SandsBytes

What SandsBytes is

SandsBytes is a cybersecurity investigation and incident response platform for examining incidents, hunting threats, tracking evidence and indicators of compromise, and preparing reports. Its products divide that work among Sands Investigate, Sands Manage, and Sands Flow. Investigate parses forensic artifacts into ECS-normalized searchable records, enriches them with threat intelligence and external lookups, and identifies indicator matches and suspicious patterns. Manage supports collaborative cases with evidence, timelines, findings, task assignments, and indicator tracking; configured templates can produce PDF or DOCX reports. Flow provides visual playbooks for enrichment, alert routing, and service-level escalation. Workflows can connect to external HTTP APIs, databases, queues, and file storage. The Hunt interface supports dashboard and table analysis, pivot filtering, CSV export, and bulk tagging. Deployment is self-hosted on 64-bit Linux Ubuntu 20.04.6 LTS or later, accessed through Chrome, Firefox, or Edge, and requires at least 6 CPU cores, 16 GB RAM, and 100 GB of free storage. Pricing is available on request. A license key has a validity period; after it expires, the application rejects access until renewal. SandsBytes says customers control incident data and it processes that data under customer instructions and a Data Processing Agreement.