Welcome to SandsBytes
Incident response case management for evidence, findings, IoCs, hunt, reports, and automation.
SandsBytes is an incident response case management platform. It keeps evidence, findings, indicators of compromise (IoCs), reports, requirements, and remediations in one case workspace, and it adds hunt search, parser-driven processing, and workflow automation.
This documentation describes version 1.7.9, as shown in the application footer.
Get started
What is SandsBytes
Overview, capabilities, and terminology
Deployment
Requirements and deployment steps
Authentication
Sign in with a local account, LDAP, or SSO
Create a case
Open a new investigation
Process a triage package
Upload artifacts and run parsers
Start hunting
Search parsed records
Dashboard
SQL widgets for the analyst workspace
Settings
Health, identity, templates, store, and audit

