PumaCase is an offline incident-response case manager — the container that holds an incident from first alert to lessons-learned. Open a case, work it through the NIST 800-61 lifecycle, and keep every task, indicator, and piece of evidence in one place. No server, no account, no telemetry.
.pumapack (all boards, cases, observables, evidence records + custody) and, separately, a .pumaevd evidence bundle holding the raw file bytes. Export both for a full backup; Import takes either (drag-drop works too), in any order.See the Keyboard tab for shortcuts.
PumaCase is built around NIST SP 800-61, the standard four-phase model for handling a security incident. A case moves through the phases; its status, tasks, and timeline all hang off them.
Contain before you eradicate. Stop the spread first — a half-cleaned host that's still reachable just reinfects. And preserve evidence before you wipe; you can't re-collect what you destroyed.
Evidence is only as good as its provenance. Hash each artifact when you acquire it, log every transfer, and re-verify before you rely on it. If you can't show the bytes didn't change, the evidence won't hold up.
Memory is the first casualty of an incident. Record detections, decisions, and actions when they happen, with timestamps — not from recollection while writing the report. The contemporaneous record is what makes the after-action review honest.
Use TLP (Traffic Light Protocol) to mark how far each case and indicator may travel. Decide handling before you forward, not after.
The source is NIST SP 800-61 (Computer Security Incident Handling Guide). The SANS "PICERL" mnemonic — Preparation, Identification, Containment, Eradication, Recovery, Lessons-learned — covers the same ground. Rehearse the plan in PumaTTX, and hunt for what detection missed in PumaHunter.
Every case board is stored in your browser's sessionStorage, on this device and this browser only. Evidence file bytes are kept locally in this browser's IndexedDB. Nothing is uploaded anywhere.
The Save button (or ⌘/Ctrl+S) saves all boards and evidence records to a single .pumapack file. For a complete backup also export the evidence bundle separately — use the board's right-click menu → Export board → Evidence bundle. Restore with Import (either file, any order) or by dragging it onto the window.
Danger zone. This erases every PumaCase board and all evidence in this browser. Export a backup first.
Type DELETE EVERYTHING to confirm:
.pumapack backupPumaCase is a lightweight, portable, offline IR case management system that runs entirely in your browser. Running an IR CMS in your browser is a terrible idea for a variety of reasons, and you shouldn't do it. That said, sometimes you don't have any better options to keep track, and a nice interface for a JSON beats notepad.exe.
This tool is provided as-is, with no warranties or guarantees. It is not professional advice. By using it you accept full responsibility for any outcomes that result from your use.
PumaWorx is a suite of offline, single-HTML productivity apps that run entirely in your local browser. The entire suite is a personal, open source vibecoding project.
This is an offline single-HTML app. No data goes to or from the internet — there is no server, no account, no sync, and no telemetry. Your cases and evidence live in your web browser's sessionStorage and IndexedDB — on this device, in this browser, and nowhere else.
If you clear site data, use a private/incognito window, switch browsers, or lose this device, your cases are gone. Back up regularly with Export in the topbar — it produces a single .pumapack file containing every board, case, and evidence item.
Press ? any time for help and keyboard shortcuts.