Catalyst SOAR Incident Response Platform

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Consolidate Incident Response in Your Own VPC

Catalyst is an open source, self-hosted SOAR (Security Orchestration, Automation and Response) platform that gives security teams one place to triage alerts, manage incidents, vulnerabilities and tasks, run playbooks and automations, keep case timelines and evidence, and collaborate through a web console and REST API, all within your own AWS account.

## Ready to Respond in Minutes, Not Days

Unlike self-deploying open source SOAR tools, which require installing and pinning releases, configuring TLS reverse proxies, generating secrets, provisioning dedicated storage and hardening services, this AMI delivers a production-ready incident-response platform on first boot. Launch the instance, browse to HTTPS on port 443, and sign in with your generated admin credentials. Your team can begin triaging alerts immediately.

The current release available is Catalyst 0.15.7.

## Application Architecture

Catalyst ships as a single Go binary serving the REST API and the embedded web console. It stores everything in an embedded SQLite database with evidence attachments as local file uploads, so there is no external database cluster to provision or maintain. The application binds to loopback only; an nginx reverse proxy terminates TLS on port 443 and forwards traffic, while port 80 redirects to HTTPS. The incident datastore lives on a dedicated EBS volume mounted at /var/lib/catalyst, separate from the operating-system disk and independently resizable as your case data grows.

## Secure By Default: No Shared Secrets, No Default Credentials

An incident-response platform holds sensitive security data, so a shipped secret would be a serious risk. Unlike many marketplace security AMIs that ship with shared default credentials, every Catalyst instance generates unique security material on first boot:

• A unique admin password and fresh session, token and reset secrets are generated before the platform is reachable
• A per-instance self-signed TLS certificate is created on first boot; no shared certificate ships in the image
• The application and datastore listen on loopback only, reached solely through the TLS reverse proxy
• The security group opens just SSH and HTTPS
• The image ships with no admin account and no database; default logins are rejected and unauthenticated API requests are refused
• Build-time state is wiped before capture, so secrets, certificates and data are all created fresh on your instance

## Use Cases

• In-house SOC teams that want a self-hosted case-management and automation hub for alerts, incidents and vulnerabilities, kept entirely within their own AWS account with no SaaS dependencies.
• Managed security service providers and incident-response consultancies that need auditable, per-client deployments with data residency and full ownership of case data.
• Compliance-driven teams who cannot send incident data to a third-party hosted SOAR and need it running in their own VPC to meet data-residency requirements.

## What You Avoid By Using This AMI

• Installing, pinning and maintaining the release as a hardened loopback service
• Configuring a TLS reverse proxy and provisioning certificates
• Generating and rotating admin credentials and application secrets
• Provisioning and managing a dedicated resizable datastore volume
• Ongoing security patching without expert guidance

## Licensing

Catalyst is free and open source under the GNU Affero General Public License v3.0 (AGPL-3.0). The verbatim licence text and a pointer to the corresponding source at the pinned release ship inside the image. Its embedded datastore is SQLite (public domain) via an MIT-licensed driver. There is no per-seat fee for the software; the cloudimg charge covers packaging, security patching, image maintenance and 24/7 support.

## Get Started

Launch the AMI, browse to the instance over HTTPS on port 443, and sign in with the generated admin account. Retrieve the credentials with: sudo cat /root/catalyst-credentials.txt. The full deployment guide is at https://www.cloudimg.co.uk/guides/catalyst-soar-aws/ . For help with TLS certificate replacement, DNS, backups, user management or any other deployment question, contact cloudimg support at support@cloudimg.co.uk.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.