KANVAS
The facts below are what the maker publishes about KANVAS, checked and dated. Our editors have not written about it yet.
Plans and prices
From KANVAS's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| KANVAS | Free | GPL-3.0 open-source project |
The facts
Each one read from KANVAS's own pages, with the date it was checked.
What it does
- Case collaboration
- Investigation files can reside on local machines or shared drives, with file locking to manage edits among multiple investigators.checked 5 Oct 2026
- Knowledge tools
- Built-in references include Windows Event IDs, Microsoft Entra ID AppIDs, LOLBAS, Azure and Entra portals, and DLL hijacking information.checked 5 Oct 2026
- License
- The project repository identifies its license as GPL-3.0.checked 5 Oct 2026
- Local operation
- The maker says KANVAS runs entirely on the user's machine without a web server, setup, or infrastructure.checked 5 Oct 2026
- Lookup integrations
- The maker says lookup features require users to configure API keys such as VirusTotal and Shodan.checked 5 Oct 2026
- Notable limits
- The incident timeline requires MITRE TTP mappings for each entry, and the maker notes that Flow Builder may have performance issues, especially on Windows.checked 5 Oct 2026
- Purpose
- KANVAS is a desktop incident response case management tool for tracking and documenting investigations using SOD or similar spreadsheets.checked 5 Oct 2026
- Reporting
- KANVAS generates a self-contained HTML report that can include timelines, lateral movement, Diamond Model, investigation summaries, and recommendations.checked 5 Oct 2026
- Security frameworks
- The tool includes MITRE ATT&CK and D3FEND mapping and V.E.R.I.S. incident reporting.checked 5 Oct 2026
- Spreadsheet requirement
- Users of their own spreadsheets must match the documented column names, and the maker recommends the slightly modified SOD template included with the package.checked 5 Oct 2026
- STIX export
- KANVAS exports indicators of compromise in STIX 2.1 JSON format for use with threat intelligence platforms such as OpenCTI or MISP.checked 5 Oct 2026
- Threat intelligence
- Lookup features cover IP reputation, domain and URL data, file hashes, CVEs, email breaches, and ransomware victim data.checked 5 Oct 2026
- Visualizations
- It can create incident timelines, lateral movement visualizations, and MITRE Flow Builder diagrams, with image or CSV export for timeline and lateral movement views.checked 5 Oct 2026
Money
- Free plan
- Yeschecked 22 Sep 2026
Alternatives to KANVAS
- 1
Tracker
Free planAndroidiOSWebmacOS8.3From $24 a month - 2
EQS Integrity Line
AndroidiOSWebAPI8.2From £85 a month - 3
DFIR-IRIS
Free planOpen sourceWebAPILinuxmacOS8.2Free plan - 4
Socianote
Free planAndroidiOSWeb8.2From $99 a month - 5
Primero
Free planAndroidiOSWebAPI8.1From $8,250 a year - 6
FAMCare
AndroidiOSWebAPI8.0From $795 a month