Dagobert
Dagobert: Open-source DFIR case management with ATT&CK mapping, evidence tracking, and forensic integrations. Ranked #12 of 21 in Incident Response Software by our editors (7.9/10); pricing: Open source; best for ATT&CK-oriented DFIR teams.
At a glance
- Editor score7.9 / 10
- PricingOpen source
- Best forATT&CK-oriented DFIR teams
- Paid fromFree
- Case managementYes
- Facts checked20 Sep 2026
Where it wins
- Cross-case ATT&CK heatmaps and mapped investigation timelines
- Structured case tracking for evidence, indicators, assets, and malware
- Integrates with forensic tools, enrichment services, and Timesketch
Where it doesn't
- Self-hosted deployment requires team-managed infrastructure
- Focused on post-incident investigations rather than live response
- No built-in AI features or commercial support tier
Our verdict on Dagobert
Dagobert is a self-hosted, web-based incident response platform for DFIR consultants, MSSPs, and internal CIRT or SOC teams. It organizes investigations into case workspaces covering timelines, assets, indicators, malware, evidence, tasks, notes, and comments. Per-case role-based access control supports collaborative work across multiple investigations, while local or OIDC authentication handles access. The product is aimed at investigative work after an alert, not live incident operations.
Its strongest capability is the connection between case management and forensic analysis. A cross-case dashboard provides a MITRE ATT&CK heatmap, and the unified investigation timeline maps activity to ATT&CK techniques. Teams can track lateral movement across hosts, accounts, and indicators, assign tasks with owners and due dates, and share notes and comments. Evidence processing connects with Hayabusa, Zircolite, Chainsaw, Plaso, and Dissect. Indicator enrichment is available through VirusTotal, AbuseIPDB, and Hybrid Analysis, while Timesketch adds a dedicated timeline integration.
Dagobert also supports report generation from user-supplied document templates and exposes a read-only authenticated MCP endpoint for case data. It runs as a single Go binary backed by SQLite, which keeps the deployment model focused but places infrastructure responsibility with the adopting team. The project is open source and self-hosted, with no AI features and no commercial support tier. Choose it for ATT&CK-oriented teams that need structured, multi-case DFIR coordination and control over deployment. Choose an alternative when the priority is live response operations, managed hosting, built-in AI, or commercial support.
Questions about Dagobert
What does Dagobert run on? Web. It runs self-hosted.
What does Dagobert integrate with? 11 integrations, including Timesketch, VirusTotal, AbuseIPDB, Hybrid Analysis and Hayabusa.
Who is Dagobert built for? Small businesses, mid-market companies and enterprises (our editorial estimate).
Your product? Our editors can test Dagobert in depth and publish a review, labelled as paid · from $149/mo →
Dagobert pricing
Dagobert fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Free |
| Case management | Yes |
| Evidence tracking | Yes |
| Responder collaboration | Yes |
| On-call scheduling | No |
| Audit log | Not verified |
| API access | Yes |
| Deployment options | Self_hosted |
| Deployment | Self-hosted |
| Platforms | Web |
| Support | Community, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 11 integrations: Timesketch, VirusTotal, AbuseIPDB, Hybrid Analysis, Hayabusa, Zircolite … |
| Pricing | Open source |
| Website | github.com |
| Facts checked | 20 Sep 2026 |
Dagobert integrations
Dagobert lists 11 integrations on its own site.
- Timesketch
- VirusTotal
- AbuseIPDB
- Hybrid Analysis
- Hayabusa
- Zircolite
- Chainsaw
- Plaso
- Dissect
- OIDC
- Azure AD
Alternatives to Dagobert
- TheHiveA broad incident response workspace covering triage, investigation, evidence, and reporting.9.4
- DFIR-IRISA focused case-management platform for open-source incident response teams.9.2
- LimaCharlieAffordable endpoint-centric response with telemetry, cases, containment, and automation.9.0
See all Dagobert alternatives →
Used Dagobert? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Dagobert for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Dagobert is listed in our Incident Response Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/dagobert/"><img src="https://www.itechguides.com/best/badge/dagobert.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update