Catalyst SOAR

Search the Marketplace for Catalyst SOAR, choose the plan, and deploy into your VNet. In the NSG, allow TCP 22 (SSH) and TCP 80 (web console) from your client networks only.

In production, front port 80 with a TLS reverse proxy or Azure Application Gateway.

RG="catalyst-prod"; LOCATION="eastus"; VM_NAME="catalyst-01" IMAGE_URN="sac1647283583153:catalyst-soar-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name cat-vnet --address-prefix 10.103.0.0/16 --subnet-name cat-subnet --subnet-prefix 10.103.1.0/24 az network nsg create -g "$RG" --name cat-nsg az network nsg rule create -g "$RG" --nsg-name cat-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name cat-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:catalyst-soar-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name cat-vnet --subnet cat-subnet --nsg cat-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

Both catalyst.service and catalyst-firstboot.service run automatically on first boot.

sudo systemctl is-active catalyst.service nginx.service catalyst-firstboot.service
sudo test -f /var/lib/sac/data/catalyst-firstboot.done && echo FIRSTBOOT_DONE
sudo ss -tlnp | grep -E ':8090 |:80 ' swapon --show || echo "no swap (correct)"

Catalyst listens on loopback 127.0.0.1:8090 and is reached only through the nginx reverse proxy on port 80.

sudo cat /root/catalyst-credentials.txt

CATALYST_URL=http://<vm-ip>/ CATALYST_ADMIN_EMAIL=admin@catalyst.local CATALYST_ADMIN_PASSWORD=<CATALYST_PASSWORD>

The password is unique to this VM. First boot generates it and stores it in a root-only file (mode 0600).

Log in for a bearer token, create an incident ticket, and read it back:

EMAIL=$(sudo grep '^CATALYST_ADMIN_EMAIL=' /root/catalyst-credentials.txt | cut -d= -f2-)
PASS=$(sudo grep '^CATALYST_ADMIN_PASSWORD=' /root/catalyst-credentials.txt | cut -d= -f2-)
TOKEN=$(curl -sf -X POST http://127.0.0.1:8090/auth/local/login \
  -H 'Content-Type: application/json' \
  -d "{\"email\":\"${EMAIL}\",\"password\":\"${PASS}\"}" \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["token"])')
# Create an incident (the "incident" ticket type ships by default; severity is in state)
TID=$(curl -sf -X POST http://127.0.0.1:8090/api/tickets \
  -H "Authorization: Bearer ${TOKEN}" -H 'Content-Type: application/json' \
  -d '{"type":"incident","name":"Phishing campaign against finance","description":"Reported by SOC","open":true,"schema":{},"state":{"severity":"High"}}' \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])')
# Read it back curl -sf http://127.0.0.1:8090/api/tickets/${TID} -H "Authorization: Bearer ${TOKEN}" | python3 -m json.tool

Browse to http://<vm-ip>/. Catalyst redirects to the /ui/ console. Sign in with the email and password from /root/catalyst-credentials.txt.

The dashboard summarizes open tickets by type, tickets per week and your assigned work at a glance:

The Incidents view lists every open incident with its age and owner. Alerts, Incidents and Vulnerabilities are separate ticket types, each with its own list:

Open a ticket to see its full workspace: description, severity, tasks, comments, a timeline, links and evidence files. It holds everything an analyst needs to run the investigation in one place:

Automations live under Reactions in the sidebar. Pair a trigger (webhook or collection hook) with an action (Python or outbound HTTP) to enrich or triage tickets without a human in the loop.

Component Path

Catalyst binary /usr/local/bin/catalyst

Data dir (SQLite + uploads) /var/lib/catalyst/catalyst_data

Environment file /etc/catalyst/catalyst.env

systemd unit /etc/systemd/system/catalyst.service

Firstboot script /usr/local/sbin/catalyst-firstboot.sh

nginx site /etc/nginx/sites-available/sac-catalyst

Credentials /root/catalyst-credentials.txt (mode 0600)

Sentinel /var/lib/sac/data/catalyst-firstboot.done

/usr/local/bin/catalyst --version sudo ls -la /var/lib/catalyst/catalyst_data/
sudo systemctl is-enabled catalyst.service nginx.service catalyst-firstboot.service

sudo systemctl restart catalyst.service
sudo journalctl -u catalyst.service --no-pager -n 50
# Create an additional admin (username is derived from the email)
sudo bash -c 'cd /var/lib/catalyst && runuser -u catalyst -- /usr/local/bin/catalyst admin create analyst@example.com "$(openssl rand -hex 20)"'

