ANKIR Get access

Analyst Notes, Knowledge & Incidents Repository

Collaborative investigations, from first note to final case

ANKIR is a local-first collaborative investigation workspace for DFIR and CTI teams, unifying notes, evidence, intelligence, and cases.

Try the demo See capabilities
ankir / INC-2020-001 / SUNBURST
The ANKIR client investigating the SUNBURST / SolarWinds supply-chain incident, a block outliner with case severity, TLP marking, and IOCs alongside auto-generated knowledge panels for threat actor, malware analysis, and indicators of compromise.
ANKIR editor view showing a real DFIR case note.
Local-first
Private Vault, offline-capable
Team workspace
Shared cases, tasks, authorship
Structured intel
IOCs, entities, relationships
Case-ready
Evidence, timelines, reports

One shared record instead of four tools

Analysts today stitch together Obsidian for notes, case systems for tracking, shared drives for artifacts, and custom scripts for reporting. The seams become visible during active response.

ANKIR bridges private analysis and team coordination in one environment. Capture messily in the Vault, promote clean findings to the Workspace, and report from the same investigation record.

  • Obsidian / Logseq

    Strong for private notes. Weak for team cases and audit trails.

  • TheHive / XSOAR

    Strong for ticketing. Weak for narrative thinking and speed.

  • ANKIR

    Notebook speed, shared workspaces, investigation assets, graph-backed intelligence, and case-ready reporting

Built for investigation workflows

ANKIR replaces the patchwork of note apps, case systems, shared drives, and custom scripts with one analyst-native environment for private work and team investigations.

  • Analyst notebook

    Fast structured notes with nested outlines, markdown, anchors, and stable IDs for investigation narratives.

  • Shared workspaces

    Promote findings into team-visible spaces with live collaboration, authorship, tasks, and audit history.

  • Case & asset management

    Cases, tasks, evidence, playbooks, and objectives live in one typed model instead of scattered tools.

  • Knowledge graph

    Threat actors, malware, IOCs, and relationships become nodes automatically so analysts can pivot without rebuilding context.

  • Private Vault

    Brain dump, paste logs, and test rough theories locally with no team visibility until you choose to share.

  • CTI standards

    STIX 2.1 import/export and ATT&CK-aware workflows keep intelligence work connected to operational notes.

Vault and Workspace

The Vault is not a draft folder. It is a permanent first-class environment for sensitive, fast work. The Workspace is where promoted findings become team-visible, auditable, and report-ready.

Vault

Private. Local. Yours.

  • Brain dump, paste logs, rough notes, half-formed theories
  • Works offline with no spinners or sync anxiety
  • No team visibility, no audit trail by default
  • Some content never needs to leave the Vault

Workspace

Shared. Synced. Auditable.

  • Promote clean findings when you are ready
  • Real-time collaboration for active incidents
  • Full audit trail with timestamps, authorship, and edit history
  • Evidence-grade output for leadership and legal

You control what crosses the boundary and when. No accidental exposure of raw analysis.

Security & Trust

Data residency you can verify

For DFIR work, where your evidence lives is a buying criterion. ANKIR is local-first and self-hostable end to end. No third-party cloud sits between you and your investigation.

  • Local-first by default

    Your Vault lives on your device in local SQLite. It is private, offline-capable, and never auto-syncs, so sensitive analysis stays put until you decide otherwise.

  • No telemetry

    Nothing is phoned home from the client. The public demo build ships with no embedded API keys. Even the AI integration is stubbed out.

  • Your data, your host

    Self-host the standalone stack on your own Docker or LXC host. Workspace data lives in your Postgres; evidence lives in your MinIO object storage.

  • Audit & chain of custody

    Workspaces keep a hash-chained, append-only audit log with timestamps, authorship, and edit history, plus SHA256 evidence hashing for integrity verification.

  • You control the boundary

    Nothing crosses from Vault to Workspace by accident. You promote clean findings when you are ready, with TLP markings and evidence-grade output for leadership and legal.

  • Proprietary licensing

    ANKIR is proprietary, all-rights-reserved software, not an open redistribution. You run it on your own infrastructure under its license terms.

Product preview

Real screenshots from the ANKIR client showing the local Vault, shared case structure, and investigation graph in one surface.

ankir / local Vault
ANKIR editor showing the INC-2020-001 SUNBURST case note, with block outliner severity, TLP marking, and IOC metadata alongside auto-generated knowledge panels for threat actor, malware analysis, and indicators of compromise.

Block outliner with case metadata, anchors, and live knowledge panels.

Captured from the ANKIR client running with demo data. Real product, illustrative incidents.

For technical evaluators

Architecture at a glance

ANKIR is one React client with a standalone backend. No managed cloud lock-in, no proprietary sync layer. The local Vault is the source of truth for private work; the server holds collaborative, auditable Workspaces. You can run it as a browser demo, self-host the full stack, or ship it as a desktop app.

Client

Local-first React app

  • React 19 + TypeScript + Vite
  • CodeMirror 6 block-level outliner
  • TanStack Query for data flow
  • SQLite WASM for the private local Vault
  • Yjs for real-time collaboration

Intelligence

DFIR-native data model

  • STIX 2.1 import and export
  • MITRE ATT&CK-aware workflows
  • Cases, evidence, and IOCs as typed assets
  • Audit-grade authorship and timelines

Server

Standalone backend (@ankir/server)

  • Hono REST API + Drizzle ORM
  • PostgreSQL as the Workspace data of record
  • Yjs over WebSocket collaboration
  • MinIO object storage for evidence
  • jose JWT auth with role-gated realms

Three delivery surfaces, one codebase

Every surface is the same standalone client build. Evaluate it in the browser, then bring it fully in-house when you are ready.

  • Public browser demo

    A static client build that runs entirely in the visitor’s browser. Vault data never leaves the tab. No login, no backend.

  • Self-host (Docker / LXC)

    One-command standalone stack on your own infrastructure: client, API, PostgreSQL, and MinIO. Your data stays on your host.

  • Tauri desktop shell

    The same client wrapped in a native desktop app, vault-only or pointed at your self-hosted server.

Self-host in one command

The reference topology brings up the full stack from a single compose file: client, API, database, and object storage.

docker-compose.standalone.yml 
$ docker compose -f docker-compose.standalone.yml up --build
web
:3000
api
:8787
postgres
:5432
minio
:9000 / :9001

Try ANKIR

The public browser demo is a local-only client. Your vault stays in your browser, and nothing is sent to a server. Explore seeded DFIR sample cases, then contact us if you are evaluating ANKIR for your team.

Open demo ahoy@ankir.app