[dagobert]

A collaborative platform for incident response

Dagobert gives incident response teams a shared workspace for forensic investigations: technical findings, timelines, tasks, and notes live in one place, and reports are generated from your own document templates instead of being written by hand at 2am.

It is inspired by IRIS and Aurora Incident Response, but takes a deliberately lighter approach: where IRIS runs as a multi-container Python stack with PostgreSQL, Dagobert is a single Go binary backed by SQLite — one container, no external database, and a backup is a file copy. Unlike Aurora's desktop, file-locking model, Dagobert is web-based, so the whole team can work on a case concurrently.

Lateral movement graph	Assets	Indicators

• Multi-case management — separate workspaces per investigation, with per-case access control (role-based, managed in the UI).
• Cross-case dashboard — an overview across all cases, including a MITRE ATT&CK heatmap of observed techniques.
• Timeline — a unified chronology of attacker activity and investigative actions, with MITRE ATT&CK technique mapping.
• Evidence, indicators & malware tracking — structured records for assets, IOCs, collected evidence, and malware samples, with CSV import/export.
• Lateral movement graph — visualize the relationships between compromised hosts, accounts, and indicators as the attack unfolds.
• Tasks — assign work to team members with owners and due dates.
• Notes & comments — document findings as you go, visible to the whole team.
• Report generation — render Word, Excel/Calc, Writer, and Impress templates (.docx, .ods, .odt, .odp) from case data; bring your own corporate template.
• Evidence processing — run Hayabusa (EVTX triage), Zircolite (EVTX Sigma detection), Chainsaw (EVTX Sigma and native-rule hunting), Plaso (super-timelines), and Dissect (disk & VM image triage) against uploaded evidence as background jobs.
• Indicator enrichment — look up hashes, IPs, and domains against VirusTotal, AbuseIPDB, and Hybrid Analysis directly from an indicator.
• Timesketch integration — upload timelines to Timesketch or import events back for analysis.
• Hooks — trigger automations when records are created or updated, with conditions written as expr expressions.
• MCP server — expose case data (cases, timeline, assets, indicators, malware, evidences, notes, tasks) read-only to MCP clients over an authenticated HTTP endpoint.
• Authentication — local users or any OIDC provider (tested with Azure AD), with optional auto-provisioning.

• Docker

1. Configure the environment:

   curl -o dagobert.env https://raw.githubusercontent.com/sprungknoedl/dagobert/main/dagobert.env.example
   $EDITOR dagobert.env

2. Start the container:

   docker run -d --name dagobert --restart unless-stopped \
     --env-file dagobert.env -v data:/home/dagobert/data -p 8080:8080 \
     sprungknoedl/dagobert

   On first run the (empty) data volume is bootstrapped automatically: the database is created and migrated, and the MITRE ATT&CK data is already bundled in the image. No separate migration step is needed.

3. Create the first user:

   docker exec -it dagobert dagobert create-user <USERNAME>

   You will be prompted for a password. This can be run at any time, including against a running server.

Dagobert is now available at http://localhost:8080.

The published sprungknoedl/dagobert image bundles Plaso, Hayabusa, Dissect, Zircolite, and Chainsaw, so evidence processing works out of the box. Jobs run in-process, with the tool commands configured via the MODULE_* environment variables — the image presets these to the bundled tools, so leave them unset in dagobert.env unless you want to override them. The Timesketch importer is built into the app itself and configured solely via the TIMESKETCH_* variables.

All runtime configuration is done through environment variables — see dagobert.env.example for an annotated starting point and the Configuration reference for the complete list. For how evidence is processed and how to supply the Hayabusa and Plaso tools, see Evidence Processing.

Dagobert serves a read-only MCP endpoint at /mcp. Create an API key of type MCP in the UI, then point an MCP client at it. For Claude Code:

claude mcp add --transport http dagobert https://<dagobert>/mcp --header "X-API-Key: <API KEY>"

You need Go 1.26+. TailwindCSS is built with the standalone CLI — make build-web downloads the pinned binary and daisyUI plugin files automatically, no Node.js required.

make build   # build CSS + templ templates + Go binary
make run     # dev server with hot reload (air)
make check   # templ generate + build + vet + test + gofmt — run before committing

To run the binary directly against a fresh checkout:

make                          # build the binary
./dagobert update             # create + migrate the database, download MITRE data
./dagobert create-user <NAME> # create the first (Administrator) user
./dagobert server             # start the web server on :8080

dagobert update is the canonical "bring this instance current" command: it creates the database if missing, applies pending migrations, and downloads or refreshes the MITRE ATT&CK data. It is idempotent — re-run it after pulling a new build to apply any new migrations and data.

HTML templates are templ files in internal/views/; run go tool templ generate (included in make build-go and make check) after editing them. Database migrations are plain SQL files in internal/model/migrations/, applied with dagobert update.

Contributions of any kind — code, documentation, design, bug reports — are welcome. See CONTRIBUTING.md for how to get started.

Dagobert is released under the MIT License.