Your files stay on your device

Incident response workspace

Run one incident in a single page: timeline, SHA-256 hashed evidence with custody, indicators, actions, deadlines, and lessons, exported as JSON or a Markdown or HTML report.

Set up the incident on the left; every section fills in from there.

This is a single-analyst worksheet, not a case-management system: nothing is sent anywhere, there is no collaboration, and evidence sources are hashed in this tab and then dropped. A hash alone is not chain of custody; the custody log under each item is the part that matters, so record who took the item, when, and why. Deadline clocks are computed from the times you enter. The SEC business-day count skips weekends but not federal holidays, and DORA's initial notification uses classification plus four hours capped at awareness plus 24. The JSON export round-trips through Import JSON, reports defang every indicator, and raw values stay only in the JSON you keep.
Options

More text tools

- Password policy tester (/crypto/password-policy-tester)
- Markdown table (/text/markdown-table)
- Compare two texts (/text/diff)
All text tools (/text)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/text/incident-response-workspace
Markdown version: https://nutter.tools/text/incident-response-workspace.md
Plain-text version: https://nutter.tools/text/incident-response-workspace.txt
Agent index: https://nutter.tools/llms.txt