- Home
- Incident Response Software
- SandsBytes
SandsBytes
Riyadh, Saudi Arabia
What it is
SandsBytes is a cybersecurity investigation and incident response case management platform for triage, threat hunting, evidence, indicators of compromise and reporting. Its three products cover analysis, casework and workflow automation. Sands Investigate converts varied forensic triage artifacts into searchable ECS-normalized records, enriches them with threat intelligence and external lookups, and identifies indicator matches and suspicious patterns. Sands Manage supports collaborative cases with evidence, timelines, findings, task assignments and indicator tracking; configured templates can produce PDF or DOCX reports. Sands Flow uses visual playbooks for enrichment pipelines, alert routing and SLA escalation, with connections to external HTTP APIs, databases, queues and file storage. The Hunt interface supports dashboard and table analysis, pivot filtering, CSV export and bulk tagging. Deployment is self-hosted on 64-bit Linux Ubuntu 20.04.6 LTS or later, accessed through Chrome, Firefox or Edge. The documented minimum is 6 CPU cores, 16 GB RAM and 100 GB free storage. Pricing is on request, and access is rejected after a license key expires until it is renewed.
For and against
For
- Investigate normalizes forensic artifacts into searchable records.
- Manage supports evidence, timelines, tasks and case reports.
- Flow connects playbooks to APIs, databases, queues and storage.
- Hunt supports filtering, CSV export and bulk tagging.
- Self-hosted deployment is available.
Against
- Pricing is provided on request.
- Minimum deployment requires 6 CPU cores and 16 GB RAM.
- Expired license keys block application access until renewed.
- Documented deployment requires Linux Ubuntu 20.04.6 LTS or later.
The verdict
SandsBytes brings artifact analysis, collaborative case management and visual workflow automation into one incident response platform. Teams should account for its documented Linux deployment requirements and license renewal requirement; pricing is on request.
Who it suits
SandsBytes is aimed at incident response teams, SOC analysts, digital forensics specialists, MSSPs and security consultancies. It suits teams seeking self-hosted case management and forensic artifact analysis.
On the record
- API integration
- A SandsBytes workflow component calls registered product HTTP API endpoints using the workflow's security context.sandsbytes.com · read 2 Oct 2026
- Artifact analysis
- Sands Investigate parses and normalizes forensic artifacts, enriches them with external threat intelligence, and detects IOC matches and suspicious patterns.sandsbytes.com · read 2 Oct 2026
- Case management
- Sands Manage supports team collaboration, case correlation, task assignment, evidence tracking, timelines, IOC tracking, and automated reports.sandsbytes.com · read 2 Oct 2026
- Data processing
- Customers remain data controllers for incident data, while SandsBytes acts as a processor under the customer's instructions and Data Processing Agreement.sandsbytes.com · read 1 Oct 2026
- Deployment
- The platform is deployed as a containerized stack on Ubuntu Linux 20.04.6 LTS or later, with Docker Engine and Docker Compose.sandsbytes.com · read 2 Oct 2026
- Deployment requirements
- The documented minimum deployment requires 6 CPU cores, 16 GB RAM, and 100 GB of free storage.sandsbytes.com · read 2 Oct 2026
- Forensic parsing
- Sands Investigate transforms disparate triage artifacts into ECS-normalized, searchable records.sandsbytes.com · read 1 Oct 2026
- Hunting
- The Hunt interface offers dashboard and table views, record pivots, CSV export, and bulk tagging of records.sandsbytes.com · read 2 Oct 2026
- Integrations
- Workflows can connect to external systems such as HTTP APIs, databases, queues, and file storage.sandsbytes.com · read 2 Oct 2026
- Intended users
- SandsBytes identifies incident response teams, SOC analysts, digital forensics specialists, MSSPs, and security consultancies as its intended users.sandsbytes.com · read 2 Oct 2026
- License limitation
- A license key has a specified validity period and the application rejects access after expiration until the key is renewed.sandsbytes.com · read 1 Oct 2026
- Minimum resources
- The documented minimum deployment resources are 6 CPU cores, 16 GB RAM and 100 GB free storage.sandsbytes.com · read 1 Oct 2026
- Product purpose
- SandsBytes is a cybersecurity investigation and incident response case management platform for triage, threat hunting, evidence, IOCs and reports.sandsbytes.com · read 1 Oct 2026
- Products
- The platform includes Sands Investigate for digital forensics and threat hunting, Sands Manage for incident case management, and Sands Flow for security workflow automation.sandsbytes.com · read 2 Oct 2026
- Purpose
- SandsBytes is a cybersecurity investigation and incident response platform for triaging incidents, hunting threats, documenting findings, managing evidence and IOCs, and generating structured reports.sandsbytes.com · read 2 Oct 2026
- Report formats
- Case reports can be generated as PDF or DOCX files using configured templates.sandsbytes.com · read 2 Oct 2026
- Security and privacy
- SandsBytes says customers remain the data controller for incident data and that SandsBytes processes it as a data processor under customer instructions and a Data Processing Agreement.sandsbytes.com · read 2 Oct 2026
- Security controls
- Deployment instructions call for setting unique secrets for authentication, internal service communication, database access, and SMTP credential encryption.sandsbytes.com · read 2 Oct 2026
