Technical requirements
Buyer summary first. Administrator detail second. Sizing numbers are starting points, not certified benchmarks.
Architecture
CaseScope coreWeb UI / Gunicorn
Evidence storageUploads, staging, vault, memory, PCAP
PostgreSQLCases, users, IOCs, audit
ClickHouseHigh-volume events
WorkersCelery parse / memory / PCAP / analysis
Optional local AIStays in-environment
Optional external AIOnly if enabled
License check-inEntitlement metadata, not evidence
Starting sizes
Small-team evaluation: Ubuntu 24.04, 8+ CPU, 32 GB RAM. Production more typically 16+ CPU, 64 GB+ RAM, NVMe for staging. These are estimates.
Who owns what
You own OS patching, TLS, backups, and recovery. CaseScope provides the application, worker model, and licensed upgrade path for supported versions.
Administrator detail
PostgreSQL 15+, Redis 7+, ClickHouse, Gunicorn, Celery, EvtxECmd/Hayabusa, Volatility3, and Zeek as needed. Dedicated IOC queue exists so IOC work does not block ingest workers. Customer documentation ships with evaluation or licensed access.