Security Operations
Incident management tools that keep one case and one timeline (2026)
A 2026 shortlist of case shelves. Public docs, not a lab bake-off.
Expertise: Security Operations · Level: Intermediate · 12 min read
Six Slack threads is not a timeline.
The host was isolated in one chat. The ticket lived in another. Incident management is one case, one timeline, one owner. SOAR is the action. This page is the case.
Six cases. Two open IR platforms. Two pagers. One ITSM. One Slack-native shelf. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| TheHive | Open IR case you can host | AGPL-3.0 / commercial |
| DFIR-IRIS | Open DFIR case for a team you have | LGPL-3.0 |
| PagerDuty | Page the human who can revoke | Commercial |
| incident.io | Declared incidents with a clock | Commercial |
| Jira Service Management | The ticket you already have | Commercial |
| Rootly | Slack-native incident commercial | Commercial |
TheHive
Best for open IR case you can host
TheHive is a case platform. Observables, tasks, a timeline. StrangeBee stewards it. Cortex sits next to it as analyzers.
Key features
- Cases and tasks
- Observables
- You can host it
- Cortex analyzers
Why we like it
This is the hidden gem for a SOC that will not live in Slack.
Limits
AGPL-3.0. You staff it. Analyzers are not SOAR playbooks.
DFIR-IRIS
Best for open DFIR case for a team you have
IRIS is a collaborative DFIR platform. Cases, notes, IOCs. You host it.
Key features
- Collaborative case
- IOC modules
- You operate it
- LGPL-3.0
Why we like it
When the work is notes and evidence, not a playbook marketplace, IRIS is the honest shelf.
Limits
You staff it. Not a pager. Not TheHive’s analyzer market.
PagerDuty
Best for page the human who can revoke
PagerDuty is the known pager. Escalation, not a full IR case.
Key features
- Escalation
- On-call
- Many integrations
- Commercial
Why we like it
A case without a page is a wiki. A page without a case is this row’s hole. Use both.
Limits
Commercial. It is not TheHive. We did not run a tenant.
incident.io
Best for declared incidents with a clock
incident.io sells declared incidents, roles, and a clock. Common next to Slack.
Key features
- Declare and roles
- Timeline they document
- Slack-shaped
- Commercial
Why we like it
When the org already talks in Slack, this is the commercial case they will finish.
Limits
Commercial. Not an IR lab. We did not run it.
Jira Service Management
Best for the ticket you already have
JSM is ITSM. Security teams use it because it is already there.
Key features
- Tickets
- SLAs they sell
- Same Atlassian tenant
- Commercial
Why we like it
Honesty. A lot of IR is a Jira ticket. We list it so the open cases have a neighbor.
Limits
A ticket is not a timeline unless you write one. Not a pager.
Rootly
Best for slack-native incident commercial
Rootly runs incidents from Slack. Retrospective after.
Key features
- Slack workflows
- Roles
- Retros they document
- Commercial
Why we like it
Second Slack-shaped shelf so we are not a one-logo page.
Limits
Commercial. Slack is a chat. You still need artifacts.
What the internet thinks about incident management
IR threads treat Slack as a trap. We agree. The case is the artifact. A page that ends as a Jira paste is the hole this page names.
VectorLock on Hacker News, Nov 2021: “This is one thing I really like about PagerDuty’s incident response, I can pull incidents and Slack messages right into the Incident timeline.”
Prove TheHive still publishes
Confirm TheHive still publishes. Do not attach production tickets to a new case box on the first day.
curl -fsSIL https://strangebee.com/thehive/ | head -n 8FAQs
Does a case replace SOAR?
No. The case records. SOAR acts. Link both.
Is PagerDuty enough?
A page is not a timeline. Keep a case.
Can I live in Slack?
You can. Export the timeline or you will lose the night.
Is this a scored bake-off?
No. Order is editorial.
