GIRP — Guided Incident Response Platform

GIRP is a modular incident response platform for Security Operations Centers (SOCs). Administrators build dynamic, guided intake forms with a visual playbook editor; reporters submit incidents through those forms; analysts triage, investigate, and manage the resulting tickets in a unified dashboard.

GIRP is source-available under the Sustainable Use License.

This repository is the deployment stack: a single docker-compose.yml plus a shared .env that runs the whole platform.

Modules

Module	Description	Default Port
backend-socview	Central management API. Handles tickets, playbooks, users, and platform configuration.	3000
backend-inputform	Intake API. Manages form sessions and persists incident submissions.	4000
frontend-socview	Analyst dashboard. Ticket management, timeline, playbook administration.	5173
frontend-inputform	Public intake form. Dynamically guided form interface for incident reporters.	4173
formbuilder	Visual playbook editor. Low-code tool for designing form flows.	hosted
launcher	Windows all-in-one launcher. Electron app that runs the entire platform locally — no Docker required.	desktop app
database-models	Shared Mongoose models used by both backends. Published on npm as @girp/database-models.	npm library

How It Works

An administrator designs an incident intake form in the Formbuilder and imports the resulting playbook into SOCView. A reporter opens the public Inputform, works through the guided questions, and submits the incident. The submission is processed by the Backend-Inputform and written as a ticket to the shared database, where analysts monitor and manage it in the Frontend-SOCView, backed by the Backend-SOCView.

Architecture

flowchart LR
    subgraph Users
        REP["Reporter"]
        AN["Analyst"]
        ADM["Playbook Designer"]
    end

    subgraph Stack["girp-stack (docker compose)"]
        FEIF["frontend-inputform<br/>:4173"]
        FESV["frontend-socview<br/>:5173"]
        BEIF["backend-inputform<br/>:4000"]
        BESV["backend-socview<br/>:3000"]
        DB[("MongoDB 8<br/>replica set rs0<br/>shared database")]
        INIT["mongo-init<br/>(one-shot setup)"]
    end

    FB["formbuilder<br/>hosted editor (default)<br/>or self-hosted :8080"]

    REP --> FEIF
    AN --> FESV
    ADM --> FB
    FEIF --> BEIF
    FESV --> BESV
    FB -. "playbook import" .-> FESV
    BEIF -- "session validation" --> BESV
    BEIF --> DB
    BESV --> DB
    INIT -. "initializes replica set + app user" .-> DB

Loading

Both backends share one MongoDB database (single-node replica set rs0 — required for the change streams that power live ticket updates). The mongo-init service initializes the replica set and creates the application user on first start.

Screenshots

Analyst dashboard (Frontend-SOCView)

Guided intake form (Frontend-Inputform)

Visual playbook editor (Formbuilder)

Prerequisites

• Docker with the Docker Compose plugin

Quickstart

git clone https://github.com/BavariaByte/girp-stack.git
cd girp-stack
cp .env.example .env
# Edit .env — see Configuration below
docker compose up -d

MongoDB is included as a managed service (single-node replica set, initialized automatically).

Images

By default the module images are pulled prebuilt from the GIRP Docker registry (docker.bavariabyte.com, publicly reachable — see the IMAGE_* variables in .env.example). To build locally instead, clone the module repos side by side inside this directory using their exact lowercase names (backend-socview, backend-inputform, frontend-inputform, frontend-socview) so they match the compose build contexts, unset the IMAGE_* variables, and run docker compose build.

Formbuilder

The stack does not run its own Formbuilder. The hosted editor at builder.girp.bavariabyte.com is used by default (FORMBUILDER_URL). To self-host it instead, run the image on a port of your choice and point FORMBUILDER_URL at it:

docker run -d -p 8080:80 docker.bavariabyte.com/formbuilder:latest
# .env: FORMBUILDER_URL=http://localhost:8080

Dedicated compose variants that bundle the Formbuilder may follow later.

Configuration

All configuration lives in a single .env file — see the curated, commented .env.example for every available variable. The essentials:

Variable	Description
PLATFORM_URL	Public URL of the Frontend-SOCView, e.g. https://socview.example.com
INPUTFORM_URL	Public URL of the Frontend-Inputform, e.g. https://form.example.com
SOCVIEW_API_URL	Public URL of the Backend-SOCView API, as reachable by the browser
INPUTFORM_API_URL	Public URL of the Backend-Inputform API, as reachable by the browser
FORMBUILDER_URL	Public URL of the Formbuilder (default: the hosted editor)
MONGO_ROOT_PASSWORD, MONGO_APP_USERNAME, MONGO_APP_PASSWORD	MongoDB credentials
CSRF_SECRET, SESSION_JWT_SECRET	Security secrets — generate with openssl rand -hex 32
SUPER_ADMIN_EMAIL	Email address that is always granted admin privileges

Platform Updates:

Variable	Description	Default
UPDATE_CHECK_ENABLED	Enable periodic checks for platform updates	true
UPDATE_CHECK_INTERVAL_DAYS	Interval between update checks (days)	3
UPDATE_CHECK_REGISTRY	Docker registry to check for new platform images	docker.bavariabyte.com

When a newer version is available, admins receive an email notification and see a dialog on their next login. To apply the update, run:

docker compose pull
docker compose up -d

Authentication — enable exactly one provider (default: Microsoft SSO via Azure / Entra ID):

Provider	Required variables
Azure / Entra ID (AUTH_AZURE_ENABLED=true, default)	AZURE_CLIENT_ID, AZURE_TENANT_ID
Auth0 (AUTH_AUTH0_ENABLED=true)	AUTH0_CLIENT_ID, AUTH0_OIDC_ISSUER, AUTH0_OIDC_AUDIENCE
Better-Auth (AUTH_BETTERAUTH_ENABLED=true)	BETTER_AUTH_SECRET, BETTER_AUTH_COOKIE_DOMAIN — optionally with Google or Slack OAuth

Notifications (all optional): SMTP, Slack, Microsoft Teams, and PagerDuty are configured via environment variables — leave the NOTIFY_* and SMTP_* variables empty to disable them.

Security

Please report security vulnerabilities to security@bavariabyte.com — see SECURITY.md. Do not open public issues for vulnerabilities.

License

GIRP is source-available under the Sustainable Use License — free for internal business, non-commercial, and personal use. See LICENSE.md for the full terms.