KANVAS

Free plan LinuxMacWindows

What KANVAS is

KANVAS is a free, GPL-3.0 desktop incident-response case management tool for investigations based on SOD or similar spreadsheets. It runs entirely on the user’s machine without a web server, setup, or infrastructure, on Linux, macOS, and Windows. Files can stay locally or on shared drives, with file locking for multiple investigators. KANVAS produces self-contained HTML reports containing summaries, timelines, lateral movement, Diamond Model material, and recommendations. It creates incident timelines, lateral-movement views, and MITRE Flow Builder diagrams, with image or CSV export for timeline and lateral-movement views. Lookup functions cover IP reputation, domains and URLs, hashes, CVEs, email breaches, and ransomware victims; configured keys such as VirusTotal or Shodan are required. The tool includes MITRE ATT&CK and D3FEND mapping, V.E.R.I.S. reporting, reference material, and STIX 2.1 JSON export for indicators of compromise. Custom spreadsheets must use documented column names.

Who it suits

KANVAS suits incident responders and investigators who want local case files, structured visualizations, reports, and threat-intelligence lookups. Teams using their own spreadsheets must match the documented columns.

What it does well

Runs locally without server infrastructure
Supports shared-drive files and locking
Generates self-contained HTML reports
Exports indicators as STIX 2.1 JSON
Available on Linux, macOS, and Windows

What to know first

Lookup features require configured API keys
Own spreadsheets must match documented columns
Timelines require MITRE TTP mappings
Flow Builder may have Windows performance issues

Plans

Plan	Billed and limits	Price
KANVAS	GPL-3.0 open-source project	Free

As kanvas-ir.org lists them, read 5 Oct 2026. The maker's own page has the final word.

Verdict

KANVAS provides a free desktop workspace for documenting and visualizing incident investigations. Its spreadsheet requirements, API-key dependencies, and noted visualization limits should be considered before adoption.

Facts from KANVAS's own pages

Case collaboration: Investigation files can reside on local machines or shared drives, with file locking to manage edits among multiple investigators. · github.com, 5 Oct 2026
Free plan: Yes · kanvas-ir.org, 22 Sept 2026
Knowledge tools: Built-in references include Windows Event IDs, Microsoft Entra ID AppIDs, LOLBAS, Azure and Entra portals, and DLL hijacking information. · github.com, 5 Oct 2026
License: The project repository identifies its license as GPL-3.0. · github.com, 5 Oct 2026
Local operation: The maker says KANVAS runs entirely on the user's machine without a web server, setup, or infrastructure. · kanvas-ir.org, 5 Oct 2026
Lookup integrations: The maker says lookup features require users to configure API keys such as VirusTotal and Shodan. · github.com, 5 Oct 2026
Notable limits: The incident timeline requires MITRE TTP mappings for each entry, and the maker notes that Flow Builder may have performance issues, especially on Windows. · github.com, 5 Oct 2026
Purpose: KANVAS is a desktop incident response case management tool for tracking and documenting investigations using SOD or similar spreadsheets. · github.com, 5 Oct 2026
Reporting: KANVAS generates a self-contained HTML report that can include timelines, lateral movement, Diamond Model, investigation summaries, and recommendations. · github.com, 5 Oct 2026
Security frameworks: The tool includes MITRE ATT&CK and D3FEND mapping and V.E.R.I.S. incident reporting. · github.com, 5 Oct 2026
Spreadsheet requirement: Users of their own spreadsheets must match the documented column names, and the maker recommends the slightly modified SOD template included with the package. · github.com, 5 Oct 2026
STIX export: KANVAS exports indicators of compromise in STIX 2.1 JSON format for use with threat intelligence platforms such as OpenCTI or MISP. · kanvas-ir.org, 5 Oct 2026
Threat intelligence: Lookup features cover IP reputation, domain and URL data, file hashes, CVEs, email breaches, and ransomware victim data. · github.com, 5 Oct 2026
Visualizations: It can create incident timelines, lateral movement visualizations, and MITRE Flow Builder diagrams, with image or CSV export for timeline and lateral movement views. · github.com, 5 Oct 2026

Where KANVAS stands on Freedom251

Case Management Software#11 of 177