Skip to content
SPECIFICTION
Get listed

DFIR-IRIS

dfir-iris.org

Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit dfir-iris.org
Spec score 8.8 #8 of 177 in Case Management Software

What it is

DFIR-IRIS is an open-source incident response platform for teams conducting investigations in a shared workspace. Case records organize assets, indicators of compromise, tasks, evidence and notes with an audit trail. Alerts from SIEM, EDR, MISP, IntelOwl or REST endpoints can be collected, triaged and promoted into cases. Evidence can be checked with SHA-256, MD5 or SHA-1, while access restrictions and logs cover downloads, views and changes. War rooms provide real-time chat, threads, room-specific teams and slash commands that record decisions and case actions. Configurable Jinja templates generate PDF or DOCX executive summaries, technical reports or court-ready documents. The project lists modules including IrisVT, IrisMISP, IrisCheck and IrisWebHooks, along with a REST API and 162 hook binding points. Permissions include deny-all, read-only and full-access case controls. Docker and Docker Compose are recommended; Linux and macOS are officially supported, while Windows may need Dockerfile changes for file storage paths. Documentation identifies v3.0.0-beta.1 as the current v3 release and says beta versions are not production-ready. The project advises restricting access and not exposing IRIS to the Internet.

Spec sheet

Purpose
DFIR-IRIS is an open-source incident response platform for running investigations collaboratively in one workspace.Read 5 Oct 2026 · dfir-iris.org
Product
DFIR-IRIS is a collaborative incident-response platform for cases, timelines, evidence and war rooms.Read 15 Oct 2026 · dfir-iris.org
Deployment
The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths.Read 5 Oct 2026 · docs.dfir-iris.org
Free plan
YesRead 19 Sep 2026 · dfir-iris.org
Integrations
First-party modules include IrisVT for VirusTotal, IrisMISP for MISP, IrisCheck for validations and IrisWebHooks for URL destinations.Read 15 Oct 2026 · dfir-iris.org
Support
The project lists getting-started help, support and implementation, and training, with details available by contacting [email protected].Read 5 Oct 2026 · docs.dfir-iris.org
Founded
2019Read 23 Sep 2026 · dfir-iris.org
Access control
IRIS provides RBAC permissions plus case-level ACLs for users, groups and customers, with deny-all defaults from v2.4.0.Read 15 Oct 2026 · docs.dfir-iris.org
Alert ingestion
The platform accepts alerts from SIEM, EDR, MISP, IntelOwl and arbitrary REST endpoints.Read 15 Oct 2026 · dfir-iris.org
Alert triage
Related alerts can be clustered, deduplicated, merged, split and promoted into cases.Read 15 Oct 2026 · dfir-iris.org
API authentication
Each user receives an API key used as a Bearer token; renewing a key revokes the previous token.Read 15 Oct 2026 · docs.dfir-iris.org
API versioning
Documentation maps IRIS releases through v2.4.x to corresponding API versions and identifies a separate develop API.Read 15 Oct 2026 · docs.dfir-iris.org
Case management
Cases contain assets, IOCs, tasks, evidence and notes with severity, ownership, status and audit history.Read 15 Oct 2026 · dfir-iris.org
Collaboration
War rooms provide real-time chat, threads, per-room teams and slash commands that record decisions and case actions.Read 5 Oct 2026 · dfir-iris.org
Community funding
OpenCollective reports total raised of $13,201.06 USD, total disbursed of $44.71 USD and an estimated annual budget of $4,870 USD at the time viewed.Read 15 Oct 2026 · opencollective.com
Company origin
The project began inside Airbus CyberSecurity's commercial CSIRT in France in 2019 and was released publicly in December 2021 with Airbus support.Read 15 Oct 2026 · blog.dfir-iris.org
Deployment components
The v3 stack uses backend, worker, frontend, PostgreSQL, RabbitMQ and nginx services.Read 15 Oct 2026 · docs.dfir-iris.org
Documentation
The documentation covers operations, modules, reports, upgrades, API reference, Python client and development topics.Read 15 Oct 2026 · docs.dfir-iris.org
Evidence
Evidence can be verified with SHA-256, MD5 or SHA-1, with access restrictions and logged downloads, views and changes.Read 5 Oct 2026 · dfir-iris.org
Evidence handling
Evidence is hashed, tagged, access-controlled and logged, with SHA-256, MD5 and SHA-1 verification options.Read 15 Oct 2026 · dfir-iris.org
Extensibility
Python modules can attach logic to 162 hook points such as case creation, IOC addition and evidence upload.Read 15 Oct 2026 · dfir-iris.org
Independent limit: scope
Darkroast Protocol positions IRIS as an investigative case record rather than a SOAR or automated playbook engine.Read 15 Oct 2026 · darkroastprotocol.com
Independent praise: deployment
Darkroast Protocol describes Docker Compose deployment as suitable for on-premises or private-cloud regulated environments.Read 15 Oct 2026 · darkroastprotocol.com
Independent praise: MISP
