Endpoint Forensics Console (Container Edition)

Productivity

A self-hosted endpoint forensics console: collect forensic data from managed machines and investigate them from a web interface, brought up with Docker Compose on your own machine, with a demo client included so one machine is ready to use in the interface. Derived from a frozen snapshot of an open-source project under the Apache-2.0 licence; the delivery includes an orchestration file (images fixed by digest, every port bound to 127.0.0.1), a script that generates the passwords and secrets, and a quick-start guide. The guide states that the interface has no sign-in and performs no access checks, so it is for your own machine only.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-12

In practice

Readiness3 / 5

What you need

Few changes needed4 / 5

Who it is for

Security staff and small teams who want to try endpoint forensics workflows on their own machine for evaluation or teaching; not suited to serving the interface to others directly.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview2,000+ paths

▸api_client25

python/

▸appveyor9

docker_build/
e2e_tests/
windows_templates/

▸colab25

examples/
grr_colab/
setup.py

▸devenv6

src/

▸docker6

centos7-python39/
centos7/
docker-entrypoint.sh
install_grr_from_gcs.sh
rockylinux8/
ubuntu18/

▸docker_config_files18

client/
healthchecks/
init_certs.sh
mysql/
server/
testing/

▸grr1838

__init__.py
artifacts/
client/
client_builder/
config/
core/
proto/
server/
test/
test_lib/
…

▸keys9

test/

▸monitoring23

grafana/

▸scripts2

quickstart/

▸terraform6

demo/

▸travis8

__init__.py
build_api_documentation.sh
build_local_pyindex.sh
build_templates.sh
get_openapi_description.py
install.sh
install_client_builder.sh
set_up_test_user.sh

▫ACKNOWLEDGEMENTS

▫ATTRIBUTION.md

▫AUTHORS

▫CHANGELOG.md

▫Dockerfile

▫Dockerfile.client

▫LICENSE

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫build_requirements.txt

▫compose.testing.yaml

▫compose.watch.yaml

▫compose.yaml

▫conftest.py

▫delivery-manifest.txt

▫gsoc_2021.md

▫pytest.ini

▫version.ini

▫Config and hidden files 5

Latest passing run

Clone → Checkout → Toolchain → Console up and serves

Pre-purchase Disclosure

What you are buying

A self-hosted endpoint forensics console: collect forensic data from managed machines and investigate them from a web interface, with a demo client included so one machine is ready to use in the interface once it is up. It is brought up with Docker Compose.

Derived from an open-source project under the Apache-2.0 licence, and not the original project itself. Our work: an orchestration file (images fixed by digest), a script that generates the passwords and secrets, and a quick-start guide.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision f82a438.

Known limitations

The interface has no sign-in and performs no access checks, so it is for your own machine only
The web interface is published only on port 18000 of the local machine, 127.0.0.1, over HTTP
The data lives in Docker named volumes, and docker compose down -v deletes all of it
The first start pulls images from registries and repacks the client installers, which takes several minutes
When you open the interface, the browser loads fonts and icons from Google Fonts
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit d71034a. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

3 PASS2 WARN0 FAIL

Source ReviewPASS

Read: compose.yaml (ports published only on 127.0.0.1, the database exposed only inside the compose network, images fixed by digest, startup refused when a password is missing), scripts/quickstart/init-env.sh (openssl generates random values, an existing .env is left unchanged), scripts/quickstart/init-configs.sh (runs in a one-shot container, generates keys and certificates, fills the passwords into the configuration), and the server configuration file, which sets the web interface to perform no access checks (stated in the quick-start guide). The upstream source was not read file by file.

Script SafetyPASS

The two scripts on the buyer path were read line by line: init-env.sh runs on the buyer host and only writes .env; init-configs.sh runs inside a one-shot container. Neither downloads anything or pipes a download into a shell. The images are fixed by digest in compose.yaml; what runs inside the upstream images was not inspected.

RecencyWARN

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the revision recorded in the product repository (see the evidence link). How recently upstream has been active was not checked.

LicensePASS

SPDX:Apache-2.0

The LICENSE file in the product repository was read: the Apache License 2.0 text, and PRODUCT.md and ATTRIBUTION.md record the same licence for upstream. The evidence link points at the upstream file at the pinned revision; it was not compared byte by byte with the copy in the product repository from this environment.

Dependency LicensesWARN

This records the declared side, not a scan result: the images are pulled by the buyer from their registries and their contents were not scanned for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).