# Kanvas

Kanvas is an Incident Response product. It runs on-premises. Pricing is free.

An open-source incident response case management tool

Checked October 2026.

## What is Kanvas?

Kanvas is an incident response case management tool with a desktop interface built using Python. It provides a unified workspace for investigators to track and document security incidents without switching between multiple applications.

The tool is built on the SOD (Spreadsheet of Doom) framework, allowing all data to remain within a spreadsheet for easy distribution and collaboration. It supports multi-user workflows by enabling files to be stored on local machines or shared drives with file locking to prevent editing conflicts.

Key features include:
- Attack chain visualization for mapping lateral movement
- Incident timeline visualization in chronological order
- Threat intelligence lookups for IP addresses, domains, file hashes, and CVEs
- Ransomware victim verification to check if an organization's data has been published online
- MITRE ATT&CK and D3FEND framework mapping
- V.E.R.I.S. reporting capabilities
- Knowledge management tools including bookmarks, Windows Event ID reference, and Entra ID reference
- Built-in Markdown editor for note-taking and documentation
- One-click sanitization of sensitive data like domains, URLs, and IP addresses

Kanvas is designed to streamline incident response workflows by consolidating essential investigation tools and references into a single application.

Tags: Visualization, Case Management, Open Source, Security Framework

## Where it fits in your security program (NIST CSF 2.0)

- [Respond](https://cybersectools.com/guides/building-respond-program-small-team): helps you contain and handle incidents.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Incident Response](https://cybersectools.com/categories/dfir)
- Deployment: On-Premises
- Company size fit: Startup
- Pricing model: Free
- Features: 5 listed
- GitHub stars: 363
- Website: github.com

The full feature and integration lists are on the page for signed-in visitors.

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## Kanvas FAQ

### What is Kanvas?

Kanvas is a product in the Incident Response category. It covers Visualization, Case Management and Open Source.

### What is the pricing for Kanvas?

Kanvas is free. Download and setup instructions are at https://github.com/WithSecureOpenSource/Kanvas.

### What are alternatives to Kanvas?

Alternatives to Kanvas listed on CybersecTools:

1. [CatchProbe CrimeGround](https://cybersectools.com/tools/catchprobe-crimeground) - Investigation and case management system for cybersecurity incidents (Commercial)
2. [StrangeBee TheHive IaaS Images](https://cybersectools.com/tools/thehive-strangebee) - Collaborative case management platform for incident response and investigation (Commercial)
3. [Spacewalk AI](https://cybersectools.com/tools/spacewalk-ai) - AI platform for incident response: timeline automation, reporting & team sync. (Commercial)
4. [CipherData Incident Response](https://cybersectools.com/tools/cipherdata-incident-response) - AI-assisted IR platform with human-in-the-loop task management and containment. (Commercial)
5. [CYGNVS Incident Response](https://cybersectools.com/tools/cygnvs-incident-response) - An out-of-band command center for cyber incidents and the teams involved in response (Commercial)

Compare all Kanvas alternatives at [https://cybersectools.com/alternatives/kanvas](https://cybersectools.com/alternatives/kanvas)

### What deployment and organization size does Kanvas fit?

Kanvas is available as on-premises software. It is listed for startups. It is free.

## Compare Kanvas with similar solutions

- [Kanvas vs CatchProbe CrimeGround](https://cybersectools.com/compare/catchprobe-crimeground-vs-kanvas)
- [Kanvas vs StrangeBee TheHive IaaS Images](https://cybersectools.com/compare/kanvas-vs-thehive-strangebee)
- [Kanvas vs Spacewalk AI](https://cybersectools.com/compare/kanvas-vs-spacewalk-ai)

All alternatives to Kanvas: [/alternatives/kanvas](https://cybersectools.com/alternatives/kanvas)

---

Source: https://cybersectools.com/tools/kanvas

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Kanvas: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md