Darkroast Protocol reports that the MISP integration supports bidirectional IOC exchange between IRIS cases and MISP events.Read 15 Oct 2026 · darkroastprotocol.com
Independent praise: workflow fit
Darkroast Protocol praises IRIS for modeling cases, assets, IOCs, timelines, evidence, notes and tasks around real DFIR work.Read 15 Oct 2026 · darkroastprotocol.com
Integration: Sumo Logic
Sumo Logic's integration exposes actions for creating and updating cases, adding assets, IOCs, notes and timeline events, and escalating alerts.Read 15 Oct 2026 · sumologic.com
Licence
The project is open source under the LGPL-3.0 licence.Read 15 Oct 2026 · dfir-iris.org
Limit: custom-field search
The Q&A says custom attributes cannot currently be searched server-side.Read 15 Oct 2026 · docs.dfir-iris.org
Limit: deleted data
Deleted cases and case objects cannot be recovered unless database backups exist.Read 15 Oct 2026 · docs.dfir-iris.org
Limit: internet exposure
The project's Q&A warns administrators not to expose IRIS directly to the internet and recommends a restricted network.Read 15 Oct 2026 · docs.dfir-iris.org
Limit: v3 migration
The documented v3 upgrade cannot be performed in place, and v2.4 integrations and legacy endpoints stop working.Read 15 Oct 2026 · docs.dfir-iris.org
Maker location
The verified GitHub organisation lists France as its location and describes the project as initiated by Airbus Cybersecurity in 2019.Read 15 Oct 2026 · github.com
Marketplace listing
Microsoft Marketplace lists DFIR-IRIS 2.4.29 as an open-source, self-hosted platform deployable on Ubuntu with Docker.Read 15 Oct 2026 · marketplace.microsoft.com
Operating-system support
Linux and macOS are officially supported; Windows may need Dockerfile changes for file-storage paths.Read 15 Oct 2026 · docs.dfir-iris.org
Organization history
The project says the idea originated within Airbus Cybersecurity’s commercial CSIRT in France in 2019 and was released as open source in December 2021 with Airbus CyberSecurity’s agreement and support.Read 5 Oct 2026 · blog.dfir-iris.org
Python SDK
The project publishes a Python client for automating interactions with the IRIS API.Read 15 Oct 2026 · docs.dfir-iris.org
Release status
The documentation identifies v3.0.0-beta.1 as the current v3 release and says beta versions are not production-ready.Read 5 Oct 2026 · docs.dfir-iris.org
Reporting
Jinja templates can generate configurable executive, technical or court reports in PDF or DOCX.Read 15 Oct 2026 · dfir-iris.org
Reports
Configurable Jinja templates can produce PDF or DOCX executive summaries, technical reports or court-ready documents.Read 5 Oct 2026 · dfir-iris.org
REST API
The REST API mirrors almost all web-interface operations and runs on the web server's HTTPS port, 443 by default.Read 15 Oct 2026 · docs.dfir-iris.org
Security configuration
Production setup requires changing database passwords, Flask secret values and password salts; default self-signed certificates are testing-only.Read 15 Oct 2026 · docs.dfir-iris.org
Security guidance
The project advises that IRIS should only be accessible in a restricted environment and says not to expose it on the Internet.Read 5 Oct 2026 · docs.dfir-iris.org
Self-hosting
IRIS is deployed on an organisation's own infrastructure with Docker and Docker Compose.Read 15 Oct 2026 · docs.dfir-iris.org
System requirements
The documented typical installation for 20 users, about 200 daily alerts and 12 active cases uses 4 CPU cores, 16 GB RAM and 1 TB fast SSD.Read 15 Oct 2026 · docs.dfir-iris.org
Timelines
Cases support multiple filtered timelines and importing events from CSV, SIEM queries or war-room commands.Read 15 Oct 2026 · dfir-iris.org
War rooms
War rooms provide real-time threaded chat, per-room teams, slash commands and case-linked attachments.Read 15 Oct 2026 · dfir-iris.org

Plans and prices

Free and open-source Free No licence fee · self-hosted deployment Read 5 Oct 2026 · dfir-iris.org
Open-source self-hosted Free No licence fee stated Deploy on your own infrastructure · Docker deployment · Hosted demo available Read 15 Oct 2026 · dfir-iris.org

Every DFIR-IRIS plan and price →

Strong points and limits

Strong points

  • Case records include evidence and an audit trail
  • Alerts can be triaged and promoted into cases
  • Evidence checks support three hash algorithms
  • War rooms record decisions and case actions

Limits

  • The current v3 release is identified as beta
  • Windows may need Dockerfile changes for file storage paths
  • The project says not to expose it on the Internet

Who it suits

DFIR-IRIS suits incident response teams that need shared case records, alert triage and collaborative investigation tools. Teams should account for deployment and access restrictions, especially on Windows or when using the beta release.

Verdict

DFIR-IRIS brings case management, alert triage, evidence handling and team collaboration into one self-hosted platform. Its beta status and restricted-access guidance should shape deployment decisions.

Where Specifiction places it

Alternatives to DFIR-IRISAll alternatives →