Skip to content
COEUS
Install

From extension to account

A dated account-and-cases design from before Coeus adopted its current tools-first direction.

7 min readCoeus — Maintainersaccountcases

Update, 6 November 2026. Coeus no longer has accounts; everything it keeps is stored in your browser.

Update, September 2026. The investigation views this post describes were removed before release. Coeus now focuses on free security tools and optional account sync. There is no paid plan or case product coming. What follows is preserved as a record of the earlier plan.

The extension is complete on its own, and that is not a disclaimer. Lookup, extract, verdicts and the page scan all work with no account, no server and no network call the user did not ask for. Most days that is the whole tool.

The workspace exists for the parts a single browser genuinely cannot do: keeping an investigation somewhere a colleague can read it, publishing a pack without running a web server, and seeing what you looked up on the laptop while you are on the desktop. This is what it adds, and — more usefully — what it deliberately does not.

Cases

A case is a title, a summary, a status (open, monitoring, closed), a severity, some tags, and three lists: indicators, notes, and a timeline.

Indicators go in by paste. The same detectAll that runs in the extension runs here, so a block of text becomes typed, de-duplicated, refanged rows, each with a defang toggle, an optional per-row note, and a verdict column. Notes are markdown with a preview and

⌘ Enter to save. The timeline records what happened and who did it — created, status changed, severity changed, indicator added or removed, note written, verdict attached, export taken — which is the part that matters three weeks later when someone asks why the case was closed.

Export is four buttons: CSV, JSON, a Markdown report, and a STIX 2.1 bundle. The bundle maps each indicator to an indicator SDO with a real STIX pattern for its type — ipv4-addr, domain-name, url, email-addr, file:hashes for the three digest lengths, vulnerability for a CVE, autonomous-system for an ASN — so it lands in a TIP without a transformation step.

{
  "type": "bundle",
  "id": "bundle--…",
  "objects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "pattern_type": "stix",
      "pattern": "[ipv4-addr:value = '185.220.101.4']",
      "valid_from": "2026-09-01T09:12:00.000Z"
    }
  ]
}

The pack hub

Everything in build a source pack your whole SOC can subscribe to assumes you can host a JSON file somewhere your team can reach. Plenty of teams cannot, or can but would rather not own another service.

The workspace's pack editor is two panes: a form with a row per source (id, name, description, tags, auth, and a template per type or group, validated live against the pack schema) and a JSON view you can edit directly with errors shown inline. Both are the same document. A "Try it" input renders any template against a value you type, using the same renderer the extension uses, so a broken placeholder is visible before anyone subscribes.

Publishing sets a visibility — private, unlisted or public — and produces a URL at /p/<slug>.json, served with an ETag so a refresh that changes nothing costs one 304. Copy the URL into a chat channel and that is the onboarding done.

Signing in on a browser

The workspace never holds a provider key. When it needs enrichment it asks your extension, which does the work locally.

That requires the two halves to know each other. "Sign in on this browser" is what the button says; underneath it is a per-browser token, and these are its four steps:

Say hello

/app/devices → Sign in on this browser. The page sends a coeus.hello message to the extension over Chrome's externally_connectable channel, which the extension's manifest opens to the workspace origin and nothing else. No extension, nothing to sign in — the button explains that instead of failing.

Mint a token

The workspace creates a device row and a random 32-byte token. The token is returned to the page exactly once; only its SHA-256 hash is stored, so a database dump does not yield working credentials.

Hand it over

The page sends coeus.pair with the token, the API base, the browser's name and the account it belongs to — your email and the workspace name, so the extension can say who it is signed in as. The extension stores it and opens its own dashboard at Settings.

Approve the origin, in the extension

You click Allow sync. The extension requests the host permission for the workspace origin — a prompt from Chrome, in the extension, requiring your gesture. This step cannot be done from the web page, by design.

After that, the top bar's status pill reads Signed in and the workspace can ask the extension to open a tab group, enrich a list of values, push a pack into "My sources", or offer a subscription. Each of those is a named message with a fixed shape; the extension ignores anything from an origin that is not the configured workspace.

What comes back from coeus.enrich is summaries — a level and one sentence per provider — never raw provider bodies. The workspace stores the summary and not the response.

What syncs

Sync is per record, and the rule is deliberately simple: for a source by id, a subscription by id, or a setting by key, the newer updatedAt wins. History is append-only and de-duplicated by value and timestamp.

Three things never travel:

  • Provider keys. Not in the snapshot, not in the schema, not in any route.
  • Sources marked localOnly. They are dropped on the way out and on the way in, so a colleague's internal hostname cannot arrive on your machine either.
  • Deletions. The merge rule has no tombstones, so removing a source in one place does not remove it everywhere. That is a real limitation rather than a bug: removing something everywhere is a deliberate act per device. It is written down in the sync doc so nobody has to discover it.

Signing out works from both ends. In the extension, Settings → Sync → Sign out clears the stored token. In the workspace, Devices → Sign out revokes the row, and the stored hash with it, so the token stops working even if the extension never checks in again.

What lives where

When not to sign in

If you work alone, on one machine, and nobody needs to read your case notes, there is nothing here for you. The extension will not nag: there is no account prompt, no upgrade banner, and no feature that quietly requires a login.

The honest test is whether an investigation has a second reader. If it does, a case with a timeline beats a text file. If it does not, the side panel already told you what you needed to know.