Colander vs DFIR-IRIS
Colander
pts-project.org
DFIR-IRIS
dfir-iris.orgSide by side
| Figure | Colander | DFIR-IRIS |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 2 |
| Spec score · Incident Response Software | 7.7 (#11) | 8.7 (#3) |
| Case management | Colander organizes evidence, observations, and artifacts into distinct cases. | Cases contain assets, IOCs, tasks, evidence and notes with severity, ownership, status and audit history. |
| Collaboration | Users can invite team members to collaborate on cases and share information with other organizations. | War rooms provide real-time chat, threads, per-room teams and slash commands that record decisions and case actions. |
| Deployment | The maker documents deployment on a dedicated server running Debian, using Docker and Ansible. | The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths. |
| Evidence handling | Colander can collect and sign artifacts from PiRogue and provides features for artifact integrity and authenticity. | Evidence is hashed, tagged, access-controlled and logged, with SHA-256, MD5 and SHA-1 verification options. |
| Purpose | Colander is a web-based case management, digital investigations, and knowledge-building platform. | DFIR-IRIS is an open-source incident response platform for running investigations collaboratively in one workspace. |
| Security configuration | The deployment guide says most server secrets are randomly generated and instructs administrators to encrypt the configuration vault because it contains secrets. | Production setup requires changing database passwords, Flask secret values and password salts; default self-signed certificates are testing-only. |
| Support | The project invites users who need help to join its Discord server. | The project lists getting-started help, support and implementation, and training, with details available by contacting [email protected]. |
Plans
In their own words
Colander
Colander is a web-based platform for case management, digital investigations, and shared knowledge building. It organizes evidence and investigative knowledge into cases, supports team collaboration, and allows information sharing with other organizations. A web graph editor represents artifacts, actors, observables, and events. Through Threatr, users can retrieve intelligence from VirusTotal, MISP, and OTX AlienVault. Colander can collect and sign PiRogue artifacts, track their integrity and authenticity, and analyze decrypted network traffic and payloads. Payloads can be decoded with CyberChef, while YARA rules can be applied to network traffic. Users can generate data transmission reports and create feeds in different formats. A Python 3 library abstracts the REST API and uses an API key from the user profile. The project is open source under AGPL v3, with API, Linux, web, and self-hosted options. Deployment guidance recommends current Debian, at least 4 cores, 4 GB RAM, 500 GB storage, and a public IP.
DFIR-IRIS
DFIR-IRIS is an open-source incident response platform for teams conducting investigations in a shared workspace. Case records organize assets, indicators of compromise, tasks, evidence and notes with an audit trail. Alerts from SIEM, EDR, MISP, IntelOwl or REST endpoints can be collected, triaged and promoted into cases. Evidence can be checked with SHA-256, MD5 or SHA-1, while access restrictions and logs cover downloads, views and changes. War rooms provide real-time chat, threads, room-specific teams and slash commands that record decisions and case actions. Configurable Jinja templates generate PDF or DOCX executive summaries, technical reports or court-ready documents. The project lists modules including IrisVT, IrisMISP, IrisCheck and IrisWebHooks, along with a REST API and 162 hook binding points. Permissions include deny-all, read-only and full-access case controls. Docker and Docker Compose are recommended; Linux and macOS are officially supported, while Windows may need Dockerfile changes for file storage paths. Documentation identifies v3.0.0-beta.1 as the current v3 release and says beta versions are not production-ready. The project advises restricting access and not exposing IRIS to the Internet.