Skip to content
SPECIFICTION
Get listed

DFIRe

dfire.fi

From €825/mo Free plan WebLinuxAPISelf-hosted
Visit dfire.fi
Spec score 8.9 #4 of 177 in Case Management Software

What it is

DFIRe is self-hosted case management software for digital forensics and incident response. Teams can configure case types, severity, assignments, and escalation from triage to incident response while keeping case history. Evidence records can be organized hierarchically with configurable attributes, custody verification, printable receipts, and transfer records. The software includes default playbooks for fifteen common case types, which users can adapt or replace, plus timers and reminders for breach notifications, statutory reporting, and other deadlines. Its IOC registry supports STIX 2.1 types, enrichment from named threat intelligence providers, and sharing through MISP and TAXII. Documented integrations include Slack, bidirectional Jira synchronization, webhooks, and SIEM or log forwarding. Reports support structured sections, QA, evidence inventories, and optional LLM drafting through a customer-selected provider. Security documentation describes OIDC sign-on, role-based access, encrypted attachments, and an immutable audit trail. DFIRe supports air-gapped use and offline licensing. The annual licence is €9,900 a year for unlimited users and cases in one production deployment; a 90-day trial is available.

Spec sheet

Product
DFIRe is self-hosted case management software for digital forensics and incident response.Read 7 Oct 2026 · dfire.fi
Deployment
Installation uses a release-pinned Docker Compose bundle and supports manual or air-gapped deployment.Read 15 Oct 2026 · dfire.fi
Free plan
YesRead 19 Sep 2026 · dfire.fi
API
DFIRe provides a REST API with per-user API keys, service accounts, interactive ReDoc documentation and a downloadable OpenAPI 3 schema.Read 15 Oct 2026 · dfire.fi
Integrations
Native integrations include Slack case workflows, two-way Jira Cloud synchronization, outgoing webhooks and SIEM/SOAR forwarding.Read 15 Oct 2026 · dfire.fi
Compliance
Users can define compliance timers and reminders for breach notifications, statutory reporting, and other deadlines such as SLAs.Read 7 Oct 2026 · dfire.fi
Support
Documentation covers deployment, configuration, cases, evidence, SSO, backups, integrations, security and changelog topics; additional help is offered by email.Read 15 Oct 2026 · dfire.fi
Headquarters
Vantaa, FinlandRead 28 Sep 2026 · dfire.fi
Audit logging
The audit trail is append-only and fail-closed, so an operation does not complete when its audit record cannot be written.Read 15 Oct 2026 · dfire.fi
Case workflow
Cases combine actions, notes, files, evidence, indicators and reports, with investigations escalatable into incidents.Read 15 Oct 2026 · dfire.fi
Case workflows
The product supports custom case types, severities, assignments, and escalation from triage to incident response without losing history.Read 7 Oct 2026 · dfire.fi
Changelog news
Version 1.12.1, released October 8, 2026, added a redesigned website, documentation search and clarified license-server data reporting.Read 15 Oct 2026 · dfire.fi
Compliance timers
Cases can track deadlines for GDPR, NIS2, DORA, HIPAA, SEC and custom rules with reminders.Read 15 Oct 2026 · dfire.fi
Custody hashing
Each custody entry uses SHA-256 chaining, and failed verification stops further transfers for that item.Read 15 Oct 2026 · dfire.fi
Database requirement
Production deployments require PostgreSQL 16 or later managed by the customer or its provider.Read 15 Oct 2026 · dfire.fi
Enrichment providers
Official examples include VirusTotal, AbuseIPDB, Shodan, GreyNoise, MISP, urlscan and Spur.us, using customer API keys.Read 15 Oct 2026 · dfire.fi
Evidence custody
Evidence records include ownership, storage, custodians, runbooks, encrypted files and a verifiable chain of custody.Read 15 Oct 2026 · dfire.fi
Indicators
The indicator registry supports STIX 2.1 types, enrichment, cross-case correlation and sharing through TAXII 2.1 or MISP-compatible feeds.Read 15 Oct 2026 · dfire.fi
Infrastructure responsibility
Customers are responsible for securing their database, file storage, network, server infrastructure, and backups; case data is stored in plaintext in the database for performance and full-text search.Read 7 Oct 2026 · dfire.fi
