Start a conversation
HodhodHODHOD
RESPOND

Incident, case and response operations management

From incident
to coordinated response.

Every incident needs a clear path. Hodhod keeps triage, ownership, response time, actions and evidence in one case, from the first signal to the recorded outcome.

Start exploring your needsCompare editions
Structured workflowsClear ownershipIntelligence under human control
An incident’s journeyInteractive view · Sample data
Case 042In triage

Unusual access to a service

Source: monitoring alert · Sample environment

Current ownerTier-one analyst
SLA time remaining01:45
Next stepReview impact and set priority
Evidence attached to the case

Alert reference and asset information

Proposed priority recorded for expert review.

Select stages; case context stays with them.

FROM INCIDENT TO RESOLUTIONListen · Coordinate · Act

A closer look

Product brochure & demo

Download PDF

Product demo Hodhod

The story behind Hodhod

Information matters when it leads to action.

O hoopoe of the morning breeze, I send you to ShebaSee from where, and to where, I send you

Hafez, Ghazal 90 ↗

In the story of Solomon and the Queen of Sheba, the hoopoe returns with news from a distant land. It then carries Solomon’s letter and is asked to observe the response. Delivering a message is the start of a connection; its value lies in the response that opens the way to dialogue and decisions.

A signal is noticed. Information reaches the team. Between receiving it and finding an answer, there is an essential journey: understanding the issue, getting it to the right person, and staying with it until the outcome is clear. The hoopoe inspires this connection between information, action, and follow-through.

In Hodhod, every request and incident has a clear path: its information and evidence stay together, ownership and the next step are clear, and progress is tracked until the outcome is recorded. Messages stay in view as they move between people, and every response becomes a lesson for a better response next time.

Hear the news. Coordinate the response. Follow through to the outcome.The story of Solomon and the hoopoe; Surah An-Naml, verses 22–44 ↗

Hodhod at a glance

Response operations,
centered on one case.

Hodhod is Faraconesh’s request and incident management system. It unifies information, roles, SLAs, actions, evidence and case history in a traceable, auditable flow.

DeskOrganizational requests and casesCERTSpecialist security incident lifecycle+ IntelligenceIntelligent decision-support add-on

When do you need Hodhod?

Ownership

The case moves, but ownership of the next step is unclear.

Assignment, owner and next action are visible in the same case.

Time

The response deadline passes before the delay is noticed.

SLA status and stalled stages become operational insight.

Context

Evidence and decisions are scattered across messages and files.

Handling information and history stay with the case.

For response teams

CERT and CSIRT, SOCs, information security, network operations and organizational service teams in banks, operators, critical infrastructure and organizations with operational cases.

Response lifecycle

A clear path from the first signal to the final decision.

Handling is configured to the organization’s approved process. This cycle illustrates the main control points in incident management.

  1. 1

    Receive

    Register a request, incident or alert

  2. 2

    Triage

    Initial review and information completion

  3. 3

    Prioritization

    Appropriate category, severity and SLA

  4. 4

    Specialist investigation

    Assignment and evidence collection

  5. 5

    Action

    Playbook and response coordination

  6. 6

    Review

    Oversight or escalation when needed

  7. 7

    Resolve the incident

    Record and evaluate the outcome

  8. 8

    Close and learn

    Report and retain response experience

One case, all incident context

Every decision leaves a clear trail.

Conceptual view
  • EVENT
    Source event referenceAlert linked to the case
    Registered
  • LOG
    Access investigation evidenceSample service log reference
    Case attachment
  • NOTE
    Analyst noteDecision basis for the next action
    Reviewable

This case is fictional; access and fields are configured for your organizational process.

Key capabilities

Process control. Team coordination. Retained experience.

WORKFLOW

Workflows aligned to your organization

States, transitions, authorized roles and mandatory stage information are configured within the deployment scope.

Defined processes; controlled transitions
SLA & OWNER

Time and ownership at a glance

See the current owner, response time, stalled cases and delay risks to clarify the next step.

Assignment, follow-up and escalation
ACTION & PLAYBOOK

Repeatable actions

Actions are recorded with owners and results. In CERT, playbooks help organize the response.

From instructions to action outcomes
EVIDENCE & AUDIT

Decisions linked to evidence

Files, log references and technical notes remain alongside status changes and decisions so handling can be reconstructed.

Who, when and with which evidence
DASHBOARD & REPORT

Operational visibility for management

Case status, team performance, SLAs and time spent in stages become usable reports.

From one case to process bottlenecks
KNOWLEDGE

Experience that stays in the organization

Outcomes, effective actions and case reports are retained; Intelligence Pack adds knowledge and similar-incident retrieval.

