Dagobert

What Dagobert is

Dagobert is an open-source workspace for incident response teams conducting forensic investigations. Teams can separate cases into workspaces with role-based access managed in the interface, then review multiple investigations through a dashboard featuring a MITRE ATT&CK heatmap, unified timeline, evidence and indicator tracking, and lateral movement graph. Records can cover timelines, assets, indicators, evidence, malware, tasks, notes, and comments, with CSV import and export for structured records. Teams can create reports from their own Word, Excel or Calc, Writer, and Impress templates, producing DOCX, ODS, ODT, and ODP files. Background evidence jobs can use Hayabusa, Zircolite, Chainsaw, Plaso, and Dissect. Indicator enrichment can query VirusTotal, AbuseIPDB, and Hybrid Analysis, and timelines can be exchanged with Timesketch. Hooks can start automations when records are created or updated. Sign-in is available through local accounts or an OIDC provider. The project is a Go binary backed by SQLite, with Docker instructions for self-hosting, and is MIT-licensed. Its README advises against direct internet exposure and recommends access limited to the team behind an HTTPS reverse proxy. No releases are listed.