Open-source alternatives to Dispatch

This project provides a comprehensive framework for incident management, offering standardized procedures and operational guidance for handling technical emergencies. It serves as a structured resource for defining incident response workflows, establishing severity classification systems, and coordinating team roles during high-stakes operational events. The documentation is maintained as version-controlled, markdown-based content, enabling collaborative updates through peer review workflows. This approach allows organizations to manage their operational knowledge as code, ensuring that proce

Cachet is a self-hosted, open-source status page system designed to communicate service uptime, incident history, and infrastructure performance to end users. It provides a centralized dashboard for managing the operational lifecycle of system components, tracking service disruptions, and scheduling maintenance windows. The platform distinguishes itself through a comprehensive RESTful API that enables programmatic status page management and automated incident reporting. It supports deep integration with external monitoring tools, allowing for the synchronization of performance metrics and the

Oncall is an incident response management platform designed to coordinate alert routing, on-call scheduling, and incident resolution workflows. It functions as an alert routing and escalation engine that directs notifications to responders using rule-based deduplication and conditional escalation policies. The system includes a multi-channel notification gateway for delivering urgent alerts via SMS, push notifications, and chat platforms, featuring the ability to bypass device silence settings. It also serves as an on-call scheduling system that manages team rotations and availability through

Security-101 is a vendor-agnostic, foundational cybersecurity learning curriculum organized into modular, framework-aligned modules. It is designed to build core knowledge across multiple security domains without tying content to specific products or platforms, making it suitable for both beginners and professionals seeking a structured introduction to the field. The curriculum is built around established security frameworks, including the MITRE ATT&CK framework for standardized threat analysis and the NIST Cybersecurity Framework for incident response workflows. It covers a broad range of do

StackStorm is an event-driven automation platform that watches for events from external systems and triggers workflows, actions, and remediation across infrastructure tools. At its core, it provides a workflow orchestration engine that chains multiple actions and conditional logic into reusable, multi-step workflows for complex automation tasks, alongside a rules engine that applies matching criteria to triggers and maps trigger payload data to action inputs for automated responses. The platform distinguishes itself through a ChatOps integration framework that enables executing commands and r

Cabot is a self-hosted incident management platform and monitoring alert manager. It serves as a centralized system for receiving external monitoring data, managing on-call responder rotations, and dispatching incident notifications to administrators to ensure prompt resolution of system failures. The platform provides a containerized monitoring interface and a REST API for programmatically creating and modifying monitoring data and incident reports. It coordinates the routing of critical system alerts and manages the scheduling of personnel for on-call rotations. The system includes capabil

Nightingale is a Prometheus-compatible monitoring and alerting platform designed to centralize telemetry management across multiple time-series databases. It functions as a multi-source alerting engine and metric data pipeline that ingests telemetry via remote write protocols and triggers alarms based on data from sources such as Prometheus, Elasticsearch, Loki, and ClickHouse. The system is distinguished by its automated alert healing system, which executes predefined scripts and RPC-based corrective actions when monitoring thresholds are breached. It supports distributed alert processing, a

This project is an AI agent orchestration platform that provides a visual environment for building, testing, and deploying complex automation workflows. It functions as a low-code development interface where users can chain discrete functional blocks into dependency-aware pipelines to integrate artificial intelligence with external data and services. The platform supports the creation of intelligent conversational agents, automated business processes, and multi-service API orchestrations within a unified workspace. The platform distinguishes itself through its event-driven integration engine,

React-admin is a framework for building data-driven administrative interfaces that connect to REST or GraphQL backends. It provides a comprehensive suite of tools for managing the full lifecycle of administrative applications, including resource-oriented routing, declarative form scaffolding, and context-driven state management. By utilizing a modular adapter-based architecture, the framework abstracts backend communication, allowing developers to build consistent CRUD interfaces that handle data fetching, authentication, and synchronization automatically. The project distinguishes itself thr

