FIR (Fast Incident Response)

Spec sheet

Purpose

FIR is a cybersecurity incident management platform for creating, tracking, and reporting incidents.Read 4 Oct 2026 · github.com

Intended users

The project says FIR is for teams that track cybersecurity incidents, including CSIRTs, CERTs, and SOCs.Read 4 Oct 2026 · github.com

Deployment

FIR can be run with Docker for testing or occasional use, or installed in a production environment for daily use.Read 4 Oct 2026 · github.com

Integrations

The repository includes optional plugins for MISP, LDAP, OIDC, two-factor authentication, and an API.Read 4 Oct 2026 · github.com

License

The public repository identifies its license as GPL-3.0.Read 4 Oct 2026 · github.com

Artifacts

FIR extracts artifacts such as IP addresses, hostnames, URLs, email addresses, and hashes, and displays correlated artifacts from other incidents.Read 4 Oct 2026 · github.com

Custom attributes

Teams can define numeric incident attributes such as financial loss, stolen credential counts, or downtime and use them for statistics.Read 4 Oct 2026 · github.com

Deployment requirements

The README says FIR can run smoothly on an Ubuntu virtual machine with 1 core, 40 GB disk, and 1 GB RAM.Read 4 Oct 2026 · github.com

Incident fields

Incidents can include category, status, detection method, severity from 1 to 4, date and time, description, and TLP confidentiality.Read 4 Oct 2026 · github.com

Incident workflow

Users can add comments, files, attributes, todos, or nuggets and change an event's status to open, blocked, or closed.Read 4 Oct 2026 · github.com

Reporting

The incident follow-up action opens a one-page report intended to be printed as a PDF for business lines.Read 4 Oct 2026 · github.com

Technical stack

FIR is written in Python with Django and Bootstrap, and the README describes MySQL while allowing other Django-compatible database adapters.Read 4 Oct 2026 · github.com

Templates

Incident templates can prefill incident creation fields, and the project documentation says none are defined by default.Read 4 Oct 2026 · github.com

Plans and prices

Every FIR (Fast Incident Response) plan and price →

Where Specifiction places it

• Incident Management Software#18 of 297.7