CaseLens is a security operations case manager for file and network investigations. It brings Crucible and PacketLens into one workflow so a team can collect evidence, queue analysis, correlate indicators, document decisions, and produce reports without passing artifacts between separate tools.
- Incident ownership, severity, status, notes, and evidence
- File and PCAP uploads with SHA-256 verification
- Background analysis through Celery and Redis
- Static file inspection through Crucible
- PCAP inspection through PacketLens
- Correlation of IP addresses, domains, hashes, and MITRE ATT&CK techniques
- Admin, analyst, and read-only access levels
- Append-only, hash-chained audit history
- Executive and technical HTML reports
- PostgreSQL persistence, Docker deployment, and CI checks
Requirements: Docker Desktop or Docker Engine with Compose.
Copy-Item .env.example .envEdit .env and replace the database password, JWT secret, and bootstrap administrator password. For a production deployment, set ENVIRONMENT=production, COOKIE_SECURE=true, and serve CaseLens over HTTPS.
docker compose up --buildOpen http://localhost:8080 and sign in with the bootstrap administrator account from .env. The initial account is only created when the users table is empty.
- Create an incident and assign an analyst.
- Add investigation notes and upload evidence.
- Queue an analysis from the evidence panel.
- Review the job output and correlated indicators.
- Export an executive summary or technical report.
Crucible is used for static file inspection only. Its dynamic execution path is intentionally disabled in the shared worker. PacketLens handles supported PCAP and PCAPNG captures. The worker stores structured findings in PostgreSQL and keeps original evidence in the configured evidence volume.
| Role | Access |
|---|---|
| Admin | Full investigation access, account management, assignment, audit history, and chain verification |
| Analyst | Create and update incidents, add notes, upload evidence, queue jobs, and export reports |
| Read only | Review incidents, evidence metadata, findings, correlations, and reports |
The frontend requires Node.js 22 or newer. The API targets Python 3.12.
npm install
npm run devIn another terminal:
python -m venv .venv
.\.venv\Scripts\pip.exe install -r backend\requirements-dev.txt
$env:DATABASE_URL = "postgresql+psycopg://caselens:password@localhost:5432/caselens"
$env:REDIS_URL = "redis://localhost:6379/0"
.\.venv\Scripts\python.exe -m uvicorn app.main:app --app-dir backend --reloadStart a worker after PostgreSQL and Redis are available:
.\.venv\Scripts\python.exe -m celery --workdir backend -A app.celery_app:celery_app worker --loglevel=INFORun the checks:
npm test
npm run lint
Push-Location backend
& ..\.venv\Scripts\python.exe -m pytest tests -q
Pop-Location
docker compose configapp/: analyst web interfacebackend/app/: API, authorization, analysis adapters, audit chain, and reportsbackend/migrations/: PostgreSQL schema and audit immutability triggerdeploy/: gateway configuration and security headersdocs/: architecture and deployment security notes.github/workflows/ci.yml: frontend, backend, and Compose validation
See architecture.md for the service boundaries and security.md before exposing the platform outside a trusted network.
The worker installs fixed revisions of Crucible and PacketLens. Update those pins deliberately, then rerun the backend tests and analyze representative samples before deployment.
MIT