Overview
Self-hosted incident response platform - ingest alerts, triage, investigate and close cases, entirely on your own infrastructure.
ir.mlab.sh turns scattered security alerts into structured investigations - from initial triage to case closure. It runs entirely on your infrastructure: your servers, your databases, your data. The only outbound call is an hourly license validation.
Deploy is three commands with Docker Compose. A free license key is auto-provisioned with every mlab.sh account at mlab.sh/orga/ir/license.
Getting started
Quick start
Three commands, Docker, you're running.
Installation
Docker Compose, requirements, reverse proxy, TLS.
Configuration
Environment variables, secrets, tuning.
Core concepts
Workflow stages
How alerts move through ingest, triage, investigate, resolve.
Licensing
Activation, signed validation, the 7-day offline window, tiers.
API reference
Alerts, cases, observables, webhooks endpoints.
Integrations
SIEM, EDR, email gateway, custom sources.
Operations
Update
Pull, restart, rollback.
Troubleshooting
Common errors and how to fix them.
FAQ
Quick answers to the questions we hear most.
Glossary
Terms used across the product.
Need help?
If you're stuck, the fastest path is [email protected]. Paid plans include priority email support; Corporate plans come with an SLA. License management for your organisation lives on mlab.sh.