- Home
- Case Management Software
- DFIR-IRIS
DFIR-IRIS
DFIR-IRIS · France · founded 2019
What it is
DFIR-IRIS is an open-source incident response platform for teams conducting investigations together in one workspace. Cases bring assets, indicators of compromise, tasks, evidence and notes into a single record with an audit trail. Alerts from SIEM, EDR, MISP, IntelOwl or REST endpoints can be collected, reviewed and promoted into cases. Evidence can be checked with SHA-256, MD5 or SHA-1; access restrictions and logs cover downloads, views and changes. War rooms provide real-time chat, threads, room-specific teams and slash commands that record decisions and case actions. Configurable Jinja templates can create PDF or DOCX summaries, technical reports and court-ready documents. The project lists IrisVT, IrisMISP, IrisCheck and IrisWebHooks modules, a REST API and 162 hook binding points. Permissions include deny-all, read-only and full access. The software is free and self-hosted. Documentation recommends Docker and Docker Compose, officially supports Linux and macOS, and warns that Windows may need file-storage path changes. Its current v3 release is identified as a beta and is not production-ready.
For and against
For
- Free and open-source with self-hosted deployment
- Case records include audit trails
- Supports evidence hashes and logged access
- War rooms record decisions and case actions
- Configurable PDF and DOCX reports
Against
- Windows may need Dockerfile changes
- Current v3 release is beta, not production-ready
- Should not be exposed on the Internet
The verdict
DFIR-IRIS combines case management, alert triage, evidence controls and team collaboration in a self-hosted platform. Its beta status and deployment requirements are important considerations before adoption.
Who it suits
It suits incident response teams that need shared case records, alert triage, evidence handling and collaboration. Teams should account for its self-hosted deployment and restricted-environment security guidance.
Plans and prices
Open-source self-hosted
Deploy on your own infrastructure · Docker deployment · Hosted demo available
Read 15 Oct 2026 · dfir-iris.org
Free and open-source
No licence fee · self-hosted deployment
Read 5 Oct 2026 · dfir-iris.org
On the record
- Access control
- IRIS provides RBAC permissions plus case-level ACLs for users, groups and customers, with deny-all defaults from v2.4.0.docs.dfir-iris.org · read 15 Oct 2026
- Alert ingestion
- The platform accepts alerts from SIEM, EDR, MISP, IntelOwl and arbitrary REST endpoints.dfir-iris.org · read 15 Oct 2026
- Alert triage
- Related alerts can be clustered, deduplicated, merged, split and promoted into cases.dfir-iris.org · read 15 Oct 2026
- API authentication
- Each user receives an API key used as a Bearer token; renewing a key revokes the previous token.docs.dfir-iris.org · read 15 Oct 2026
- API versioning
- Documentation maps IRIS releases through v2.4.x to corresponding API versions and identifies a separate develop API.docs.dfir-iris.org · read 15 Oct 2026
- Case management
- Cases contain assets, IOCs, tasks, evidence and notes with severity, ownership, status and audit history.dfir-iris.org · read 15 Oct 2026
- Collaboration
- War rooms provide real-time chat, threads, per-room teams and slash commands that record decisions and case actions.dfir-iris.org · read 5 Oct 2026
- Community funding
- OpenCollective reports total raised of $13,201.06 USD, total disbursed of $44.71 USD and an estimated annual budget of $4,870 USD at the time viewed.opencollective.com · read 15 Oct 2026
- Company origin
- The project began inside Airbus CyberSecurity's commercial CSIRT in France in 2019 and was released publicly in December 2021 with Airbus support.blog.dfir-iris.org · read 15 Oct 2026
- Deployment
- The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths.docs.dfir-iris.org · read 5 Oct 2026
- Deployment components
- The v3 stack uses backend, worker, frontend, PostgreSQL, RabbitMQ and nginx services.docs.dfir-iris.org · read 15 Oct 2026
- Documentation
- The documentation covers operations, modules, reports, upgrades, API reference, Python client and development topics.docs.dfir-iris.org · read 15 Oct 2026
- Evidence
- Evidence can be verified with SHA-256, MD5 or SHA-1, with access restrictions and logged downloads, views and changes.dfir-iris.org · read 5 Oct 2026
- Evidence handling
- Evidence is hashed, tagged, access-controlled and logged, with SHA-256, MD5 and SHA-1 verification options.dfir-iris.org · read 15 Oct 2026
- Extensibility
- Python modules can attach logic to 162 hook points such as case creation, IOC addition and evidence upload.dfir-iris.org · read 15 Oct 2026
- Independent limit: scope
- Darkroast Protocol positions IRIS as an investigative case record rather than a SOAR or automated playbook engine.darkroastprotocol.com · read 15 Oct 2026
- Independent praise: deployment
- Darkroast Protocol describes Docker Compose deployment as suitable for on-premises or private-cloud regulated environments.darkroastprotocol.com · read 15 Oct 2026
- Independent praise: MISP
- Darkroast Protocol reports that the MISP integration supports bidirectional IOC exchange between IRIS cases and MISP events.darkroastprotocol.com · read 15 Oct 2026
