Cybersecurity Incident Tracker

A local workspace for cyber incident response. Capture evidence as an investigation unfolds, see what happened over time, and prepare a clear briefing or handoff without a hosted case database.

KEEP THE CASE TOGETHER Create incidents, track their status, and record IP addresses, domains, URLs, hashes, identities, processes, impact observations, and analyst notes. Keep event and discovery times attached to the evidence.

SEE THE SEQUENCE Review indicators in a chronological timeline or visual map. Export the timeline as CSV when you need to work with the data elsewhere.

BRIEF WITH ON-DEVICE INTELLIGENCE Turn case evidence into a structured overview of status, key findings, impact, and next actions. On supported devices, Apple Intelligence helps generate the briefing on device. When it is unavailable, IR Tracker offers a local evidence-based summary. Always review generated content against the source evidence.

SHARE ON YOUR TERMS Export an incident handoff ZIP, share a timeline, or send a summary as Markdown. Import another analyst's handoff as a new case or review it for merging into an existing one.

START CLEAN Your workspace begins empty. Fictional sample incidents are available only if you choose to load them, are clearly labeled, and can be removed without deleting your own cases.

IR Tracker requires no account. Incident records stay in the app's local workspace unless you choose to export or share them.

Discovery signals