Incident response collaboration tool.
Orders, tasks, findings and one shared timeline. It runs on a local network, members only need a browser.
See it run
One exercise incident in seven screens. Use the arrow keys, or press Present for a projector.
The section joins from a browser
Only the IC laptop runs the Field HQ. Members connect to the section network, scan the QR code or type the address, check the certificate fingerprint and enter the access code. Nothing gets installed on their phones or laptops.
Get the section moving with a warning order
The fields come filled with sensible default text, so the IC edits instead of writing from a blank page. Issue it and every member gets a banner on their own device that they have to acknowledge.
Issue the full orders
Situation, higher intent, mission, execution, service support, command and signal. Tasks go to named members, and each member sees a New task banner on their own device until they acknowledge it.
Declare the incident and start the clock
Give the incident an ID, pick the severity and fill in the 5W. The moment you declare, the H clock starts and every log line after it carries H+ time.
Findings that hold up later
Each finding is stamped and signed with the analyst's name. Files are hashed with SHA-256 the moment you attach them. Anything too big or too dangerous to carry around, like a memory image or a malware sample, goes in as a reference with its hash and where it is stored.
The White Cell plays higher HQ
On an exercise, one more laptop runs as the White Cell. It sees each team's status and the RFIs and RFCs they address to WC. From there it answers, approves or rejects, and sends injects to one team or to all of them.
Stand down, review, report
Stand down stops the clock and records the end state, the evidence handover and the residual risk. The after action review comes next, and members can add their own sustain and improve points. Then one click turns the whole session into a deck for the hot wash.
Version 1.8.0
The IC laptop needs the Field HQ. Members only need a browser.
Check the SHA-256 on the card before you run a file: Get-FileHash -Algorithm SHA256 .\CBP-HQ-*.zip on Windows, sha256sum on Linux.