PumaCase is an offline incident-response case manager — the container that holds an incident from first alert to lessons-learned. Open a case, work it through the NIST 800-61 lifecycle, and keep every task, indicator, and piece of evidence in one place. No server, no account, no telemetry.

• Cases with severity, TLP, lifecycle status, incident category, assignee, and SLA clocks driven off the detection time.
• Case boards (workspaces) — one per client, engagement, or team. Switch, rename, and recolor them from the tabs.
• Three views — a metrics Dashboard, a sortable Cases table, and a drag-between-lanes Board.
• Tasks per case, grouped by IR phase, with assignee and due dates.
• Playbooks — each category carries an editable list of template tasks that are auto-created when you open a case of that category. Define your own categories and playbooks from the topbar gear (⚙).
• Observables / IOCs — typed indicators (IP, domain, hash, URL, email…) with TLP and an IOC flag.
• Evidence with chain of custody — attach a file, PumaCase computes its SHA-256 locally, and every acquisition / transfer / verification is logged. "Verify" re-hashes the stored bytes to prove they haven't changed.
• Case timeline — a time-ordered record of detections, actions, findings, and communications. Key events are logged automatically.
• Everything exports to a single .pumapack backup (evidence bytes travel as content-addressed attachments).

See the Keyboard tab for shortcuts.