Catalyst is an incident response platform / SOAR (Security Orchestration, Automation and Response) system.

Related tags

Code Analysis soar
Overview

Screenshot of the playbook part of a ticket Catalyst

Speed up your reactions

Website - The Catalyst Handbook (Documentation) - Try online (user: bob, password: bob)

Catalyst is an incident response platform or SOAR (Security Orchestration, Automation and Response) system. It can help you to automate your alert handling and incident response procedures.

Features

Ticket (Alert & Incident) Management

Screenshot of a ticket

Tickets are the core of Catalyst. They represent alerts, incidents, forensics investigations, threat hunts or any other event you want to handle in your organisation.

Ticket Templates

Screenshot of the playbook part of a ticket

Templates define the custom information for tickets. The core information for tickets like title, creation date or closing status is kept quite minimal and other information like criticality, description or MITRE ATT&CK information can be added individually.

Conditional Custom Fields

Screenshot of the playbook part of a ticket

Screenshot of the playbook part of a ticket

Custom Fields can be dependent on each other. So if you, for example choose "malware" as an incident type a custom field ask you to define it further as ransomware, worm, etc. which a "phishing" incident would ask for the number of received mails in that campaign.

Playbooks

Screenshot of the playbook part of a ticket

Playbooks represent processes that can be attached to tickets. Playbooks can contain manual and automated tasks. Complex workflows with different workflow branches, parallel tasks and task dependencies can be modeled.

Automations

Screenshot of the playbook part of a ticket

Automations are scripts that automate tasks or enrich artifacts. Automations are run in their own Docker containers. This enables them to be created in different scripting languages and run securely in their own environment.

Users

Screenshot of the playbook part of a ticket

Catalyst has two different types of users, normal users accessing the platform via OIDC authentication and API keys for external script. A fine-grained access model is available for both types and allows to define possible actions for each user.

Comments
Releases(v0.10.1)

  • v0.10.1(Nov 5, 2022)

    What's Changed

    • Remove malware playbook in https://github.com/SecurityBrewery/catalyst/pull/540
    • Fix automated root task start in https://github.com/SecurityBrewery/catalyst/pull/541
    • Split correlated and related tickets in https://github.com/SecurityBrewery/catalyst/pull/542
    • Fix detail changes in https://github.com/SecurityBrewery/catalyst/pull/543
    • Improve restore in https://github.com/SecurityBrewery/catalyst/pull/544
    • Dependency updates

    Full Changelog: https://github.com/SecurityBrewery/catalyst/compare/v0.10.0...v0.10.1

    Source code(tar.gz)
    Source code(zip)

  • v0.10.0(Oct 22, 2022)

    • Frontend URLs: All frontend pages are now located at /ui/, so you might need to change your links e.g. from https://try.catalyst-soar.com/tickets to https://try.catalyst-soar.com/ui/tickets
    • Improved OIDC support: A whole new authentication system was developed and integrated to improve OIDC support and other authentication related issues.
    • ⚠️ New role and permission system:There are only three roles now (analyst, engineer and admin) with fixed permissions. Users are automatically migrated and might have different permissions now.
    • Testing: Testing was largely improved including new e2e tests using cypress.
    • Emitter is gone: The emitter project is quite stale and the docker containers used extensive computing resources which led to the decision remove it.
    Source code(tar.gz)
    Source code(zip)

  • v0.10.0-rc.5(Oct 22, 2022)

  • v0.10.0-rc.4(Oct 12, 2022)

  • v0.10.0-rc.3(Oct 2, 2022)

  • v0.10.0-rc.2(Oct 2, 2022)

  • v0.10.0-rc.1(Oct 2, 2022)

  • v0.9.2(Apr 25, 2022)

  • v0.9.1(Mar 19, 2022)

  • v0.9.0(Mar 13, 2022)

    • Add dashboards
    • Add global settings

    API Changes

    • GET /dashboards: New endpoint to list all dashboards
    • POST /dashboards: New endpoint to add a dashboard
    • GET /dashboards/{id}: New endpoint to get a dashboard
    • PUT /dashboards/{id}: New endpoint to update a dashboard
    • DELETE /dashboards/{id}: New endpoint to delete a dashboard
    • GET /dashboard/data: New endpoint to generate widget data
    • GET /settings: Updated endpoint to get the settings
    • POST /settings: New endpoint to save the settings
    Source code(tar.gz)
    Source code(zip)

  • v0.8.0(Mar 12, 2022)

    • Improved input validation
    • More tests
    • New file API

    API Changes

    • /tickets/{id}/files: Removed endpoint.
    • /files/{ticketID}/tusd: New endpoint for the tusd protocol.
    • /files/{ticketID}/upload: New upload endpoint.
    • /files/{ticketID}/download/{key}: New download endpoint.
    • /tickets/{id}/playbooks/{playbookID}/task/{taskID}: Changed endpoint, now sets data directly.
    • /tickets/{id}/playbooks/{playbookID}/task/{taskID}/owner: New endpoint to set the ticket owner.
    Source code(tar.gz)
    Source code(zip)

  • v0.7.2(Jan 20, 2022)

  • v0.7.1(Dec 18, 2021)

  • v0.7.0(Dec 13, 2021)

Owner
Security Brewery
We brew security software.
Security Brewery
GitHub https://catalyst-soar.com
GoKart - Go Security Static Analysis

GoKart is a static analysis tool for Go that finds vulnerabilities using the SSA (single static assignment) form of Go source code.

