DFIR-IRIS
Open source collaborative incident response platform for cases, timelines, evidence, and alerts.
Technical Architecture & Overview
DFIR-IRIS is a web platform where incident responders manage cases, share findings, build timelines, track evidence, and correlate alerts to compromises. It grew out of Airbus CERT practice and is now community maintained. Modules cover case management, IOC handling with MISP integration, alerts ingest, and report export. It is a common self-hosted successor choice for teams that outgrew free case tracking.
Targeted Technical Use Cases
Response teams that need structured case management and IOC handling they can self-host.
Evaluation & Trade-offs
Core Strengths
- +Purpose-built for IR coordination, not generic ticketing.
- +MISP and email alert integration.
- +Self-hosted data control.
Trade-Offs & Limitations
- -Requires container operations and updates on your side.
- -Reporting templates need customization per organization.
Defensive Security Application
Organizing incident casework, evidence, and indicators during active response.
Frequently Asked Questions
What is DFIR-IRIS?→
DFIR-IRIS is a web platform where incident responders manage cases, share findings, build timelines, track evidence, and correlate alerts to compromises. It grew out of Airbus CERT practice and is now community maintained. Modules cover case management, IOC handling with MISP integration, alerts ingest, and report export. It is a common self-hosted successor choice for teams that outgrew free case tracking.
What is DFIR-IRIS used for?→
Response teams that need structured case management and IOC handling they can self-host.
What are the strengths of DFIR-IRIS?→
- +Purpose-built for IR coordination, not generic ticketing.
- +MISP and email alert integration.
- +Self-hosted data control.
What are the limitations of DFIR-IRIS?→
- +Requires container operations and updates on your side.
- +Reporting templates need customization per organization.
How is DFIR-IRIS used defensively?→
Organizing incident casework, evidence, and indicators during active response.