• Rotate the admin password in the console (top-left account menu) or with catalyst admin set-password <email> <password>.
• Restrict the NSG so that port 80 reaches only trusted networks.
• Front Catalyst with TLS at a reverse proxy or Azure Application Gateway in production. The built-in listener is plain HTTP on loopback behind nginx.
• Add analyst accounts with the analyst group rather than sharing the admin login. Manage users and groups in the console.
• Back up /var/lib/catalyst/catalyst_data/ (the SQLite database and uploaded evidence) to Azure Blob storage.
• Patch the OS monthly with sudo apt-get update && sudo apt-get upgrade && sudo reboot.

Catalyst is licensed under AGPL-3.0. SecureAnyCloud provides commercial support for the image separately.

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Support hours: 24/7, 24h response SLA

Deploy on Azure

Launch Catalyst SOAR on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7. sales@secureanycloud.com

Deploy on Azure

Launch Catalyst SOAR on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

• On the product page in AWS Marketplace, choose Continue to Subscribe, accept the terms, then choose Continue to Configuration.
• Choose the region and the m5.large instance type (recommended), then choose Continue to Launch.
• Under Network settings, attach a security group that allows inbound TCP 22 (SSH) from your IP and TCP 443 (the web console) from the addresses that should reach the platform. Restrict both to your own CIDR rather than the whole internet, because an incident-response platform should not be world-open.
• Select your EC2 key pair and launch.

You can also launch the subscribed AMI directly. Replace the AMI ID, key name, security group and subnet with your own:

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids <sg-id> \
  --subnet-id <subnet-id> \
  --metadata-options "HttpTokens=required" \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=catalyst-soar}]'

Then connect over SSH as ubuntu, as shown in the table above.

SSH in as ubuntu and confirm that the core services are active:

systemctl is-active catalyst.service nginx.service

Both units report active. The application listens on loopback 127.0.0.1:8090 and is reached only through the nginx reverse proxy. From outside the instance, only 443 (HTTPS) is served, and 80 redirects to it:

sudo ss -tln | grep -E ':(443|8090) '

The embedded SQLite datastore lives on its own dedicated EBS volume, separate from the OS disk:

findmnt /var/lib/catalyst

The first boot of every instance generates a unique admin password and writes it to a root-only file, alongside the console URL:

sudo cat /root/catalyst-credentials.txt

The file (mode 0600 root:root) holds CATALYST_URL, CATALYST_ADMIN_EMAIL (admin@catalyst.local) and CATALYST_ADMIN_PASSWORD. None of these ship in the image. Every value is unique to this instance, so no two instances share a credential and there is no default login. Catalyst also generates fresh session, token and reset secrets in the database on first boot.

Open the console in your browser at https://<public-ip>/. The certificate is a per-instance self-signed certificate, so your browser warns you once. Accept it to continue. Then sign in with the email and password from the credentials file.

Catalyst organizes work as tickets of different types: alerts, incidents and vulnerabilities. Each ticket has its own severity, timeline and tasks. Use the sidebar to open the incident queue, where you can search and filter open or closed cases. Select New Ticket to raise one.

Open a case to work it. Set its status and assignee, edit the description, add tasks and attach evidence. This case view is the core of Catalyst incident-response case management.

Catalyst runs automations called reactions. It also exposes a full REST API, so you can create and update tickets from your existing tooling, such as a SIEM, EDR or scripts.

Every API request must carry a bearer token from POST /auth/local/login, and unauthenticated requests are refused. python3 and python3-venv are installed so that reaction Python actions run.

The image ships a per-instance self-signed certificate at /etc/ssl/certs/catalyst-selfsigned.crt with its key at /etc/ssl/private/catalyst-selfsigned.key. To use a certificate that your browsers trust, replace those two files with your own. For example, use a certificate from your internal CA, or from a public CA for a DNS name that points at the instance. Then reload nginx:

sudo systemctl reload nginx

Catalyst keeps everything under /var/lib/catalyst/catalyst_data (the SQLite database and evidence uploads) on the dedicated volume. To back up your cases, snapshot that EBS volume or copy the data directory:

sudo ls -la /var/lib/catalyst/catalyst_data