DFIR-IRIS vs ORNA
DFIR-IRIS
dfir-iris.org
ORNA
orna.appSide by side
| Figure | DFIR-IRIS | ORNA |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 4 |
| Spec score · Incident Response Software | 8.7 (#3) | 7.6 (#14) |
| Case management | Cases contain assets, IOCs, tasks, evidence and notes with severity, ownership, status and audit history. | Alerts can be escalated into incidents with one action, while ORNA automatically generates and assigns attack-specific tasks based on team roles. |
| Deployment | The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths. | ORNA says it can be deployed on-premises as well as in the cloud and can receive custom enterprise features and integrations. |
| Integrations | First-party modules include IrisVT for VirusTotal, IrisMISP for MISP, IrisCheck for validations and IrisWebHooks for URL destinations. | ORNA states that it has 200+ integrations, including FortiGate, SonicWall, Entrust, Cisco VPN, Palo Alto firewalls, Symantec WAF, VMware Carbon Black EDR, Docker, Kaspersky, McAfee and Microsoft Exchange. |
| Product | DFIR-IRIS is a collaborative incident-response platform for cases, timelines, evidence and war rooms. | ORNA is an AI-guided cyberattack response automation and cyber incident response case-management platform. |
| Reporting | Jinja templates can generate configurable executive, technical or court reports in PDF or DOCX. | ORNA produces detailed or executive incident reports with built-in evidence analysis in seconds. |
| Support | The project lists getting-started help, support and implementation, and training, with details available by contacting [email protected]. | The platform includes free 24/7 SME incident-resolution and digital-forensics support plus around-the-clock customer service. |
Plans
ORNA
- Self-Managed FreeFree
- ManagedPriced on request
- Self-Managed ProPriced on request
- Self-Managed Pro + AlertsPriced on request
In their own words
DFIR-IRIS
DFIR-IRIS is an open-source incident response platform for teams conducting investigations in a shared workspace. Case records organize assets, indicators of compromise, tasks, evidence and notes with an audit trail. Alerts from SIEM, EDR, MISP, IntelOwl or REST endpoints can be collected, triaged and promoted into cases. Evidence can be checked with SHA-256, MD5 or SHA-1, while access restrictions and logs cover downloads, views and changes. War rooms provide real-time chat, threads, room-specific teams and slash commands that record decisions and case actions. Configurable Jinja templates generate PDF or DOCX executive summaries, technical reports or court-ready documents. The project lists modules including IrisVT, IrisMISP, IrisCheck and IrisWebHooks, along with a REST API and 162 hook binding points. Permissions include deny-all, read-only and full-access case controls. Docker and Docker Compose are recommended; Linux and macOS are officially supported, while Windows may need Dockerfile changes for file storage paths. Documentation identifies v3.0.0-beta.1 as the current v3 release and says beta versions are not production-ready. The project advises restricting access and not exposing IRIS to the Internet.
ORNA
ORNA is an AI-guided platform for coordinating cyberattack response and managing incident cases. Its Scout agent watches infrastructure for attacks and anomalies around the clock, sorts findings by source, relevance and criticality, and adds threat intelligence from 28 public and private sources. AI estimates an incident’s severity and affected assets, then presents color-coded views by asset, attack type, technique and time. Teams can turn alerts into incidents with one action; ORNA then creates and assigns tasks according to team roles. Playbooks span digital forensics and incident response as well as crisis work for HR, communications and legal teams. The platform generates detailed or executive incident reports with evidence analysis and offers a Risk Dashboard for NIST CSF management across five governance domains. ORNA lists more than 200 integrations. It supports web, API and self-hosted access, with on-premises and cloud deployment. The Self-Managed Free plan is free. Other listed plans use custom quotes or have no price listed.