Response coordination CSIRT-led

Convey

Transforms incident logs and tables into enriched, filtered or split reports that CSIRTs can send to responsible contacts through SMTP or OTRS.

By CSIRT.cz / CZ.NIC · Czechia

Open primary source Compare saved tools Report a correction

CSIRT-led

Primary sources connect this project to an EU CSIRT as developer or lead.

At a glance

Recorded facts

Response workflow: Response coordination
Developer or maintainer: CSIRT.cz / CZ.NIC
Recorded country: Czechia
Product model: Open source
Deployment: Desktop/CLI / Self-hosted
Software license: GPL-3.0
Upstream status: Active
Evidence class: CSIRT-led

What the sources establish

Origin note

Upstream README explicitly says Convey is brought by CSIRT.cz within the Czech CZ.NIC organization.

Reported capabilities

Log/table conversion and enrichment
Split by incident contact
SMTP or OTRS delivery

Scope and limits

Primarily a Python CLI with an optional web-service mode; it processes reports but is not a full case-management platform.

Inspect the research evidence 4 source observations

identity / origin / capabilities / deployment
README credits CSIRT.cz and documents pip installation, CLI/web-service modes, CSV/log conversion, filtering, splitting and SMTP/OTRS sending.
Read source Checked 2026-10-10
license
Actual LICENSE.txt text is GNU General Public License version 3.
Read source Checked 2026-10-10
maintenance
Upstream GitHub API reports nonarchived repository with code pushed 1 October 2026; this is activity, not a support guarantee.
Read source Checked 2026-10-10
country
CZ.NIC's current first-party association page identifies its Czech domain-registry and cybersecurity role, and registration at the Municipal Court in Prague.
Read source Checked 2026-10-10

This profile summarizes source material. It does not include hands-on security testing, procurement review, or an assessment of fit for your environment.

Capabilities & integrations

Tags record specific documented functions. They do not establish end-to-end interoperability; check the component, edition and version in the source.

No structured capability or integration evidence has been added for this tool in the current pass. This does not establish that a feature is unsupported. Send a documentation link.

Put the tool in context.

Move from alert triage to assigned tasks, evidence, shift handoff and closure. A practical case management guide with TheHive and DFIR-IRIS references.

An incident response case management workflow