DFIRe

DFIRe is a self-hosted case-management system built for digital forensics and incident-response work. It fits teams that need defensible evidence handling, configurable investigations, and offline operation under their own control. The trade-off is a substantial annual commitment plus responsibility for running and securing the deployment.

Overview

DFIRe brings investigation workflow, evidence records, deadlines, threat intelligence, and reporting into one application. Custom case types, severity levels, assignments, and escalation preserve a case history as work moves from triage to response. That is more specialized than a general task tracker, but it also means teams must invest in defining and maintaining their own procedures.

Self-hosting gives organizations control over where the system runs, including air-gapped networks with offline licensing. It also makes the customer responsible for the database, file storage, network, server infrastructure, and backups. Case data remains in plaintext in the database for performance and full-text search, so infrastructure hardening and access controls are operational requirements rather than optional extras.

Key features

Fifteen default playbooks cover common case types and can be customized or replaced. They provide a useful starting framework without forcing every team into identical steps, although tailoring them still requires process ownership.

Evidence is arranged hierarchically with configurable attributes, verifiable custody records, printable receipts, and transfer records. Those capabilities suit investigations where proving who handled material, and when, is as important as recording the finding itself.

Compliance timers and reminders cover breach notifications, statutory reports, and other deadlines such as SLAs. The IOC registry supports STIX 2.1 types, enrichment from named threat-intelligence providers, and exchange through MISP and TAXII. Slack collaboration, bidirectional Jira synchronization, webhooks, and SIEM or log-forwarding integrations connect case work with surrounding operations.

Reports use structured sections and a QA workflow, can generate evidence inventories, and optionally use an LLM chosen by the customer for drafting. Security controls include OIDC single sign-on, two-tier role-based access control, AES-256-GCM attachment encryption, and an immutable fail-closed audit trail. These controls strengthen accountability, but they do not remove the need to secure the host environment.

Pricing

DFIRe uses a freemium model with a 90-day trial. The Non-commercial plan has custom, case-by-case pricing for individuals, students, educational organizations, charities, and community use, with all features included. It is the appropriate route for qualifying non-commercial users who need the complete product rather than a reduced feature set.

The Annual licence costs €9,900.00 per year, billed at €9,900 per year. VAT is 0%, with VAT added under EU rules. It includes unlimited users and cases, applies to one production deployment, can convert to an offline licence, and starts with the 90-day trial. Unlimited seats and cases make the licence easier to justify for an established response function, but the single-deployment condition limits how it can be used across separate production environments.

Small teams receive custom pricing with the same deployment model and features and unlimited cases. That option is more suitable when a smaller organization needs the full workflow but cannot use the standard annual arrangement. There is no published low-cost paid tier for teams that only need a subset of the system.

Platforms

DFIRe provides an API and web interface for Linux-based, self-hosted operation. The supported deployment model is Docker Compose on a Linux host, requiring Docker Engine 24.0 or later, Compose 2.24.4 or later, and PostgreSQL 16 or later for production. Other container platforms are not supported, so organizations standardized on a different orchestration model should account for that constraint.

Who it's for

DFIRe is a strong match for forensic and incident-response teams that need formal custody records, deadline controls, threat-intelligence exchange, and auditable reporting in an environment they administer. Air-gapped operators benefit from offline deployment and licensing. It is a poor fit for organizations seeking a hosted service, avoiding infrastructure maintenance, or needing several independent production deployments under one licence.

Pros and cons

Pros

• Investigation-specific workflow: configurable cases, escalation, and adaptable playbooks retain history from triage through response.
• Defensible evidence handling: custody verification, receipts, transfers, and generated inventories support formal investigative records.
• Broad operational connections: STIX 2.1, MISP, TAXII, Slack, Jira, webhooks, and SIEM or log forwarding link case work to existing tools.
• Offline capability: air-gapped deployment and offline licensing support isolated networks.

Cons

• High entry price: the standard licence is €9,900 per year, before any EU VAT that applies.
• Operational burden: customers must secure and back up the database, storage, network, servers, and deployment.
• Single production deployment: unlimited users and cases do not extend to multiple production installations.
• Constrained deployment choice: Docker Compose on Linux is supported, while other container platforms are not.

Alternatives

Incident Response Software, Incident Management Software, and Case Management Software provide broader category starting points.

Forensicator is a free, open-source, cross-platform incident-response toolkit, making it preferable when licence cost and operating-system breadth matter more than DFIRe's case-management scope.

LimaCharlie offers a free Community tier with up to two endpoints and EDR free, so it suits small endpoint-focused deployments rather than teams seeking DFIRe's evidence-custody workflow.

DFIR-IRIS is free and open source with self-hosted deployment, a straightforward alternative when avoiding an annual licence is the priority.

GRR Rapid Response is an Apache License 2.0 self-hosted project for organizations choosing an open-source option.

ORNA has a free self-managed plan and a custom-priced managed platform, giving buyers a choice between running it themselves and purchasing managed service.

SIFT Workstation is free and open source for Linux, Windows, and self-hosted use, suited to workstation-based forensic work.

Binalyze AIR is a paid product with a free trial and custom pricing, worth considering when that commercial model fits better.

SandsBytes is another paid option for API, Linux, self-hosted, and web environments.

Verdict

Choose DFIRe if your response or forensic team needs rigorous custody records, configurable case progression, compliance deadlines, and offline self-hosting in one system. Look elsewhere if €9,900 per year, a single production deployment, and full infrastructure responsibility outweigh the value of those specialized controls.