- Home
- Incident Response Software
- Dagobert
Dagobert
What it is
Dagobert is a free, MIT-licensed workspace for digital forensics and incident response teams. It keeps separate investigations with role-based, per-case access and records for timelines, assets, indicators, evidence, malware, tasks, notes, and comments. A cross-case dashboard includes a MITRE ATT&CK heatmap, unified timeline, evidence and indicator tracking, and a lateral movement graph. Teams can import and export structured records as CSV. Reports are generated from supplied Word, Excel or Calc, Writer, and Impress templates in DOCX, ODS, ODT, and ODP formats. Background jobs can process evidence with Hayabusa, Zircolite, Chainsaw, Plaso, and Dissect. Enrichment queries can use VirusTotal, AbuseIPDB, and Hybrid Analysis, while timelines exchange with Timesketch. Hooks trigger automations on record changes, and an authenticated read-only MCP endpoint exposes case data. Sign-in supports local accounts or OIDC. Deployment uses a Go binary with SQLite or Docker for self-hosting. The README recommends an HTTPS reverse proxy and restricted team access rather than direct internet exposure.
For and against
For
- Separate cases with role-based access
- Cross-case ATT&CK heatmap and timeline
- Template-based report generation
- Evidence-processing integrations
- Read-only MCP API access
Against
- No commercial offering or support tier
- Self-hosting deployment required
- README warns against direct internet exposure
- No on-call scheduling
The verdict
Dagobert combines case management, forensic evidence workflows, reporting, integrations, and automation in a self-hosted package. Its MIT license and collaboration features suit DFIR teams, while deployment and security configuration remain team responsibilities.
Who it suits
It is primarily for DFIR consultants handling outside-client cases and secondarily for internal CIRT or SOC teams. Self-hosting teams needing shared investigation records and reporting may find its deployment model suitable.
On the record
- Authentication
- Users can sign in with built-in local accounts or an OIDC provider; OIDC auto-provisioning is optional.github.com · read 7 Oct 2026
- Automation
- Hooks can trigger automations when records are created or updated, with conditions written as expr expressions.github.com · read 7 Oct 2026
- Automation and API
- Hooks can trigger automations on record creation or updates, and an authenticated HTTP MCP endpoint exposes case data read-only to MCP clients.github.com · read 7 Oct 2026
- Case management
- It supports multiple investigations in separate workspaces with role-based, per-case access control managed in the UI.github.com · read 7 Oct 2026
- Commercial status
- The product document says there is no commercial offering, pricing, or support tier.github.com · read 7 Oct 2026
- Deployment
- The project describes itself as a single Go binary backed by SQLite and provides Docker-based installation instructions for self-hosting.github.com · read 7 Oct 2026
- Evidence processing
- Background evidence-processing jobs can use Hayabusa, Zircolite, Chainsaw, Plaso, and Dissect.github.com · read 7 Oct 2026
- Integrations
- Indicator enrichment can query VirusTotal, AbuseIPDB, and Hybrid Analysis, and Dagobert can exchange timelines with Timesketch.github.com · read 7 Oct 2026
- Intended users
- The product document identifies DFIR consultants working cases for outside clients as its primary audience and internal CIRT/SOC teams as a secondary audience.github.com · read 7 Oct 2026
- Investigation features
- Features include a cross-case dashboard with a MITRE ATT&CK heatmap, a unified timeline, evidence and indicator tracking, and a lateral movement graph.github.com · read 7 Oct 2026
- Investigation records
- Teams can track timelines, assets, indicators, evidence, malware, tasks, notes, and comments, with CSV import and export for structured records.github.com · read 7 Oct 2026
- License
- The repository states that Dagobert is released under the MIT License.github.com · read 7 Oct 2026
- License and releases
- The repository identifies the project as MIT-licensed and its releases page states that there are no releases.github.com · read 7 Oct 2026
- Maker
- The repository owner’s GitHub profile identifies the maker as Thomas Kastner.github.com · read 7 Oct 2026
- MCP access
- An authenticated, read-only MCP endpoint exposes case data to MCP clients using an API key created in the UI.github.com · read 7 Oct 2026
- Purpose
- Dagobert provides incident response teams a shared workspace for forensic investigations, including findings, timelines, tasks, notes, and report generation.github.com · read 7 Oct 2026
- Reporting
- It generates reports from user-provided Word, Excel/Calc, Writer, and Impress templates in DOCX, ODS, ODT, and ODP formats.github.com · read 7 Oct 2026
- Reports
- It generates reports from user-supplied Word, Excel/Calc, Writer, and Impress templates in .docx, .ods, .odt, and .odp formats.github.com · read 7 Oct 2026
