mirror of
https://github.com/SecurityBrewery/catalyst.git
synced 2025-12-06 07:12:46 +01:00
79 lines
2.9 KiB
Markdown
79 lines
2.9 KiB
Markdown
<h1 align="center">
|
|
<img width="30" alt="Screenshot of the playbook part of a ticket" src="ui/public/flask_white.svg" />
|
|
Catalyst</h1>
|
|
<h3 align="center">Speed up your reactions</h3>
|
|
<h4 align="center">
|
|
<a href="https://catalyst-soar.com">Website</a>
|
|
-
|
|
<a href="https://catalyst-soar.com/docs/category/catalyst-handbook">The Catalyst Handbook (Documentation)</a>
|
|
-
|
|
<a href="https://try.catalyst-soar.com">Try online</a> (user: bob, password: bob)
|
|
</h4>
|
|
|
|
Catalyst is an incident response platform or SOAR (Security Orchestration, Automation and Response) system. It can help
|
|
you to automate your alert handling and incident response procedures.
|
|
|
|
## Features
|
|
|
|
### Ticket (Alert & Incident) Management
|
|
|
|
|
|
|
|
Tickets are the core of Catalyst. They represent alerts, incidents, forensics
|
|
investigations, threat hunts or any other event you want to handle in your
|
|
organisation.
|
|
|
|
## Ticket Templates
|
|
|
|
<center>
|
|
<img width="400" alt="Screenshot of the playbook part of a ticket" src="docs/screenshots/details.png" />
|
|
</center>
|
|
|
|
Templates define the custom information for tickets. The core information for
|
|
tickets like title, creation date or closing status is kept quite minimal and other
|
|
information like criticality, description or MITRE ATT&CK information can be
|
|
added individually.
|
|
|
|
## Conditional Custom Fields
|
|
|
|
<center>
|
|
<img width="400" alt="Screenshot of the playbook part of a ticket" src="docs/screenshots/conditional_custom_field_a.png" />
|
|
<img width="400" alt="Screenshot of the playbook part of a ticket" src="docs/screenshots/conditional_custom_field_b.png" />
|
|
</center>
|
|
|
|
Custom Fields can be dependent on each other. So if you, for example choose
|
|
"malware" as an incident type a custom field ask you to define it further as
|
|
ransomware, worm, etc. which a "phishing" incident would ask for the number
|
|
of received mails in that campaign.
|
|
|
|
## Playbooks
|
|
|
|
<center>
|
|
<img alt="Screenshot of the playbook part of a ticket" src="docs/screenshots/phishing_playbook.png" />
|
|
</center>
|
|
|
|
Playbooks represent processes that can be attached to tickets. Playbooks can
|
|
contain manual and automated tasks. Complex workflows with different workflow
|
|
branches, parallel tasks and task dependencies can be modeled.
|
|
|
|
## Automations
|
|
|
|
<center>
|
|
<img alt="Screenshot of the playbook part of a ticket" src="docs/screenshots/script.png" />
|
|
</center>
|
|
|
|
Automations are scripts that automate tasks or enrich artifacts. Automations are
|
|
run in their own Docker containers. This enables them to be created in different
|
|
scripting languages and run securely in their own environment.
|
|
|
|
## Users
|
|
|
|
<center>
|
|
<img alt="Screenshot of the playbook part of a ticket" src="docs/screenshots/roles.png" />
|
|
</center>
|
|
|
|
Catalyst has two different types of users, normal users accessing the platform
|
|
via OIDC authentication and API keys for external script. A
|
|
fine-grained access model is available for both types and allows to define
|
|
possible actions for each user.
|