A notebook for the next useful question.

CaseNote helps a junior analyst turn a few records into a readable investigation handoff.

It covers three bounded scenarios: suspicious sign-ins, suspicious PowerShell and unexpected AI tool actions. Each provides starting questions, evidence entries, a timeline, explicit uncertainty and a handoff export. It is free to use in a browser.

What it does.

The application organizes analyst-entered observations. It sorts valid UTC timestamps, preserves unknown times, exposes incomplete checks and exports Markdown or JSON. An optional AI-review prompt uses a separate, manually prepared summary and exact-preview approval.

What it cannot establish.

It does not access your SIEM, endpoint, identity provider or AI system. It does not fetch indicators, run commands, scan files, reproduce activity or return a verdict. It is not an evidence vault or a replacement for incident procedures.

Forty evidence entries and three scenario checklists keep this worksheet bounded. Larger investigations belong in an approved case-management system. No field-completion percentage is interpreted as safety or confidence.

Publication and review.

CaseNote is published by BenchSprout. The current guidance was reviewed October 31, 2026 against the listed primary references. Examples are synthetic. No vendor affiliation, expert certification, user validation or business outcome is claimed.

Open the worksheet or start with a field guide.

A working view of exported evidence

The home page parses CSV, JSON and JSONL events, orders supported timestamps, filters exact entities and exports a reproducible selection. The separate worksheet supports analyst-written handoffs. Neither creates an incident verdict or verifies source completeness.