KANVAS review
A focused, open-source workspace for spreadsheet-based incident investigations.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
KANVAS is an open-source desktop tool for digital forensics and incident-response investigations, aimed at analysts who organize cases in the Spreadsheet of Doom or similar spreadsheets. It provides a workspace for investigation data, notes, bookmarks, and security references, while keeping case materials in portable spreadsheet and Markdown formats. Its Windows, macOS, and Linux support makes it usable across desktop environments, and it runs without a web server or additional infrastructure. That focused approach suits teams that already work with shared files and want incident-response views around them, rather than a broad case-management system.
The distinctive value is its analysis and documentation layer. KANVAS can generate automatic incident timelines with PNG and CSV export, visualize lateral movement and attack chains, and map activity to MITRE ATT&CK and D3FEND. A MITRE Flow Builder supports adversary-action sequences, while self-contained HTML reports provide a shareable case output. Threat-intelligence lookups cover IPs, domains, URLs, hashes, email, and CVEs, with VirusTotal and Shodan listed as integrations. Indicators of compromise can be exported as STIX 2.1 JSON. These features make it relevant when an investigation needs structured visualization and reporting without moving case data into a server-based system.
KANVAS is free and open source, with no paid tiers described. Its desktop and file-based model is also its main boundary: teams collaborate through local or shared-drive files with file locking, rather than through a web application. That makes it a stronger fit for analysts comfortable with spreadsheet-centered workflows than for organizations seeking a full case-management platform or browser-based access. Choose it when portable investigation files, incident timelines, visualizations, and exports are priorities; consider a broader system when centralized case management is central to the workflow.
KANVAS pros and cons
- Where it wins
- Builds incident timelines and attack-chain visualizations from case data
- Maps MITRE ATT&CK and D3FEND techniques and exports STIX 2.1 JSON
- Runs on Windows, macOS, and Linux without a web server
- Where it doesn't
- Uses spreadsheet and Markdown files rather than a full case-management system
- Shared-file collaboration depends on local or shared-drive file locking
- Desktop deployment does not provide web-based access
KANVAS fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update