00Incident response playbooks
Draw your playbooks as diagrams, version them like code, run them step by step when it happens, and get the incident report as a PDF. Self-hosted, for security teams.
docker compose up --build
The playbook you draw is the one that runs. The run is what the report is made of. Nobody retypes anything at 3 a.m.
01 — Draw
Actions, decisions and escalations on a canvas that arranges itself. Every step has an owner, an SLA, a NIST phase and a checklist.
02 — Version
One shared draft, immutable published versions. Compare any two on the diagram itself: added, changed and removed steps, field by field.
03 — Run
Declare an incident or a tabletop exercise. Muster shows one step at a time, its tasks and its SLA clock, and asks the decisions as questions.
04 — Report
Close the incident and Muster drafts the report: executive summary, timeline, SLA performance, key decisions and the analyst’s notes. Edit, sign, download the PDF.
IR-{YYYY}-{SEQ} or {PB}-REG-{YYMMDD}-{SEQ}
Written for the incidents a security team actually meets, following the NIST phases. Start from them, then make them yours.
PB-001 Critical
Files encrypted or ransom note found. Contain fast, escalate early, restore from clean backups.
PB-002 Medium
Qualify the reported email, purge it everywhere and check who clicked.
PB-003 High
Cut access, scope what the attacker did, restore safely.
PB-004 High
Fake executive or supplier, urgent payment. Stop the money first.
PB-005 High
Contain, assess the risk, notify within 72 hours when required.
PB-006 Medium
EDR alert on a host. Check execution, contain, hunt for spread.
PB-007 High
Confirm, mitigate upstream, keep customers informed.
PB-008 Medium
Lock it, wipe it, check what data was on it.
PB-009 High
Stay discreet and work with HR and Legal.
PB-010 Critical
Find exposure, mitigate, hunt for compromise.
Review owners, SLAs and escalation contacts with your team before relying on them. Each one exports to YAML.
Calm, legible, fast. Everything a team needs while it happens, and everything an auditor asks for afterwards.
Viewer, analyst, editor and admin. Local accounts with scrypt hashing, sessions you can revoke, an admin who can never lock themselves out.
Incident progress, playbook changes and new reports reach every open browser instantly over server-sent events.
The PDF is rendered from the same data and template as the on-screen preview, so what you approve is what you send.
Sign-ins, publications, incident actions and account changes, with who and when. Readable by admins in the app.
A light interface by default and a dark one for the night shift. Reports and PDFs always print light.
Playbooks export to YAML, reports to Markdown and PDF. A plain JSON API behind every screen.
Node’s built-in HTTP server and SQLite, a React interface, one runtime dependency. You can read all of it in an afternoon.
muster/ ├─ packages/core types, 10 playbooks, diffs, engine ├─ packages/pdf report → PDF (pdf-lib) ├─ apps/api node:http, node:sqlite, roles ├─ apps/web React interface ├─ scripts/ esbuild, demo launcher └─ tests/ API, browser walk-through
X-Muster header on every writeThe demo opens with four accounts, the ten playbooks, a closed incident with its report and an exercise in progress, so every screen has something on it.
$ git clone <your-fork-url> $ cd muster $ docker compose up --build # open http://localhost:8080
$ git clone <your-fork-url> $ cd muster $ npm install $ npm run demo # open http://localhost:8080
