Get Started
What is SandsBytes
Overview of the incident response case management platform and key terms.
SandsBytes is an incident response case management platform for security analysts. It is built around a case: a workspace that holds people, evidence, tasks, findings, IoCs, remediations, and reports for one incident.
What you can do
- Centralize case work: members, evidence, requirements, tasks, findings, IoCs, timeline, remediations, and reports.
- Process triage packages with parsers, then enrich the resulting records.
- Hunt across parsed records with table and dashboard views.
- Automate with event-driven rules and visual workflows.
- Ingest threat-intelligence feeds and keep a knowledge base of documents.
- Administer users, roles, identity (local, LDAP, SSO), forms, templates, the content store, and the audit log.
Who it is for
| Role | Typical work in SandsBytes |
|---|---|
| Analyst | Create cases, process packages, hunt, write findings, generate reports. |
| Lead / manager | Assign members, track tasks and requirements, review remediations and reports. |
| Administrator | Users, roles, settings, parsers, enrichers, feeds, store, identity. |
| Automation author | Rules and workflows. |
Key capabilities
| Capability | What it covers |
|---|---|
| Case management | Lifecycle, members, evidence, tasks, findings, IoCs, timeline, remediations, reports. |
| Investigation hub | Upload and process packages, processed files, processing runs, lookup enrichments, file system. |
| Hunt | Search parsed records, save searches, tag records, add records to findings. |
| Parsers | Packages that turn files into hunt records. |
| Enrichers | Add context to records (including lookup enrichers). |
| Feeds | Threat-intelligence sources and ingested records. |
| Documents | Knowledge-base articles and guidelines. |
| Dashboard | SQL widgets over platform tables. |
| Rules | Event-driven email, webhook, and workflow actions. |
| Workflows | Visual multi-step automations, schedules, approvals, and runs. |
| Identity | Local accounts, LDAP, and SSO (OIDC, OAuth 2.0, SAML). |
| Store | Install and update content packages. |
| Audit | Platform activity trail. |
Terminology
| Term | Meaning |
|---|---|
| Case | One investigation workspace. |
| Triage package | An archive or remote share of artifacts processed together. |
| Parser | A package that extracts structured records from files. |
| Enricher | A package that adds context to records. |
| Finding | An analyst-confirmed observation on a case. |
| IoC | An indicator (file, network, or account) usually attached to a finding. |
| Hunt | Search over indexed records produced by processing. |
| Processing run | One execution of parsers (and selected enrichers) against packages. |
| Lookup enrichment | A run of a lookup enricher against records already in a case. |
| Feed | A threat-intelligence source and the records it produces. |
| Workflow | A graph of automated steps. |
| Rule | An event-driven automation with conditions and an action. |
| Form layout | The field set for an object type, including custom fields. |
| Template | A PDF or DOCX file used to generate a case report. |