Clue Investigation Management
6.3#101 in case management softwareWebAPI
VisitClue Investigation Management vs DFIR-IRIS
What both publish
| Fact | Clue Investigation Management | DFIR-IRIS |
|---|---|---|
| Deployment | cloud | The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths. |
| Evidence | Clue supports evidence management with chain of custody, enquiry tracking, and links between evidence and outcomes. | Evidence can be verified with SHA-256, MD5 or SHA-1, with access restrictions and logged downloads, views and changes. |
| Integrations | Listed integrations and add-ons include TWIF, the PND Connector, Analytics Connector, PostCoder API, and Confidential Reporting. | First-party modules include IrisVT for VirusTotal, IrisMISP for MISP, IrisCheck for validations and IrisWebHooks for URL destinations. |
| Purpose | Clue is a central platform for managing investigations and intelligence, helping teams surface insights, share data securely, detect threats, and progress investigations. | DFIR-IRIS is an open-source incident response platform for running investigations collaboratively in one workspace. |
Clue Investigation Management plans
- Clue Investigation ManagementPriced on request
DFIR-IRIS plans
- Free and open-sourceFree
- Open-source self-hostedFree
Pick Clue Investigation Management if…
You want what its maker publishes above — check its page for the details.
Pick DFIR-IRIS if…
DFIR-IRIS suits incident response teams that need shared case records, alert triage, evidence controls, and investigation reporting. Organizations should be able to deploy it in a restricted environment.