by you.
Every procedure step is an assignable task with an owner, a due time and an outcome.
Regulatory notification deadlines (Privacy Act, NIS2, CPS 234, sector-specific) sit at the top of the workspace.
Invite DFIR, legal, insurers, customer comms — they see one incident and only one. Revoke at any time.
Activity log entries can be added but never edited or deleted. The audit trail is the database.
Each stage is supported by structured data — not free-text fields and Slack threads.
Name, type, severity, commander. Timestamp auto-captured.
Attach a playbook. The procedure checklist materialises.
Tasks assigned. Comms drafted. External parties invited.
Runbooks executed by the right team. Timeline records every action.
Verified removal. Indicators captured. Lessons in flight.
Service restoration with explicit acceptance criteria.
Auto-generated timeline. PIR template. Actions tracked to close.
We'll walk you through a real scenario — declaration, triage, comms, external access, the lot.