Skip to content
Request a demo
Request a demo
Theme

For security operations and incident response

Every SOC needs case management. Run yours on servers you control.

Triage the alert, build the case, and approve the response in one place. Your team installs it, upgrades it, and owns every record.

Request a demoInstall Community
  1. Alert
  2. Case
  3. Tasks
  4. Approval
  5. Contained
  • Docker Compose on your hosts
  • Offline license activation
  • SAML 2.0 and FIDO2 keys
  • Hash-chained audit trail
  • Models you configure

One workspace

The alert, the case, the tasks, and the record of what happened

Analysts stop copying the same facts between a case tool, a ticket, and an automation canvas.

  1. Investigate

    Triage an alert with its observables, enrichment, MITRE ATT&CK technique, and similar alerts beside it, then open a case from it.

    Cases and alerts

  2. Coordinate

    Split the case into tasks with owners and due dates. Evidence, the timeline, and the documentation stay on the case for the review afterward.

    Tasks and the incident record

  3. Respond

    Run a workflow that waits for an approver before it acts on a host. Every step is visible before anything runs.

    Workflows

Workflows

Automation an analyst can read

Start from a template already in the product, such as routing a critical alert, escalating an SLA, or writing the after-hours brief. Or build the path yourself. Folders keep the library navigable. Simulation and an approval step sit in front of outbound action.

Contain a host after a critical EDR alert

Step 6 of 6: Notify case owner. Run complete.

Simulated run of the built-in template. No connector was called.

Deployment

Installed and run by your team

The supported production install is Docker Compose from a versioned release bundle, on hosts you operate. Only the web proxy is published. You bring the object storage, the TLS certificate, and the backups.

Air-gapped sites import the images through their own transfer process, and activation stays on your network. Connectors, enrichment services, cloud models, and real-time co-editing through Liveblocks still need a path to those services.

  • Community: every feature for one user, free, with no expiry
  • Pro and Enterprise: seat keys bound to your Installation ID
  • Cloud pages in the docs are reference architectures, not a hosted offer
How deployment works

Integrations

Ten certified connectors, and an API for the rest

Certified connectors run on governed credentials with versioned actions. Five enrichment providers and the REST API with webhooks cover the tools that are not on this list.

  • Splunk

    SIEM

  • CrowdStrike Falcon

    EDR

  • Microsoft Defender XDR

    EDR

  • Microsoft Sentinel

    SIEM

  • AWS GuardDuty

    Cloud

  • ServiceNow

    ITSM

  • Jira

    ITSM

  • Slack

    Communication

  • Palo Alto Networks

    Network security

  • MISP

    Threat intelligence

Other names in the in-app integration catalog are not certified connectors.

What each connector does

AI

A verdict that quotes the alert

Run AI Insights on an alert and the model returns a disposition, the fields it quoted, and what it was not shown. You agree, override, or mark the evidence insufficient, and the alert does not change until you act on it.

AI is optional, and CaseBender does not ship a model. Point it at one you run or contract, including Ollama and OpenAI-compatible private endpoints.

  • Promote, benign, or hand it back to an analyst
  • Every quote comes from a field the model was shown
  • Suggested techniques wait until you approve them
See every AI feature

Questions

Before you book a call

What is CaseBender?

Case management for security operations and incident response. Alerts, cases, tasks, evidence, and the incident record live in one workspace, with workflow automation beside the case.

Who is it for?

SOC, CERT, and CSIRT teams that triage alerts and run investigations, and the engineers who connect their detection and ticketing tools to that work.

Where does it run?

On hosts you operate. The supported production deployment is Docker Compose from a versioned release bundle. Air-gapped sites can install and activate it; connectors, enrichment, cloud models, and real-time co-editing still need a path to those services. The cloud pages in the docs are reference architectures, not a hosted offer.

Who operates it?

Your team does. You install the release, apply upgrades, back up the database and object storage, and decide which tools it may call. CaseBender issues license keys and answers your questions, and your team keeps full control of the installation.

How is automation controlled?

Workflows are made of steps you can open and read, and you can simulate one before it runs. An approval step holds a run until an analyst approves it. Outbound actions go through governed connectors.

Does CaseBender include an AI model?

No. AI is optional, and CaseBender does not ship a model. Point it at one you run or contract, including Ollama and OpenAI-compatible private endpoints. AI Insights, shown above, returns a verdict that quotes the alert, and nothing changes until an analyst acts on it.

How do I try it?

Install Community on a host you control. It has every feature for one user, it is free, and it does not expire. When you need more analysts, request a Pro or Enterprise key for your Installation ID. Or request a demo and we will walk through a case with you on a call.

See one case, or install it yourself

A demo is a live walkthrough of one investigation on a call, from the first alert to an approved response. To try the product, install Community on a host you control.

Request a demoInstall Community