Catalyst SOAR on Ubuntu 24.04 LTS by cloudimg

Catalyst SOAR on Ubuntu 24.04 LTS

Catalyst is a self-hosted security orchestration, automation and response (SOAR) and incident-response platform. Security operations teams use it to run the full lifecycle of alerts, incidents, vulnerabilities and threat hunts as structured tickets, and to automate the repetitive parts of triage.

What you can do

• Manage alerts, incidents and vulnerabilities as separate ticket types, each with tasks, a timeline, comments, links and evidence files
• Give each ticket type its own custom fields and schema so it captures exactly the information that matters
• Automate triage and enrichment with reactions: pair a trigger (webhook or collection hook) with an action (Python or outbound HTTP)
• See the current picture at a glance on a dashboard of open tickets by type and workload

Why the cloudimg image

• Runs the pinned Catalyst release as a single Go binary under systemd, fronted by nginx on port 80
• Embedded SQLite database plus local file storage for evidence — no external database or object store to run or secure
• Secure by default: no admin account and no database are baked into the image; on first boot a unique admin password and all platform secrets are generated at random and written to a root-only file, so no default login is ever reachable
• The database and file store listen only on loopback; the only remote surfaces are the console on port 80 and SSH with your own key
• Ubuntu 24.04 LTS base, fully patched, no swap on disk, scanned clean of fixable vulnerabilities before release

Licensing

Catalyst is licensed under AGPL-3.0 and is free — there is no per-CPU or per-user fee. The cloudimg charge (0.04 USD per vCPU/hour) covers packaging, security patching, image maintenance and 24/7 support.

Sizing and prerequisites

Recommended size Standard_B2s (2 vCPU / 4 GB) — Catalyst is a single lightweight binary. You need an Azure subscription, a VNet and an SSH key. In the NSG, permit port 22 (SSH) from your management network and port 80 (HTTP) from the networks that use the console; front port 80 with your own TLS proxy for any untrusted network.

Deployment guide: https://www.cloudimg.co.uk/guides/catalyst-soar-on-ubuntu-24-04-azure/

24/7 support: support@cloudimg.co.uk