Every response informs the next

Editions and add-on

Two operational paths. One shared core.

Desk handles general requests and cases; CERT supports specialist incident response. Intelligence Pack is available for both.

Intelligence PackOptional add-on for both editions: classification, summaries, knowledge and action suggestionsExplore the add-on

The right edition starts with your needs.

Selecting an edition highlights its details.

Comparison criterionHodhod DeskHodhod CERT
Primary needGeneral request and case managementSecurity incident response operations management
Operating teamService, IT and organizational operations teamsCERT, CSIRT, SOC and incident response teams
Starting pointA request, form or actionable caseA security incident, alert or investigation referral
WorkflowStates, roles and assignments aligned to organizational processesSpecialist incident lifecycle, severity, oversight and escalation
Action and handlingRecord and track actions, owners and resultsResponse actions, playbooks and specialist investigation coordination
Records and evidenceCase records, attachments and activity historyDecision-linked evidence and an auditable timeline
OutputA handled request and process performance reportA managed incident, post-incident report and lessons learned

Hodhod Desk

Primary need
General request and case management
Operating team
Service, IT and organizational operations teams
Starting point
A request, form or actionable case
Workflow
States, roles and assignments aligned to organizational processes
Action and handling
Record and track actions, owners and results
Records and evidence
Case records, attachments and activity history
Output
A handled request and process performance report

Intelligence alongside the expert

Knowledge suggests.
The expert decides.

Intelligence Pack turns authorized organizational history and knowledge into daily support, reducing reading and helping find relevant context and prepare decisions.

Understand cases faster
Incident and history summaries for shift handovers and management reports.
Find relevant experience
Retrieve similar incidents, documents and usable knowledge.
Reviewable recommendations
Suggested classification and actions with context for expert assessment.
A ready starting point for reports
Draft reports from information already recorded in the case.
Human control

Suggestions can be approved, edited or rejected. Sensitive decisions and final actions remain with authorized users.

INTELLIGENCE PACKInteractive view · Sample suggestion
Case input description

“Access outside the usual pattern has been reported for a service. The reason and impact remain unclear; specialist investigation is required.”

Intelligent suggestionRequires expert review
Suggested categoryUnusual access
Additional informationAccess permissions and impact scope
Suggested action

Compare the service access report against approved permissions and record the findings in the case.

Suggestion context

Case description + sample access review guide

Sensitive decisions and actions require an authorized user’s approval.

Hodhod in practice

Manage incidents through to the outcome.

DETECT → RESPOND

From alert to handling

A detection alert becomes a case with triage, ownership, SLA and action.

Track the incident through to a recorded outcomeAlongside Shahbaz
SHIFT HANDOVER

Shift handover with context intact

The next analyst sees the timeline, actions and decisions; the intelligent add-on can prepare a handover summary.

Continue handling with a clear history
CSIRT REVIEW

Investigation across teams

Specialists, service owners and reviewers collaborate in one case; comments, assignments and action outcomes are recorded.

Shared decisions and traceable ownership
HODHOD DESK

Everyday organizational requests

Track requests from registration to response using forms, roles, workflows and SLAs aligned to your processes.

A case with a clear owner and next step

Deployment and integration

Your environment, your process.

Hodhod deploys independently in organizational infrastructure or a private environment. Forms, workflows, roles and reports are configured to local operational needs.

ON-PREMISES / PRIVATE

One core, multiple operational profiles.

Environment differences can shape processes and access levels; the product edition follows the type of problem.

To get started
Current processes, roles, SLAs, input sources and a sample case.
For integration
Destination system, data exchange scope and a suitable API or connector.

Aligned with IT services and assets

Forms, categories, workflows and roles are configured for requests and incidents involving IT users, services and systems.

IT and OM are operational profiles; the edition choice is between Desk and CERT.

Between detection and action

Connected to the tools your team uses.

Integration with SIEM, detection systems, Jira, knowledge sources and other tools uses APIs and connectors suited to the organizational architecture.

Alert or requestHodhodCase · Owner · ActionOperational team or tool
ShahbazFrom detection to responseSimurghFrom experience to knowledgeShabdizProtect case dataHomaAssess and improve response maturity

Integrations are complementary; each connector’s scope and readiness are determined during project review.

Before choosing

Frequently asked questions

Automatic playback · Paused

No. Hodhod Desk manages general requests and cases. Hodhod CERT provides a specialist security incident lifecycle for CERT, CSIRT, SOC and response teams.

Next step

Start responding with a clear path.

Let’s review your challenge, current process and team needs to choose Desk or CERT and define the intelligent add-on’s scope.

Start exploring your needsTalk to the Faraconesh team