No. 15 of 21 ·Incident Response Software

Dagobert

Web · Linux · Self-hosted · API

Visit site Alternatives

Freedom report

No signalScore 5.2

Free tierNo free tier on record
Open codeNo open-source code on record
Runs widely2 of 6 device platforms
DocumentedThinly documented

Dagobert is ranked #15 of 21 in incident response software on Freedom251. It runs on API, Linux, Self-hosted, Web.

Compared on incident response software

Case management: Yes
Evidence tracking: Yes
Responder collaboration: Yes
On-call scheduling: No
API access: Yes
Deployment options: self_hosted

Best Dagobert alternatives

See all 20

Two bars DFIR-IRIS Free tier No. 1Free6.6 Two bars Forensicator Free tier No. 2Free6.6 Two bars GRR Rapid Response Free tier No. 3Free6.6 Two bars LimaCharlie Free tier No. 4$3/mo6.6 One bar ORNA Free tier No. 5Free6.4 One bar TraceLock CRM Free tier No. 6Free6.2

The record

Purpose: Dagobert provides incident response teams a shared workspace for forensic investigations, including findings, timelines, tasks, notes, and report generation.
Investigation features: Features include a cross-case dashboard with a MITRE ATT&CK heatmap, a unified timeline, evidence and indicator tracking, and a lateral movement graph.
Reporting: It generates reports from user-provided Word, Excel/Calc, Writer, and Impress templates in DOCX, ODS, ODT, and ODP formats.
Evidence processing: Background evidence-processing jobs can use Hayabusa, Zircolite, Chainsaw, Plaso, and Dissect.
Integrations: Indicator enrichment can query VirusTotal, AbuseIPDB, and Hybrid Analysis, and Dagobert can exchange timelines with Timesketch.
Automation and API: Hooks can trigger automations on record creation or updates, and an authenticated HTTP MCP endpoint exposes case data read-only to MCP clients.
Authentication: Users can sign in with built-in local accounts or an OIDC provider; OIDC auto-provisioning is optional.
Deployment: The project describes itself as a single Go binary backed by SQLite and provides Docker-based installation instructions for self-hosting.
Security guidance: The README warns against exposing Dagobert directly to the internet and recommends deploying it behind an HTTPS reverse proxy with access restricted to the team.
Security controls: The configuration reference says secure cookies and the Strict-Transport-Security header are enabled by default, and describes a compressed and decompressed archive size limit of 10 GiB each.
Support: The README directs users to open a GitHub issue for questions and bug reports.
License and releases: The repository identifies the project as MIT-licensed and its releases page states that there are no releases.
Maker: The repository owner’s GitHub profile identifies the maker as Thomas Kastner.
Investigation records: Teams can track timelines, assets, indicators, evidence, malware, tasks, notes, and comments, with CSV import and export for structured records.

Where it ranks on Freedom251

Best Incident Response Software in 2026#15 of 21

Is Dagobert yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Dagobert

Sources

github.com/sprungknoedl/dagobert· checked 7 Oct 2026
github.com/sprungknoedl/dagobert/blob/main/docs/Co· checked 7 Oct 2026
github.com/sprungknoedl/dagobert/releases· checked 7 Oct 2026
github.com/sprungknoedl· checked 7 Oct 2026
github.com/sprungknoedl/dagobert/blob/main/PRODUCT· checked 7 Oct 2026