Licence limits
The annual licence covers unlimited users and cases but applies to a single production deployment.Read 7 Oct 2026 · dfire.fi
Licence ownership
DFIRe software is proprietary and owned by Finnish limited-liability company DFIRe Oy; only third-party dependencies are open source.Read 15 Oct 2026 · dfire.fi
Limit: incoming webhooks
Incoming webhooks were deprecated, so systems creating cases must use API keys with the REST API or import endpoint.Read 15 Oct 2026 · medium.com
Limit: infrastructure responsibility
Customers remain responsible for securing PostgreSQL, storage, networks, servers, backups and regulatory compliance.Read 15 Oct 2026 · dfire.fi
Limit: support SLA
The EULA states that technical support is best effort and provides no service-level agreement or guaranteed response time.Read 15 Oct 2026 · dfire.fi
Limit: template updates
The independent review notes that edits to global playbooks do not automatically change existing case snapshots, requiring manual edits or a playbook swap.Read 15 Oct 2026 · medium.com
LLM providers
AI integration supports OpenAI, Anthropic, Google Gemini, Gemini Enterprise Agent Platform, Azure OpenAI and GitHub Models.Read 15 Oct 2026 · dfire.fi
Maker headquarters
The company’s registered office is in Vantaa, Finland.Read 15 Oct 2026 · dfire.fi
Maker legal name
The maker is DFIRe Oy, Finnish VAT ID FI36221438.Read 15 Oct 2026 · dfire.fi
MCP extensibility
The built-in MCP server exposes 63 tools in 11 groups, enforces the caller's RBAC permissions and logs agent activity.Read 15 Oct 2026 · dfire.fi
Offline use
DFIRe supports air-gapped deployments and offline licensing for networks without internet access.Read 7 Oct 2026 · dfire.fi
Playbooks
DFIRe supplies default playbooks and lets administrators edit them or create their own runbooks.Read 15 Oct 2026 · dfire.fi
Praise: forensic integrity
The reviewer highlighted snapshot-based playbooks and runbooks that preserve the procedure used when a case was created.Read 15 Oct 2026 · medium.com
Praise: installation
The reviewer reported successful installation testing on Ubuntu, Debian and Parrot OS without encountering issues.Read 15 Oct 2026 · medium.com
Praise: integrations
The reviewer credited the REST API, MCP tools, outgoing webhooks and native Slack workflow as a broad automation surface.Read 15 Oct 2026 · medium.com
Praise: workflow design
An independent hands-on reviewer praised the explicit separation between high-level actions and reusable technical runbooks.Read 15 Oct 2026 · medium.com
Product purpose
DFIRe is a self-hosted case-management platform for digital forensics and incident response.Read 15 Oct 2026 · dfire.fi
Reports
Reports can generate title pages, timelines, indicator lists and evidence inventories from the case record, with optional LLM drafting.Read 15 Oct 2026 · dfire.fi
Reports and AI
Reports support structured sections, a QA workflow, generated evidence inventories, and optional LLM drafting using a provider chosen by the user.Read 7 Oct 2026 · dfire.fi
Requirements
The documented deployment requires Docker Engine 24.0 or later, Compose 2.24.4 or later, and PostgreSQL 16 or later for production.Read 7 Oct 2026 · dfire.fi
Security controls
The security documentation describes OIDC single sign-on, two-tier role-based access control, AES-256-GCM attachment encryption, and an immutable fail-closed audit trail.Read 7 Oct 2026 · dfire.fi
Security encryption
Attachments use AES-256-GCM with tenant, case or item and per-file key layers, while credentials use separate Fernet encryption.Read 15 Oct 2026 · dfire.fi
SSO
OIDC templates cover Google Workspace, Microsoft Entra ID, Okta and custom providers, with domain and group-claim gates.Read 15 Oct 2026 · dfire.fi
Supply-chain security
Releases pin dependencies, apply a 14-day adoption delay and publish checksums, SBOMs and build provenance.Read 15 Oct 2026 · dfire.fi
System requirements
Evaluation planning guidance is 2 vCPU, 4 GB RAM and 20 GB SSD; production guidance is 8 vCPU, 16 GB RAM and 100 GB SSD plus evidence and backup storage.Read 15 Oct 2026 · dfire.fi
Threat intelligence
The IOC registry supports STIX 2.1 types, enrichment from named threat intelligence providers, and sharing through MISP and TAXII.Read 7 Oct 2026 · dfire.fi

