Description

Reconstruct what happened, and when — without wrestling with a spreadsheet.

TRACE is a Windows desktop application built for security teams who need to turn scattered notes, alerts, and log excerpts into a single, chronological incident timeline. Every event is placed on a dual-track spine — adversary actions on one side, defender response on the other — so cause and effect are visible at a glance.

Built around the frameworks your team already uses

• Tag adversary actions against the Unified Kill Chain (18 phases) and MITRE ATT&CK tactics
• Tag defender response against the PICERL incident-response methodology
• Mark events by severity (Low → Critical) and type (action, decision, or key observation)
• Automatic timing metrics: dwell time, time to contain, time to eradicate, time to recover

Get the report out the door

• Export a presentation-ready timeline as SVG or PNG
• Print a formatted, text-based incident report
• Import events from CSV or JSON to bulk-load existing case data
• Export/import full incident JSON for archiving or sharing between analysts

Your data stays yours TRACE stores everything in a local SQLite database on your machine — there’s no cloud sync, no account, and no telemetry. It works completely offline. The renderer runs sandboxed and reaches storage only through a narrow, audited bridge, so incident data never touches the network unless you choose to export and send it yourself.

Manage multiple incidents Switch between saved incidents from the sidebar; each keeps its own timeline, metadata, and case reference number.

Runs on Windows 10/11 (64-bit). One-click installer, no administrator rights required — or grab the portable .exe if you’d rather not install anything.