No. 60 of 177 ·Case Management Software

KANVAS

Windows · Mac · Linux

Freedom report

Three barsScore 6.2

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

KANVAS is ranked #60 of 177 in case management software on Freedom251. It runs on Linux, macOS, Windows. There is a free plan.

KANVAS plans and pricing

All plans

KANVAS Free GPL-3.0 open-source project github.com · 5 Oct 2026

Compared on case management software

Free plan: Yes

Best KANVAS alternatives

See all 20

Two bars DFIR-IRIS Free tier No. 1Free7.4 Two bars Socianote Free tier No. 2$99/mo7.3 Two bars Primero Free tier No. 3$687.50/mo7.1 One bar Pega Investigative Case Management Paid plans No. 4—7.0 One bar IntegrityLog Paid plans No. 5—7.0 One bar Marble Case Manager Free tier No. 6Free7.0

The record

Purpose: KANVAS is a desktop incident response case management tool for tracking and documenting investigations using SOD or similar spreadsheets.
Local operation: The maker says KANVAS runs entirely on the user's machine without a web server, setup, or infrastructure.
Case collaboration: Investigation files can reside on local machines or shared drives, with file locking to manage edits among multiple investigators.
Reporting: KANVAS generates a self-contained HTML report that can include timelines, lateral movement, Diamond Model, investigation summaries, and recommendations.
Visualizations: It can create incident timelines, lateral movement visualizations, and MITRE Flow Builder diagrams, with image or CSV export for timeline and lateral movement views.
Threat intelligence: Lookup features cover IP reputation, domain and URL data, file hashes, CVEs, email breaches, and ransomware victim data.
Lookup integrations: The maker says lookup features require users to configure API keys such as VirusTotal and Shodan.
Security frameworks: The tool includes MITRE ATT&CK and D3FEND mapping and V.E.R.I.S. incident reporting.
Knowledge tools: Built-in references include Windows Event IDs, Microsoft Entra ID AppIDs, LOLBAS, Azure and Entra portals, and DLL hijacking information.
STIX export: KANVAS exports indicators of compromise in STIX 2.1 JSON format for use with threat intelligence platforms such as OpenCTI or MISP.
Spreadsheet requirement: Users of their own spreadsheets must match the documented column names, and the maker recommends the slightly modified SOD template included with the package.
Notable limits: The incident timeline requires MITRE TTP mappings for each entry, and the maker notes that Flow Builder may have performance issues, especially on Windows.
License: The project repository identifies its license as GPL-3.0.
Price from: Free

Where it ranks on Freedom251

Best Case Management Software in 2026#60 of 177

Is KANVAS yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote KANVAS

Sources

github.com/WithSecureOpenSource/Kanvas· checked 5 Oct 2026
kanvas-ir.org· checked 5 Oct 2026