Praetorian 2.1k Jan 1, 2023
Coca is a toolbox which is design for legacy system refactoring and analysis, includes call graph, concept analysis, api tree, design patterns suggest. Coca 是一个用于系统重构、系统迁移和系统分析的瑞士军刀。它可以分析代码中的测试坏味道、模块化分析、行数统计、分析调用与依赖、Git 分析以及自动化重构等。

Coca - toolbox for system refactoring and analysis Coca is a toolbox which is design for legacy system refactoring and analysis, includes call graph,

硬核开源小分队 826 Dec 29, 2022
Find outdated dependencies of your Go projects. go-mod-outdated provides a table view of the go list -u -m -json all command which lists all dependencies of a Go project and their available minor and patch updates. It also provides a way to filter indirect dependencies and dependencies without updates.

go-mod-outdated An easy way to find outdated dependencies of your Go projects. go-mod-outdated provides a table view of the go list -u -m -json all co

psampaz 602 Dec 28, 2022
Sloc, Cloc and Code: scc is a very fast accurate code counter with complexity calculations and COCOMO estimates written in pure Go

Sloc Cloc and Code (scc) A tool similar to cloc, sloccount and tokei. For counting physical the lines of code, blank lines, comment lines, and physica

Ben Boyter 4.1k Jan 4, 2023
Jenkins tracer is used to record all the Jenkins job environment variables and metrics, and send them to Elasticsearch

Jenkins Tracer Jenkins tracer is used to record all the jenkins job variables like record the build duration, build variables, repository metadata, et

Misbahul Ardani 3 Apr 22, 2021
Clean architecture validator for go, like a The Dependency Rule and interaction between packages in your Go projects.

Clean Architecture checker for Golang go-cleanarch was created to keep Clean Architecture rules, like a The Dependency Rule and interaction between mo

Robert Laszczak 662 Dec 31, 2022
Manage your repository's TODOs, tickets and checklists as config in your codebase.

tickgit ??️ tickgit is a tool to help you manage latent work in a codebase. Use the tickgit command to view pending tasks, progress reports, completio

Augmentable 292 Dec 30, 2022
depth is tool to retrieve and visualize Go source code dependency trees.

depth is tool to retrieve and visualize Go source code dependency trees. Install Download the appropriate binary for your platform from the Rele

Kyle Banks 810 Dec 30, 2022
A reference for the Go community that covers the fundamentals of writing clean code and discusses concrete refactoring examples specific to Go.

A reference for the Go community that covers the fundamentals of writing clean code and discusses concrete refactoring examples specific to Go.

Lasse Martin Jakobsen 2.5k Jan 1, 2023
Tool to populate your code with traceable and secure error codes

Essential part of any project, especially customer facing is proper and secure error handling. When error happens and customer reports it, it would be nice to know the context of the error and where it exactly occured.

vs 51 Sep 28, 2022
🔥 ~6x faster, stricter, configurable, extensible, and beautiful drop-in replacement for golint

revive Fast, configurable, extensible, flexible, and beautiful linter for Go. Drop-in replacement of golint. Revive provides a framework for developme

Minko Gechev 3.9k Jan 3, 2023
A Golang tool that does static analysis, unit testing, code review and generate code quality report.

goreporter A Golang tool that does static analysis, unit testing, code review and generate code quality report. This is a tool that concurrently runs

360 Enterprise Security Group, Endpoint Security, inc. 3k Jan 8, 2023
[mirror] Performance measurement, storage, and analysis.

Go performance measurement, storage, and analysis tools This subrepository holds the source for various packages and tools related to performance meas

Go 323 Dec 24, 2022
A GitLab API client enabling Go programs to interact with GitLab in a simple and uniform way

go-gitlab A GitLab API client enabling Go programs to interact with GitLab in a simple and uniform way NOTE Release v0.6.0 (released on 25-08-2017) no

Xanzy 1.9k Jan 6, 2023
Fast division, modulus and divisibility checks in Go for divisors known only at runtime.

fastdiv Fast division, modulus and divisibility checks for divisors known only at runtime via the method of: "Faster Remainder by Direct Computation:

null 111 Jan 8, 2023
Bundle k6 with extensions as fast and easily as possible

xk6bundler xk6bundler is a CLI tool and GitHub Action makes bundle k6 with extensions as fast and easily as possible. Features Build for multiple targ

Iván Szkiba 10 Nov 29, 2022
octocov is a tool for collecting code metrics (code coverage, code to test ratio and test execution time).

octocov is a tool for collecting code metrics (code coverage, code to test ratio and test execution time).

Ken’ichiro Oyama 159 Jan 9, 2023
Refactoring and code transformation tool for Go.

gopatch is a tool to match and transform Go code. It is meant to aid in refactoring and restyling.

Uber Go 532 Dec 30, 2022
The Golang linter that checks that there is no simultaneous return of `nil` error and an invalid value.

nilnil Checks that there is no simultaneous return of nil error and an invalid value. Installation & usage $ go install github.com/Antonboom/[email protected]

Anton Telyshev 13 Dec 14, 2022