DFIRe

DFIRe is self-hosted case management software for digital forensics and incident response, deployed on a Linux host with Docker Compose. Teams can configure case types, severities and assignments, and move cases from triage toward incident response while preserving their history. Evidence can be organized hierarchically with configurable attributes, custody records, printable receipts and transfer records. The product includes playbooks for fifteen common case types, which teams can adapt or replace, plus timers and reminders for breach notifications, reporting obligations and other deadlines. Its IOC registry supports STIX 2.1 types, enrichment from named threat intelligence providers, and sharing through MISP and TAXII. Integrations include Slack, bidirectional Jira synchronization, webhooks, SIEM and log forwarding. Reports support structured sections, QA workflows, evidence inventories and optional LLM drafting through a provider selected by the customer. Documented controls include OIDC sign-on, role-based access, AES-256-GCM attachment encryption and an immutable audit trail. Customers secure their own infrastructure and backups; case data is stored unencrypted in the database. The annual licence is €9,900 a year and starts with a 90-day trial.

DFIRe offers detailed case and evidence workflows for teams prepared to manage a self-hosted installation. Its annual licence covers unlimited users and cases in one production deployment, with a 90-day trial.

DFIRe is suited to digital forensics and incident response teams that can host and secure their own deployment. Air-gapped environments may also suit its offline deployment and licensing options.

DFIRe is self-hosted case management software for digital forensics and incident response. It is best suited to teams that need formal evidence handling and configurable investigation workflows on infrastructure they operate. Its specialized controls are a strong fit for that work, but the annual licence and responsibility for the underlying stack make it a demanding choice.

Overview

DFIRe brings case workflows, evidence custody, compliance deadlines, threat intelligence, and reporting into one system. Teams can tailor case types, severity, assignments, and escalation while preserving a case’s history as it moves from triage to incident response. That makes it more purpose-built for investigations than a general case tracker, but it also means customers must be ready to manage a self-hosted deployment.

Key features

Fifteen default playbooks cover common case types, and teams can modify or replace them. This gives responders a practical starting structure without requiring them to adopt fixed procedures. Evidence is organized hierarchically, with configurable attributes, verifiable custody records, printable receipts, and transfer records—useful safeguards where documenting evidence handling is central to an investigation.

Compliance timers and reminders can track breach notifications, statutory reporting, and SLAs. The IOC registry supports STIX 2.1 types, enrichment from named threat intelligence providers, and sharing through MISP and TAXII. Slack collaboration, bidirectional Jira synchronization, webhooks, and SIEM or log-forwarding integrations connect case work to adjacent tools, although the integrations do not remove the need to operate DFIRe itself.

Reports use structured sections and a QA workflow, with generated evidence inventories. Optional LLM drafting lets customers choose the provider. Security controls include OIDC single sign-on, two-tier role-based access control, AES-256-GCM encryption for attachments, and an immutable, fail-closed audit trail. However, case data is stored in plaintext in the database for performance and full-text search, so customers need to secure that database along with file storage, network, servers, and backups.

Pricing

The Non-commercial plan is granted case by case, with all features for individual, student, educational, charity, and community use; it has no published price. The Annual licence costs 9,900 EUR per year, with VAT at 0% and added under EU rules. It includes unlimited users and cases in one production deployment, can be converted to an offline licence, and starts with a 90-day trial. That scope suits organizations with a production environment and multiple responders, but the single-deployment limit matters if operations require more than one production instance.

Small teams receive custom pricing, the same deployment model and features, and unlimited cases. That avoids a stated case cap but does not provide a published price, so teams should weigh the quote against the operational cost of running the system. The annual plan’s unlimited users can benefit growing teams; it is not a low-cost entry point for organizations that need only basic case tracking.

Platforms

DFIRe supports API and web access, Linux, and self-hosted deployment. Docker Compose on a Linux host is the tested and supported deployment model; other container platforms are not supported. Production requirements include Docker Engine 24.0 or later, Compose 2.24.4 or later, and PostgreSQL 16 or later. Air-gapped deployment and offline licensing make it viable for networks without internet access, provided the customer can manage the infrastructure.

Who it's for

DFIRe is a strong candidate for forensic and incident response teams that need configurable workflows, documented evidence custody, reporting controls, and offline deployment. It is a weaker fit for organizations seeking a managed service or lacking the capacity to secure databases, storage, networks, servers, and backups. Small teams should also consider whether the annual licence or custom-priced option suits their budget and deployment needs.

Pros and cons

• Pros: Unlimited users and cases under the annual licence make costs independent of headcount and case volume within one production deployment.
• Pros: Verifiable custody records, printable receipts, and transfer records support accountable evidence handling.
• Pros: Air-gapped deployment and offline licensing accommodate networks without internet access.
• Cons: The annual licence is 9,900 EUR per year, a substantial commitment for smaller teams.
• Cons: Customers must secure and maintain the full infrastructure, while database case data is stored in plaintext.
• Cons: Docker Compose on Linux is the supported model; other container platforms are outside that support.

Alternatives

For a no-licence-fee, self-hosted incident response option, consider DFIR-IRIS, which is free and open-source. Forensicator is another free, open-source cross-platform incident response toolkit, while GRR Rapid Response offers a free self-hosted option under Apache License 2.0. Choose SIFT Workstation if a free and open-source Linux-focused workstation is a better match.

ORNA offers a free self-managed plan as well as a managed option with custom pricing. LimaCharlie has a free Community tier for up to two endpoints, with EDR free. Belkasoft X Forensic is a paid alternative offered to government customers only, with a perpetual licence and optional annual maintenance and support. TraceLock CRM is a free, open-source self-hosted CRM with no per-seat pricing.

Browse Incident Response Software, Incident Management Software, and Case Management Software for more options by category.

Verdict

Choose DFIRe if your forensic or incident response team needs configurable case progression, formal evidence custody, and offline operation, and can run a Linux-hosted stack securely. Its unlimited users and cases and investigation-specific controls are compelling, but the 9,900 EUR annual licence, one-production-deployment limit, and infrastructure burden make it a poor fit for teams seeking a low-cost or managed system.