DFIR-IRIS

DFIR-IRIS is a self-hosted, open-source platform for coordinating incident response investigations. It best suits security and forensics teams that need shared case records and can manage their own deployment in a restricted environment. Its connected investigation workflow is a strong draw, but the current v3 beta and deployment constraints call for caution.

Overview

DFIR-IRIS grew from an idea within Airbus CyberSecurity’s commercial CSIRT in France in 2019 and was released as open source in December 2021 with Airbus CyberSecurity’s agreement and support. It gives investigation work a common case-based home, combining operational records with collaboration and reporting. That breadth is valuable for teams that need continuity across response work, though the self-hosted model puts deployment and security responsibilities on the organization.

Key features

Casework, alerts and evidence

Cases collect assets, indicators of compromise, tasks, evidence and notes under one record with an audit trail. Alerts from SIEM and EDR systems, MISP, IntelOwl or REST endpoints can be triaged and promoted into cases. This makes IRIS a sensible fit for teams that want a path from incoming alerts to documented investigations, rather than a standalone case log.

Evidence can be verified with SHA-256, MD5 or SHA-1. Access restrictions and logged downloads, views and changes help teams track evidence handling, although they do not replace the need to secure the system itself.

Collaboration, reporting and integrations

War rooms combine real-time chat with threads, room-specific teams and slash commands that record decisions and case actions. This keeps discussion closer to the investigation record, which is useful when several responders need to coordinate. Configurable Jinja templates generate PDF or DOCX executive summaries, technical reports or court-ready documents, giving teams a way to shape output for different audiences.

Named modules include IrisVT, IrisMISP, IrisCheck and IrisWebHooks; the platform also provides a REST API and 162 hook binding points. That extension surface can support integration work, but teams should expect to assess how their own tools fit.

Access controls and deployment

Role-based permissions and case access controls offer deny-all, read-only and full-access levels, supporting separation of access by role and case. The documentation recommends Docker and Docker Compose. Linux and macOS are officially supported; Windows may require Dockerfile changes for file-storage paths, so it is a less straightforward deployment choice.

The documentation identifies v3.0.0-beta.1 as the current v3 release and says beta versions are not production-ready. The project also advises keeping IRIS in a restricted environment and not exposing it to the Internet. Those are material limits: organizations considering production use should weigh release readiness and deployment security before committing.

Pricing

DFIR-IRIS is free and open source at free, with no licence fee for self-hosted deployment. That removes a software licence cost, but the organization still needs to operate the deployment. The project offers getting-started help, support and implementation, and training; contact [email protected] for details.

Platforms

DFIR-IRIS supports API, Linux, macOS, self-hosted, web and Windows environments. Docker and Docker Compose are the recommended deployment route, with Linux and macOS officially supported. Windows users may need to adjust Dockerfile file-storage paths.

Who it's for

DFIR-IRIS is best for incident response and digital forensics teams that need structured case records, evidence accountability, collaboration and adaptable reports in one self-hosted workspace. It is less suitable for teams seeking a production-ready v3 release now, an Internet-exposed deployment, or a Windows setup without deployment adjustments.

Pros and cons

• Pros: Cases bring assets, indicators, tasks, evidence and notes together with an audit trail, supporting accountable investigations.
• Pros: Alert intake, war rooms and report generation connect triage, coordination and documentation in one platform.
• Pros: The free, open-source self-hosted plan has no licence fee.
• Cons: The current v3 release is beta and explicitly not production-ready.
• Cons: The project advises against Internet exposure, requiring a restricted deployment environment.
• Cons: Windows deployment may need Dockerfile changes for file-storage paths.

Alternatives

Forensicator is another free, open-source cross-platform incident response toolkit; choose it if that toolkit format better fits your workflow than IRIS’s case-centered workspace.

LimaCharlie is worth considering for its free tier, which covers up to 2 endpoints with EDR free; its CNAPP costs $150/organization, and the free tier requires no credit card.

GRR Rapid Response is a free, self-hosted option under Apache License 2.0 for teams seeking that alternative.

DFIRe offers a non-commercial plan granted case by case for individual, student, educational, charity and community use; consider it if that audience fits your needs.

ORNA pairs a self-managed free plan with a managed option sold by custom quote, making it an alternative for teams considering managed service.

SIFT Workstation is a free, open-source choice with an OVA download and Ubuntu 22.04 installation options; it is a different fit for teams looking for a workstation rather than an incident response case platform.

Binalyze AIR is a paid alternative with a free trial; pricing requires contacting Binalyze.

SandsBytes is another paid option.

Browse Incident Response Software, Incident Management Software or Case Management Software for more options in those categories.

Verdict

Choose DFIR-IRIS if your response or forensics team wants a no-licence-fee, self-hosted workspace that ties alert triage to evidence-aware casework, collaboration and reporting. Look elsewhere if you need a production-ready v3 release or cannot keep the system within a restricted environment.