Open source incident investigation

Incident investigation for
OCSF data in your terminal.

A single binary with embedded SQLite storage for triaging OCSF findings and events over SSH. Zero server infrastructure required. 

brew install Ashfaaq98/tap/console-ir
Windows and manual downloads ↗ (Linux & macOS amd64/arm64, Windows amd64, checksums & SBOM)
⌘ Keyboard-first ◇ OCSF 1.8.0 native ↗ AGPLv3
console-ir — findings queue & triage workflow LIVE TUI
Console-IR in use: working the findings queue, opening a detection, and escalating it into a case
Three-step investigative flow

How Console-IR works

From raw OCSF inputs to defensible incident cases, without taking your hands off the keyboard.

01. Ingest OCSF

1. Ingest OCSF

Ingest pre-formatted OCSF JSON/JSONL files, watch directories (--watch), stdin, or experimental HTTP endpoint. Input must already be OCSF JSON/JSONL.

console-ir ingest --watch ./alerts/
02. Keyboard Triage

2. Triage from the keyboard

Open to a ranked queue of findings (D), inspect raw corroborating events (A), set verdicts (v), or update status (s). Ingesting, triaging and writing up a case need no network at all.

j/k move  •  D findings  •  A events  •  ↵ open
03. Escalate Cases

3. Escalate into a case

Escalate findings into structured cases (e). Cases hold findings as members and raw events as evidence; one finding can belong to several cases.

v verdict  •  s status  •  e escalate
Open Source (v0.2.x)

Security tooling should
be inspectable.

Console-IR is an open-source project built for security practitioners. Run it locally, inspect the code, and contribute to the repository. The TUI workflow is the fully supported path (headless mode is experimental).

Ingesting, triaging, and case writing require no network. GeoIP and WHOIS enrichment call out to third-party services, and an optional Redis transport is available for external threat-intel plugins.

Explore the repository ↗
License AGPLv3
Runtime Go (≥1.23)
Storage SQLite + FTS
Interface Terminal UI