Dagobert

Paid APILinuxSelf-hostedWeb

What Dagobert is

Dagobert is an open-source workspace for incident response teams investigating digital forensics cases. Teams can keep separate investigations with role-based access managed per case, then review activity across cases in a dashboard with a MITRE ATT&CK heatmap, a unified timeline, evidence and indicator tracking, and a lateral movement graph. Case records cover timelines, assets, indicators, evidence, malware, tasks, notes, and comments; structured records can be imported or exported as CSV. Dagobert creates reports from templates supplied by the team, including templates made with Word, Excel or Calc, Writer, and Impress, and can produce DOCX, ODS, ODT, and ODP files. Background evidence-processing jobs can use Hayabusa, Zircolite, Chainsaw, Plaso, and Dissect. Indicator enrichment can query VirusTotal, AbuseIPDB, and Hybrid Analysis, and timelines can be exchanged with Timesketch. Record changes can trigger automations through hooks, while an authenticated, read-only MCP endpoint lets MCP clients access case data. Sign-in works with local accounts or an OIDC provider. The project is a Go binary backed by SQLite, with Docker instructions for self-hosting. Dagobert is MIT-licensed and free; its README advises putting it behind an HTTPS reverse proxy with team-restricted access rather than exposing it directly to the internet.

Who it suits

Dagobert is aimed primarily at DFIR consultants handling cases for outside clients, with internal CIRT and SOC teams as another intended audience. It suits teams that want self-hosted case management, evidence tracking, collaborative investigation records, and template-based reporting.

What it does well

Separate cases support role-based access control.
Cross-case dashboard includes a MITRE ATT&CK heatmap.
Tracks evidence, indicators, timelines, assets, malware, and tasks.
Generates reports from user-provided office document templates.
Can enrich indicators and exchange timelines with other tools.
MIT-licensed and available for self-hosting.

What to know first

The project describes no commercial offering, pricing, or support tier.
Self-hosting is the deployment option described.
The README warns against direct internet exposure.
The repository's releases page states that there are no releases.

Limits

Dagobert has no commercial offering, pricing, or support tier. Its configuration reference describes a 10 GiB limit for both compressed and decompressed archives.

Getting started

Open the Dagobert project repository on GitHub.
Follow its Docker-based installation instructions to self-host the application.
Set up sign-in with local accounts or an OIDC provider; optional OIDC auto-provisioning is available.
Place the deployment behind an HTTPS reverse proxy and restrict access to the team.
Create separate investigation workspaces and assign per-case roles.

Verdict

Choose Dagobert if your response team needs a free, self-hosted workspace for managing investigations, evidence, and reports across cases. Teams looking for a commercial offering or support tier should look elsewhere; deployment also calls for restricted team access behind an HTTPS reverse proxy.

Questions

What does Dagobert cost?

Dagobert is free and open source under the MIT License. The project describes no commercial offering, pricing, or support tier.

Who makes Dagobert?

The repository owner’s GitHub profile identifies Thomas Kastner as the maker.

Can Dagobert be self-hosted?

Yes. The project describes a Go binary backed by SQLite and provides Docker-based installation instructions.

How can users sign in?

Users can use built-in local accounts or an OIDC provider. Optional OIDC auto-provisioning is available.

What reporting formats does it support?

Dagobert generates DOCX, ODS, ODT, and ODP reports from user-provided templates made with Word, Excel or Calc, Writer, or Impress.

Can teams expose case data to MCP clients?

Yes. An authenticated, read-only MCP endpoint exposes case data to MCP clients using an API key created in the UI.

Facts from Dagobert's own pages

Authentication: Users can sign in with built-in local accounts or an OIDC provider; OIDC auto-provisioning is optional. · github.com, 7 Oct 2026
Automation: Hooks can trigger automations when records are created or updated, with conditions written as expr expressions. · github.com, 7 Oct 2026
Automation and API: Hooks can trigger automations on record creation or updates, and an authenticated HTTP MCP endpoint exposes case data read-only to MCP clients. · github.com, 7 Oct 2026
Case management: It supports multiple investigations in separate workspaces with role-based, per-case access control managed in the UI. · github.com, 7 Oct 2026
Commercial status: The product document says there is no commercial offering, pricing, or support tier. · github.com, 7 Oct 2026
Deployment: The project describes itself as a single Go binary backed by SQLite and provides Docker-based installation instructions for self-hosting. · github.com, 7 Oct 2026
Evidence processing: Background evidence-processing jobs can use Hayabusa, Zircolite, Chainsaw, Plaso, and Dissect. · github.com, 7 Oct 2026
Integrations: Indicator enrichment can query VirusTotal, AbuseIPDB, and Hybrid Analysis, and Dagobert can exchange timelines with Timesketch. · github.com, 7 Oct 2026
Intended users: The product document identifies DFIR consultants working cases for outside clients as its primary audience and internal CIRT/SOC teams as a secondary audience. · github.com, 7 Oct 2026
Investigation features: Features include a cross-case dashboard with a MITRE ATT&CK heatmap, a unified timeline, evidence and indicator tracking, and a lateral movement graph. · github.com, 7 Oct 2026
Investigation records: Teams can track timelines, assets, indicators, evidence, malware, tasks, notes, and comments, with CSV import and export for structured records. · github.com, 7 Oct 2026
License: The repository states that Dagobert is released under the MIT License. · github.com, 7 Oct 2026
License and releases: The repository identifies the project as MIT-licensed and its releases page states that there are no releases. · github.com, 7 Oct 2026
Maker: The repository owner’s GitHub profile identifies the maker as Thomas Kastner. · github.com, 7 Oct 2026
MCP access: An authenticated, read-only MCP endpoint exposes case data to MCP clients using an API key created in the UI. · github.com, 7 Oct 2026
Purpose: Dagobert provides incident response teams a shared workspace for forensic investigations, including findings, timelines, tasks, notes, and report generation. · github.com, 7 Oct 2026
Reporting: It generates reports from user-provided Word, Excel/Calc, Writer, and Impress templates in DOCX, ODS, ODT, and ODP formats. · github.com, 7 Oct 2026
Reports: It generates reports from user-supplied Word, Excel/Calc, Writer, and Impress templates in .docx, .ods, .odt, and .odp formats. · github.com, 7 Oct 2026
Security controls: The configuration reference says secure cookies and the Strict-Transport-Security header are enabled by default, and describes a compressed and decompressed archive size limit of 10 GiB each. · github.com, 7 Oct 2026
Security guidance: The README warns against exposing Dagobert directly to the internet and recommends deploying it behind an HTTPS reverse proxy with access restricted to the team. · github.com, 7 Oct 2026
Support: The README directs users to open a GitHub issue for questions and bug reports. · github.com, 7 Oct 2026

Where Dagobert stands on Freedom251

Incident Response Software#17 of 21