WooCommerce is a comprehensive eCommerce framework for WordPress that transforms websites into fully functional online stores for physical and digital goods. It serves as a digital storefront manager for product catalogs, inventory, and customer orders across retail and wholesale business models. The system functions as a payment gateway integrator, connecting shops to diverse processors for credit cards, digital wallets, and subscriptions. It also operates as an order fulfillment system for calculating shipping rates, generating labels, and coordinating delivery via third-party couriers, whi

Polar is a digital product monetization engine and subscription management system. It serves as a merchant of record platform that handles global sales tax and VAT compliance, providing the infrastructure for selling subscriptions and one-time digital goods via hosted checkouts and embedded payment flows. The project functions as an entitlement and access manager, automating the granting and restriction of digital benefits, license keys, and third-party platform roles. It includes a dedicated usage-based billing infrastructure that tracks customer activity through meters to apply aggregation

FlaskBB is a forum software for building online communities and structured discussions, developed using the Flask web framework. It provides a system for organizing public conversations, rendering rich text via a Markdown processor, and managing a multilingual localization engine to support global audiences. The platform features an extensible plugin framework that allows for the addition of custom logic and new features to the core forum functionality. Access is managed through a role-based access control system that assigns permissions to user groups to restrict or grant access to specific

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

GRR is a distributed incident response platform and asynchronous forensic task orchestrator. It functions as a remote forensics framework designed to collect and analyze volatile data, system memory, and digital artifacts from remote hosts during security incident response. The system operates as a remote endpoint triage system, utilizing a coordinated architecture to manage a fleet of agents. It enables the execution of investigative tasks across multiple systems, allowing for the search of files and registries across a large fleet of machines to identify compromised hosts. The platform pro

Digital Forensics Investigation Platform

DEPRECATED - MozDef: Mozilla Enterprise Defense Platform

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.

A powerful and user-friendly browser extension that streamlines investigations for security professionals.

DataHub is a metadata management platform designed to unify technical, operational, and business context across diverse data ecosystems. By utilizing a graph-based metadata model and an event-driven ingestion architecture, it creates a centralized source of truth that maps complex data relationships, lineage, and ownership. This foundational framework enables organizations to maintain a synchronized view of their data landscape, supporting both human-led discovery and automated data operations. The platform distinguishes itself through its focus on grounding artificial intelligence and autono

Kubeshark is a network observability platform designed for Kubernetes environments, functioning as an eBPF-powered engine for cluster-wide traffic analysis. It captures, indexes, and visualizes network activity and API calls directly from the kernel, providing deep visibility into service-to-service communication without requiring sidecar proxies or manual code instrumentation. The platform distinguishes itself through its ability to perform protocol-aware traffic dissection and user-space cryptographic hooking, which allows for the inspection of encrypted traffic and the reconstruction of ap

Keep is an open-source AIOps alert management platform that aggregates, deduplicates, and orchestrates the lifecycle of alerts from multiple monitoring tools. It functions as a multi-provider integration hub to centralize the flow of data between observability, ticketing, and communication tools. The platform distinguishes itself through incident workflow automation and AI-powered enrichment. It uses a declarative workflow engine to execute multi-step operational sequences and integrates large language models to summarize event data and correlate technical logs for faster incident resolution.

Hatchet is an open-source durable workflow engine and task orchestration platform. It provides a framework for building and executing fault-tolerant, multi-step pipelines as directed acyclic graphs (DAGs), with automatic retries, scheduling, and real-time observability. The system is built around durable task checkpointing, which persists execution state after each step so work can resume from the last checkpoint after a worker crash or restart, and it supports event-driven task resumption that pauses a task until a matching external event arrives. The platform distinguishes itself through it

Collaborative forensic timeline analysis

HELK is a containerized security information and event management environment and threat hunting platform. It provides a security-focused deployment of the ELK stack, combining Elasticsearch, Logstash, and Kibana into a specialized platform for investigating logs and discovering hidden patterns in network and system security data. The project functions as a security data science suite, integrating interactive computational notebooks and distributed processing tools to run machine learning and graph analytics on security logs. This allows for the identification of hidden attack patterns and an

DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs