SandsBytes

Paid APILinuxSelf-hostedWeb

What SandsBytes is

SandsBytes is a cybersecurity investigation and incident response platform for triaging incidents, hunting threats, managing evidence and indicators of compromise, and preparing reports. Its products are Sands Investigate, Sands Manage, and Sands Flow. Investigate parses forensic artifacts into searchable, normalized records, adds threat intelligence and external lookups, and detects indicator matches and suspicious patterns. Manage supports collaborative cases with evidence, timelines, findings, task assignment, indicator tracking, and automated reports; configured templates can produce PDF or DOCX files. Flow provides visual playbook orchestration for enrichment pipelines, alert routing, and service-level escalation. Workflows can connect to external APIs, databases, queues, and file storage. The Hunt interface supports dashboard and table analysis, filtering, CSV export, and bulk tagging. Deployment is self-hosted on 64-bit Linux Ubuntu 20.04.6 LTS or later, accessed through Chrome, Firefox, or Edge. Minimum documented resources are 6 CPU cores, 16 GB RAM, and 100 GB free storage. Pricing is on request; a license key is required, and access is rejected after expiry until renewal.

Who it suits

SandsBytes is aimed at incident response teams, SOC analysts, digital forensics specialists, MSSPs, and security consultancies. It suits organizations prepared to operate a self-hosted deployment in the documented Linux environment.

What it does well

Normalizes forensic artifacts into searchable records.
Cases track evidence, timelines, tasks, and indicators.
Reports can be generated as PDF or DOCX.
Workflow orchestration supports alert routing and escalation.
Supports CSV export and bulk tagging.

What to know first

Self-hosted deployment is required.
Requires at least 6 CPU cores and 16 GB RAM.
A license key must be renewed after expiration.
Pricing is provided on request.

Limits

The documented minimum deployment requires 6 CPU cores, 16 GB RAM, and 100 GB free storage. A license key has a validity period; the application rejects access after expiration until the key is renewed.

Getting started

Contact SandsBytes for pricing and deployment sizing at [email protected].
Prepare 64-bit Linux Ubuntu 20.04.6 LTS or later with at least 6 CPU cores, 16 GB RAM, and 100 GB free storage.
Deploy the containerized stack and set unique secrets for authentication, internal services, database access, and SMTP credential encryption.
Access the platform using Chrome, Firefox, or Edge.
Obtain and maintain a valid license key to use the application.

Verdict

SandsBytes brings artifact analysis, collaborative case management, and workflow automation together for incident response. Its Linux deployment requirements and license renewal conditions are important considerations.

Questions

How much does SandsBytes cost?

Pricing is provided on request.

Where can SandsBytes be deployed?

The documented deployment is self-hosted on 64-bit Linux Ubuntu 20.04.6 LTS or later. The platform is accessed through Chrome, Firefox, or Edge.

What are the minimum deployment resources?

The documented minimum is 6 CPU cores, 16 GB RAM, and 100 GB free storage.

What does the platform include?

Its products are Sands Investigate, Sands Manage, and Sands Flow, covering artifact analysis, case management, and workflow orchestration.

Can SandsBytes connect to other systems?

Workflows can connect to external HTTP APIs, databases, queues, and file storage.

Who makes SandsBytes?

SandsBytes is based in Riyadh, Saudi Arabia.

Facts from SandsBytes's own pages

API integration: A SandsBytes workflow component calls registered product HTTP API endpoints using the workflow's security context. · sandsbytes.com, 2 Oct 2026
Artifact analysis: Sands Investigate parses and normalizes forensic artifacts, enriches them with external threat intelligence, and detects IOC matches and suspicious patterns. · sandsbytes.com, 2 Oct 2026
Case management: Sands Manage supports team collaboration, case correlation, task assignment, evidence tracking, timelines, IOC tracking, and automated reports. · sandsbytes.com, 2 Oct 2026
Data processing: Customers remain data controllers for incident data, while SandsBytes acts as a processor under the customer's instructions and Data Processing Agreement. · sandsbytes.com, 1 Oct 2026
Deployment: The platform is deployed as a containerized stack on Ubuntu Linux 20.04.6 LTS or later, with Docker Engine and Docker Compose. · sandsbytes.com, 2 Oct 2026
Deployment requirements: The documented minimum deployment requires 6 CPU cores, 16 GB RAM, and 100 GB of free storage. · sandsbytes.com, 2 Oct 2026
Forensic parsing: Sands Investigate transforms disparate triage artifacts into ECS-normalized, searchable records. · sandsbytes.com, 1 Oct 2026
Headquarters: Riyadh, Saudi Arabia · sandsbytes.com, 28 Sept 2026
Hunting: The Hunt interface offers dashboard and table views, record pivots, CSV export, and bulk tagging of records. · sandsbytes.com, 2 Oct 2026
Integrations: Workflows can connect to external systems such as HTTP APIs, databases, queues, and file storage. · sandsbytes.com, 2 Oct 2026
Intended users: SandsBytes identifies incident response teams, SOC analysts, digital forensics specialists, MSSPs, and security consultancies as its intended users. · sandsbytes.com, 2 Oct 2026
License limitation: A license key has a specified validity period and the application rejects access after expiration until the key is renewed. · sandsbytes.com, 1 Oct 2026
Minimum resources: The documented minimum deployment resources are 6 CPU cores, 16 GB RAM and 100 GB free storage. · sandsbytes.com, 1 Oct 2026
Product purpose: SandsBytes is a cybersecurity investigation and incident response case management platform for triage, threat hunting, evidence, IOCs and reports. · sandsbytes.com, 1 Oct 2026
Products: The platform includes Sands Investigate for digital forensics and threat hunting, Sands Manage for incident case management, and Sands Flow for security workflow automation. · sandsbytes.com, 2 Oct 2026
Purpose: SandsBytes is a cybersecurity investigation and incident response platform for triaging incidents, hunting threats, documenting findings, managing evidence and IOCs, and generating structured reports. · sandsbytes.com, 2 Oct 2026
Report formats: Case reports can be generated as PDF or DOCX files using configured templates. · sandsbytes.com, 2 Oct 2026
Security and privacy: SandsBytes says customers remain the data controller for incident data and that SandsBytes processes it as a data processor under customer instructions and a Data Processing Agreement. · sandsbytes.com, 2 Oct 2026
Security controls: Deployment instructions call for setting unique secrets for authentication, internal service communication, database access, and SMTP credential encryption. · sandsbytes.com, 2 Oct 2026
Security statement: SandsBytes says it implements technical and organizational measures against unauthorized access, alteration, disclosure or destruction. · sandsbytes.com, 1 Oct 2026
Support: The maker directs customers to [email protected] for deployment sizing questions and unresolved support issues. · sandsbytes.com, 2 Oct 2026
Supported environment: The documented operating system requirement is Linux Ubuntu 20.04.6 LTS or later on 64-bit hardware, accessed through Chrome, Firefox or Edge. · sandsbytes.com, 1 Oct 2026
Support scope: Support covers the latest release and releases launched within the previous 12 months, excluding customer or third-party content such as parsers, enrichers, feeds and evidence. · sandsbytes.com, 1 Oct 2026
Target users: SandsBytes is designed for incident response teams, SOC analysts, digital forensics specialists, MSSPs and security consultancies. · sandsbytes.com, 1 Oct 2026

Where SandsBytes stands on Freedom251

Incident Response Software#19 of 21