KANVAS

6.5easy start · #98 of 177
in Case Management Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Linux, Mac, Windows.

KANVAS is ranked #98 of 177 in case management software on The Geeks Club. It runs on Linux, macOS, Windows. There is a free plan.

KANVAS plans and pricing

All plans

KANVAS Free GPL-3.0 open-source project github.com · 5 Oct 2026

Compared on case management software

Free plan: Yes

Best KANVAS alternatives

See all 20

UiPath Maestro Case Management 0 of 4 in the starter kit Lesson 18.5 Newgen Dynamic Case Management 0 of 4 in the starter kit Lesson 28.0 Socianote 0 of 4 in the starter kit Lesson 38.0 Whistleblower Software 0 of 4 in the starter kit Lesson 47.9 DFIR-IRIS 0 of 4 in the starter kit Lesson 57.9 IntegrityLog 0 of 4 in the starter kit Lesson 67.8

The record

Purpose: KANVAS is a desktop incident response case management tool for tracking and documenting investigations using SOD or similar spreadsheets.
Local operation: The maker says KANVAS runs entirely on the user's machine without a web server, setup, or infrastructure.
Case collaboration: Investigation files can reside on local machines or shared drives, with file locking to manage edits among multiple investigators.
Reporting: KANVAS generates a self-contained HTML report that can include timelines, lateral movement, Diamond Model, investigation summaries, and recommendations.
Visualizations: It can create incident timelines, lateral movement visualizations, and MITRE Flow Builder diagrams, with image or CSV export for timeline and lateral movement views.
Threat intelligence: Lookup features cover IP reputation, domain and URL data, file hashes, CVEs, email breaches, and ransomware victim data.
Lookup integrations: The maker says lookup features require users to configure API keys such as VirusTotal and Shodan.
Security frameworks: The tool includes MITRE ATT&CK and D3FEND mapping and V.E.R.I.S. incident reporting.
Knowledge tools: Built-in references include Windows Event IDs, Microsoft Entra ID AppIDs, LOLBAS, Azure and Entra portals, and DLL hijacking information.
STIX export: KANVAS exports indicators of compromise in STIX 2.1 JSON format for use with threat intelligence platforms such as OpenCTI or MISP.
Spreadsheet requirement: Users of their own spreadsheets must match the documented column names, and the maker recommends the slightly modified SOD template included with the package.
Notable limits: The incident timeline requires MITRE TTP mappings for each entry, and the maker notes that Flow Builder may have performance issues, especially on Windows.
License: The project repository identifies its license as GPL-3.0.
Price from: Free

Where it ranks on The Geeks Club

Best Case Management Software in 2026#98 of 177

Is KANVAS yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote KANVAS

Sources

github.com/WithSecureOpenSource/Kanvas· checked 5 Oct 2026
kanvas-ir.org· checked 5 Oct 2026