Cydarm
5.6#14 in incident response softwareWebAPISelf-hosted
VisitCydarm vs DFIR-IRIS
What both publish
| Fact | Cydarm | DFIR-IRIS |
|---|---|---|
| Case management | The platform includes case management, data enrichment, editable playbooks, reporting, collaboration, and response time SLAs. | Cases contain assets, IOCs, tasks, evidence and notes with severity, ownership, status and audit history. |
| Deployment | Cydarm is offered as a hosted managed service or as an enterprise deployment on a customer's own infrastructure. | The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths. |
| Integrations | The integrations page lists OpenAPI, email polling, webhooks, Jira, ServiceNow, Teams, PagerDuty, Slack, and SMS integrations. | First-party modules include IrisVT for VirusTotal, IrisMISP for MISP, IrisCheck for validations and IrisWebHooks for URL destinations. |
| Purpose | Cydarm is a cyber incident response management platform for security operations teams. | DFIR-IRIS is an open-source incident response platform for running investigations collaboratively in one workspace. |
Cydarm plans
- Free 30-day Cydarm TrialFree
DFIR-IRIS plans
- Free and open-sourceFree
- Open-source self-hostedFree
Pick Cydarm if…
Cydarm suits enterprise and virtual or hybrid security teams, as well as MSPs, MSSPs and DFIR firms. It is relevant to teams that need incident case controls, collaborative playbooks and response time SLAs.
Pick DFIR-IRIS if…
DFIR-IRIS suits incident response teams that need shared case records, alert triage, evidence controls, and investigation reporting. Organizations should be able to deploy it in a restricted environment.