Dagobert
5.5#16 in incident response softwareWebAPILinuxSelf-hosted
VisitDagobert vs DFIR-IRIS
What both publish
| Fact | Dagobert | DFIR-IRIS |
|---|---|---|
| Case management | It supports multiple investigations in separate workspaces with role-based, per-case access control managed in the UI. | Cases contain assets, IOCs, tasks, evidence and notes with severity, ownership, status and audit history. |
| Deployment | The project describes itself as a single Go binary backed by SQLite and provides Docker-based installation instructions for self-hosting. | The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths. |
| Integrations | Indicator enrichment can query VirusTotal, AbuseIPDB, and Hybrid Analysis, and Dagobert can exchange timelines with Timesketch. | First-party modules include IrisVT for VirusTotal, IrisMISP for MISP, IrisCheck for validations and IrisWebHooks for URL destinations. |
| Purpose | Dagobert provides incident response teams a shared workspace for forensic investigations, including findings, timelines, tasks, notes, and report generation. | DFIR-IRIS is an open-source incident response platform for running investigations collaboratively in one workspace. |
| Reporting | It generates reports from user-provided Word, Excel/Calc, Writer, and Impress templates in DOCX, ODS, ODT, and ODP formats. | Jinja templates can generate configurable executive, technical or court reports in PDF or DOCX. |
| Reports | It generates reports from user-supplied Word, Excel/Calc, Writer, and Impress templates in .docx, .ods, .odt, and .odp formats. | Configurable Jinja templates can produce PDF or DOCX executive summaries, technical reports or court-ready documents. |
Dagobert plans
No prices published.
DFIR-IRIS plans
- Free and open-sourceFree
- Open-source self-hostedFree
Pick Dagobert if…
Dagobert is primarily intended for DFIR consultants handling cases for outside clients, with internal CIRT and SOC teams as a secondary audience. It suits teams able to self-host and manage access and deployment security.
Pick DFIR-IRIS if…
DFIR-IRIS suits incident response teams that need shared case records, alert triage, evidence controls, and investigation reporting. Organizations should be able to deploy it in a restricted environment.