Kanvas is an incident response case management tool with a desktop interface built using Python. It provides a unified workspace for investigators to track and document security incidents without switching between multiple applications. The tool is built on the SOD (Spreadsheet of Doom) framework, allowing all data to remain within a spreadsheet for easy distribution and collaboration. It supports multi-user workflows by enabling files to be stored on local machines or shared drives with file locking to prevent editing conflicts. Key features include: - Attack chain visualization for mapping lateral movement - Incident timeline visualization in chronological order - Threat intelligence lookups for IP addresses, domains, file hashes, and CVEs - Ransomware victim verification to check if an organization's data has been published online - MITRE ATT&CK and D3FEND framework mapping - V.E.R.I.S. reporting capabilities - Knowledge management tools including bookmarks, Windows Event ID reference, and Entra ID reference - Built-in Markdown editor for note-taking and documentation - One-click sanitization of sensitive data like domains, URLs, and IP addresses Kanvas is designed to streamline incident response workflows by consolidating essential investigation tools and references into a single application.