17.7
DFIR-IRIS is a free, open-source incident response platform for teams conducting investigations in a shared workspace.
Free planOpen sourceWebAPILinux
Alternatives to TheHive
27.5
DFIRe is self-hosted case management software for digital forensics and incident response.
Free planWebAPILinux
37.5
Forensicator is a free, open-source toolkit for collecting and analyzing system artifacts during live investigations.
Free planOpen sourceWebAPILinux
- 4
LimaCharlie
LimaCharlie is an API-first SecOps platform for telemetry, detection, and response.
Free planWebAPILinuxmacOS7.2$3 usage-based - 5
Forendi
Forendi is a digital forensics and incident response platform for incident handling, investigations, forensic analysis and security operations.
WebAPILinuxmacOS6.6From $199 a month - 6
Belkasoft X Forensic
Belkasoft X Forensic acquires, analyzes, and reports digital evidence from computers, mobile devices, RAM, cars, drones, and cloud sources.
AndroidiOSLinuxmacOS6.5 - 7
Binalyze AIR
Binalyze AIR is a digital forensics and incident response platform that combines security signals, forensic evidence, and AI-driven analysis for SOC investigations.
WebAPILinuxmacOS6.4 - 8
GRR Rapid Response
GRR Rapid Response is an open-source framework for remote live forensics and incident investigation.
Free planWebAPILinuxmacOS6.3Free plan - 9
Cyber Triage
Cyber Triage is an AI-powered platform for investigating cyber incidents and endpoints.
APISelf-hostedWindows6.2From $3,500 a year - 10
ORNA
ORNA is an AI-guided cyberattack response automation and incident case-management platform, available through web, API or self-hosted deployment.
Free planWebAPISelf-hosted6.2Free plan - 11
SIFT Workstation
SIFT Workstation is a free, open-source collection of tools for incident response and digital forensic examination.
Free planLinuxSelf-hostedWindows6.2Free plan - 12
SandsBytes
SandsBytes is a cybersecurity investigation and incident response platform for examining incidents, hunting threats, tracking evidence and indicators…
WebAPILinuxSelf-hosted5.9 - 13
Colander
Colander is a web-based platform for case management, digital investigations and shared knowledge building.
WebAPILinuxSelf-hosted5.7 - 14
Cydarm
Cydarm is a cyber incident response management platform for security operations teams.
WebAPISelf-hosted5.6 - 15
TraceLock CRM
TraceLock CRM is an open-source, self-hosted CRM designed for security operations and incident response teams.
Free planAPISelf-hosted5.6Free plan - 16
Dagobert
Dagobert is an open-source workspace for incident response teams conducting forensic investigations.
WebAPILinuxSelf-hosted5.5 - 17
Grail
Grail is an incident-response pipeline that uses six AI agents for intake, evidence collection, analysis, validation, and reporting.
API5.5 - 18
ServiceNow Security Incident Response
ServiceNow Security Incident Response is cloud-deployed web software for managing security incidents.
Web5.0 - 19
Autopsy
LinuxmacOSWindows4.9 - 20
OpenText Endpoint Forensics & Response
WebWindows4.8