Muster

Incident response playbooks for security teams: draw them as diagrams, version them, run them step by step during an incident or an exercise, and produce the incident report as a PDF.

Try it in two minutes

With Docker (nothing else to install):

docker compose pull && docker compose up   # prebuilt, signed image from GitHub
# or build it here:
docker compose up --build

With Node.js 22.13 or later:

npm install
npm run demo

Then open http://localhost:8080 and click one of the demo accounts on the sign-in page.

Account	Password	Can
admin	muster-admin	everything, plus users and the audit log
editor	muster-editor	edit and publish playbooks, edit report templates
analyst	muster-analyst	declare incidents, run them, write reports
viewer	muster-viewer	read everything

Demo mode also loads a closed incident with its report (IR-2026-041) and a tabletop exercise in progress, so every screen has content. Demo data is disposable: when a new version of Muster changes it, a demo-mode server replaces the old demo database on start (a real install, DEMO_MODE=false, is never touched). To start the demo from scratch at any time: docker compose down -v, or delete the data-demo folder.

A short tour

1. Playbooks — ten ready-made playbooks. Open Ransomware: it has three published versions and an unpublished change.
2. In the editor, select a step and press A to add an action after it, D for a decision. Drag the orange handle under a step onto another step to connect them. Drafts save automatically.
3. History compares any two versions on the diagram and lists every change.
4. Incidents → Declare an incident, choose Exercise and a clock speed of ×60 to see SLAs tick in minutes per second. Tick tasks, answer decisions, close the incident.
5. Create incident report, edit the executive summary and your notes, then Download PDF.
6. Reports → Templates: upload your logo, change the colour, the report ID pattern (IR-{YYYY}-{SEQ}, {PB}-REG-{YYMMDD}-{SEQ}…), rename, hide or reorder sections. The preview updates as you type.

Open the app in two browsers with two accounts: incident progress, playbook changes and new reports appear live for everyone.

Default playbooks

Code	Playbook	Category
PB-001	Ransomware	Malware
PB-002	Phishing email	Phishing
PB-003	Compromised account	Identity
PB-004	CEO fraud and payment diversion	Fraud
PB-005	Personal data breach (GDPR, 72-hour notification)	Data protection
PB-006	Malware on an endpoint	Malware
PB-007	DDoS attack	Availability
PB-008	Lost or stolen device	Device
PB-009	Insider threat	Insider
PB-010	Exploited critical vulnerability	Vulnerability

They follow the NIST incident response phases and are a starting point: review owners, SLAs and escalation contacts with your team before relying on them.

Running it for real

Set DEMO_MODE=false. On first start Muster creates one admin account; set ADMIN_PASSWORD or read the generated password in the logs, then add your team in Admin.

Variable	Default	Meaning
PORT	8080	HTTP port
DATA_DIR	./data (/data in Docker)	where the SQLite database lives — back this folder up
DEMO_MODE	false (true in docker-compose.yml)	demo accounts and sample data on first start
ADMIN_PASSWORD	random	password of the first admin when demo mode is off
COOKIE_SECURE	false	set to true when served over HTTPS
TRUST_PROXY	false	set to true behind a reverse proxy, to log real client IPs

Put Muster behind a reverse proxy that terminates TLS (nginx, Caddy, Traefik). Server-sent events are used for live updates, so disable response buffering for /api/events if your proxy buffers.

Back up with a copy of DATA_DIR (stop the container first, or use sqlite3 muster.db ".backup backup.db").

Verify the image

Every published image is signed: an attestation proves it was built by this repository's Release workflow, from the code of the tag. Check it before deploying (needs the GitHub CLI):

gh attestation verify oci://ghcr.io/solidgeeks/muster:1.0.1 --owner SolidGeeks

It must print Verification succeeded!. If it fails, do not run the image, and report it (see SECURITY.md).

Working with Strata

Strata maps your information systems. Linked to Muster, a response runs on the map: the assets hit, who to call, the flows to cut, what depends on them.

1. In Muster, create an account for Strata with the analyst role (Admin › Users).
2. In Strata, set MUSTER_URL (how the Strata server reaches Muster), MUSTER_USER and MUSTER_PASSWORD.
3. Declare an incident and open Link to Strata: the Strata IS id, the assets hit (names or Strata ids) and, for the Exploited critical vulnerability playbook, the CVE.

This is the beginning of the README. Read the rest at the original. Read the full README ↗