Plans and prices

Annual licence €9,900 a year annual; VAT 0% unlimited users and cases · one production installation · offline conversion · 90-day trial Read 15 Oct 2026 · dfire.fi
Non-commercial Free case by case individual, student, educational, charity and community non-commercial use · all features Read 15 Oct 2026 · dfire.fi
Small teams Priced on request custom same deployment model and features · unlimited cases Read 15 Oct 2026 · dfire.fi

Every DFIRe plan and price →

Strong points and limits

Strong points

  • Supports air-gapped deployments and offline licensing.
  • Evidence custody includes verifiable records and transfer history.
  • Includes playbooks for fifteen common case types.
  • IOC registry supports STIX 2.1, MISP, and TAXII.
  • Annual licence covers unlimited users and cases.

Limits

  • Annual licence applies to one production deployment.
  • Customers secure databases, storage, network, servers, and backups.
  • Case data is stored in plaintext in the database.
  • Supported deployment is Docker Compose on a Linux host.

Who it suits

It suits digital forensics and incident response teams that need self-hosted case workflows, evidence custody, and air-gapped deployment. Customers must be prepared to secure and maintain the underlying infrastructure.

DFIRe in depth

Read the full write-up

Overview

DFIRe combines digital-forensics case management with incident-response workflows in a self-hosted system. It is best suited to organizations that need structured investigations and evidence custody under their own infrastructure. Its specialist controls are substantial, but they come with real operating responsibilities and a licence tied to one production deployment.

Key features

Teams can configure case types, severity, assignments, and escalation from triage to incident response while preserving case history. Fifteen default playbooks give common case types a starting process, and teams can adapt or replace them. That flexibility is useful for organizations with established procedures; it also means teams must decide how those procedures should work.

Evidence is arranged hierarchically, with configurable attributes, verifiable custody records, printable receipts, and transfer records. This makes DFIRe a more focused option than a general task tracker when documenting evidence handling is part of the investigation.

Compliance timers and reminders can cover breach notifications, statutory reporting, and SLAs. The IOC registry supports STIX 2.1 types, enrichment from named threat-intelligence providers, and sharing through MISP and TAXII. Slack collaboration, bidirectional Jira synchronization, webhooks, and SIEM or log-forwarding integrations connect case work to adjacent tools.

Reports use structured sections and a QA workflow, and can include generated evidence inventories. Optional LLM drafting uses a provider selected by the customer, giving teams a choice of provider rather than a fixed one. Security controls include OIDC single sign-on, two-tier role-based access control, AES-256-GCM encryption for attachments, and an immutable, fail-closed audit trail.

That security model does not remove infrastructure duties: customers secure the database, file storage, network, server, and backups. Case data remains plaintext in the database for performance and full-text search, a consequential consideration for organizations setting their own data protections.

Pricing

DFIRe offers a free plan and a 90-day trial. The Non-commercial plan is granted case by case to individuals, students, educational organizations, charities, and communities, with all features included. It suits eligible non-commercial users, but case-by-case approval makes it unsuitable as a predictable commercial purchasing route.

The Annual licence costs €9,900 per year, billed at 9,900 EUR / year, with VAT at 0% and added under EU rules. It includes unlimited users and cases for a single production deployment, can be converted to an offline licence, and starts with a 90-day trial. Unlimited users and cases remove per-seat and case-count constraints, but the single-deployment limit matters to organizations planning multiple production instances.

Small teams have custom pricing for small organisations, with the same deployment model and features and unlimited cases. It is worth enquiring about for a smaller organization, though custom pricing means the cost cannot be compared from a published amount. No seat or case cap is given for this plan.

Platforms

DFIRe supports API, Linux, self-hosted, and web access. Its supported deployment is Docker Compose on a Linux host; other container platforms are not supported deployment models. Production deployment requires Docker Engine 24.0 or later, Compose 2.24.4 or later, and PostgreSQL 16 or later. Air-gapped operation and offline licensing support networks without internet access, but the organization must still provide and secure the underlying infrastructure.

Who it's for

DFIRe is a strong fit for forensic and incident-response teams that need documented evidence custody, configurable investigation workflows, and control over deployment, including teams working offline. It is a poor fit for organizations that want a hosted service, cannot take responsibility for securing and maintaining the stack, or need the licence to cover multiple production deployments.

Pros and cons

Pros: Verifiable custody records, receipts, and transfer records support accountable evidence handling.

Pros: Configurable case workflows and replaceable playbooks let teams shape processes around their own response practices.

Pros: Offline licensing and air-gapped deployment support isolated environments.

Cons: Customers must secure and operate the database, storage, network, server, and backups; case data is plaintext in the database.

Cons: The €9,900 annual licence covers one production deployment, a substantial constraint for organizations that need multiple instances.

Cons: Docker Compose on Linux is the supported deployment path, limiting teams standardized on other container platforms.

Alternatives

For a broader comparison, see Incident Response Software, Incident Management Software, and Case Management Software.

Choose LimaCharlie if endpoint coverage matters and a free tier for up to two endpoints is a better starting point. Binalyze AIR is another paid option with a free trial.

Forensicator is a free, open-source cross-platform incident response toolkit, a sensible alternative for teams seeking a no-cost toolkit rather than DFIRe's case-management system. Belkasoft X Forensic may suit government customers seeking a perpetual licence with optional annual maintenance and support.

DFIR-IRIS and GRR Rapid Response are free, self-hosted alternatives for teams prioritizing no licence fee. Forendi is a threat-intelligence feed at $199 a month, better suited when sourced and scored indicators, with TAXII, MISP, and REST, are the need. ORNA offers a self-managed free plan or a managed option at custom pricing for teams considering those deployment choices.

Verdict

Choose DFIRe if your organization needs auditable evidence handling, adaptable incident workflows, and offline self-hosting, and can take responsibility for the infrastructure. Its depth is the reason to buy; the €9,900 annual price and single-production-deployment limit are the reasons to look elsewhere if you need a lower-cost or multi-instance route.

Verdict

DFIRe provides detailed incident workflows and evidence handling for organizations able to operate self-hosted software. Infrastructure responsibilities and the single-deployment licence are important constraints to weigh.

Where Specifiction places it

Alternatives to DFIReAll alternatives →