Catalyst SOAR on Ubuntu 24.04 LTS

Overview

Catalyst is a self hosted incident response and security automation platform. Security teams use it to manage the full lifecycle of alerts, incidents, vulnerabilities and threat hunts as structured tickets, each with tasks, a timeline, comments, links and evidence files, so an investigation is documented as it happens rather than reconstructed afterwards. Ticket types carry their own custom fields and schema, so an alert, an incident and a forensics case each capture the information that matters for that kind of work. Reactions are the automation engine: a trigger such as a webhook or a collection hook fires an action such as a Python script or an outbound HTTP call, so repetitive triage and enrichment run without a human in the loop and analysts spend their time on the decisions that need judgement. A dashboard summarises the current picture at a glance.

It suits security operations and incident response teams that want a single owned system for alert handling, case management and playbook automation, running inside their own cloud account rather than a shared multi tenant service.

Common uses

• Manage alerts, incidents and vulnerabilities as structured tickets with tasks, timelines and evidence
• Automate triage and enrichment with reactions that run Python or outbound HTTP on a trigger
• A self hosted incident response and case management platform you own inside your own cloud account

See it running

Real screenshots taken while testing this image against its deployment guide.