IR Desk

When something breaks, people mix symptoms with diagnosis and wipe traces “for peace of mind”. IR Desk keeps a timeline, facts apart from hypotheses, decisions with rationale and a gap list. Storage is only in your browser; export Markdown or plain text when you need to share.

Why it exists

During an account takeover, a weird alert or ransomware, the first hour tends to become a chat full of guesses. IR Desk forces a simple split: what you see, what you only suspect, what was decided and what is still missing from the logs.

It runs in the browser. No account, no cloud, no “send the case to tomek.st”. Export the note and take it onward — to your team, an insurer or the form if you want external triage.

This is not

• a round-the-clock SOC or retainer
• a court-grade chain-of-custody tool
• an automaton that “evicts the attacker”

For formal forensics and media handling, agree scope separately — Incident response / Digital forensics.

How to start

1. Enter a case title and who can approve isolation.
2. Add timeline entries in the order they were noticed.
3. Keep facts apart from hypotheses.
4. Export Markdown before you clear the browser or change machines.

The app is below.