Dagobert review
Open-source DFIR case management with ATT&CK mapping, evidence tracking, and forensic integrations.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Dagobert is a self-hosted, web-based incident response platform for DFIR consultants, MSSPs, and internal CIRT or SOC teams. It organizes investigations into case workspaces covering timelines, assets, indicators, malware, evidence, tasks, notes, and comments. Per-case role-based access control supports collaborative work across multiple investigations, while local or OIDC authentication handles access. The product is aimed at investigative work after an alert, not live incident operations.
Its strongest capability is the connection between case management and forensic analysis. A cross-case dashboard provides a MITRE ATT&CK heatmap, and the unified investigation timeline maps activity to ATT&CK techniques. Teams can track lateral movement across hosts, accounts, and indicators, assign tasks with owners and due dates, and share notes and comments. Evidence processing connects with Hayabusa, Zircolite, Chainsaw, Plaso, and Dissect. Indicator enrichment is available through VirusTotal, AbuseIPDB, and Hybrid Analysis, while Timesketch adds a dedicated timeline integration.
Dagobert also supports report generation from user-supplied document templates and exposes a read-only authenticated MCP endpoint for case data. It runs as a single Go binary backed by SQLite, which keeps the deployment model focused but places infrastructure responsibility with the adopting team. The project is open source and self-hosted, with no AI features and no commercial support tier. Choose it for ATT&CK-oriented teams that need structured, multi-case DFIR coordination and control over deployment. Choose an alternative when the priority is live response operations, managed hosting, built-in AI, or commercial support.
Questions about Dagobert
What does Dagobert run on? Web. It runs self-hosted.
What does Dagobert integrate with? 11 integrations, including Timesketch, VirusTotal, AbuseIPDB, Hybrid Analysis and Hayabusa.
Who is Dagobert built for? Small businesses, mid-market companies and enterprises (our editorial estimate).
Dagobert pros and cons
- Where it wins
- Cross-case ATT&CK heatmaps and mapped investigation timelines
- Structured case tracking for evidence, indicators, assets, and malware
- Integrates with forensic tools, enrichment services, and Timesketch
- Where it doesn't
- Self-hosted deployment requires team-managed infrastructure
- Focused on post-incident investigations rather than live response
- No built-in AI features or commercial support tier
Dagobert fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update