Case Closed Software vs DFIR-IRIS

Case Closed Software is a case management and intelligence platform for law enforcement and investigative agencies. It manages investigations from intake through prosecution, including case tracking, reports, evidence, and intelligence. Modules cover confidential informants, tips and leads, evidence tracking, gang intelligence, operations planning, agent payments, and analytics and reporting. The confidential informant module tracks status, payments, reliability scores, and deconfliction, and includes payment vouchers and approval workflows. Secure API integrations can connect to RMS, CAD, analytics, and reporting tools; custom NCIC and local database integrations are available when authorized. The maker says data is encrypted in transit and at rest, with MFA, access controls, audit logging, and daily backups. It lists CJIS, TX-RAMP Level 2, SOC 2 Type 2, and 28 CFR Part 23. Each agency has an isolated environment, and U.S. agencies’ data remains in the United States. Implementations typically take 4–8 weeks and include administrator and end-user training. The platform uses hybrid deployment, and pricing is available on request. Tracker and CaseNexus modules are in active development.

DFIR-IRIS is an open-source incident response platform for teams conducting investigations in a shared workspace. Case records organize assets, indicators of compromise, tasks, evidence and notes with an audit trail. Alerts from SIEM, EDR, MISP, IntelOwl or REST endpoints can be collected, triaged and promoted into cases. Evidence can be checked with SHA-256, MD5 or SHA-1, while access restrictions and logs cover downloads, views and changes. War rooms provide real-time chat, threads, room-specific teams and slash commands that record decisions and case actions. Configurable Jinja templates generate PDF or DOCX executive summaries, technical reports or court-ready documents. The project lists modules including IrisVT, IrisMISP, IrisCheck and IrisWebHooks, along with a REST API and 162 hook binding points. Permissions include deny-all, read-only and full-access case controls. Docker and Docker Compose are recommended; Linux and macOS are officially supported, while Windows may need Dockerfile changes for file storage paths. Documentation identifies v3.0.0-beta.1 as the current v3 release and says beta versions are not production-ready. The project advises restricting access and not exposing IRIS to the Internet.