Dagobert
5.5#16 in incident response softwareWebAPILinuxSelf-hosted
VisitDagobert vs DFIRe
What both publish
| Fact | Dagobert | DFIRe |
|---|---|---|
| Deployment | The project describes itself as a single Go binary backed by SQLite and provides Docker-based installation instructions for self-hosting. | Installation uses a release-pinned Docker Compose bundle and supports manual or air-gapped deployment. |
| Integrations | Indicator enrichment can query VirusTotal, AbuseIPDB, and Hybrid Analysis, and Dagobert can exchange timelines with Timesketch. | Native integrations include Slack case workflows, two-way Jira Cloud synchronization, outgoing webhooks and SIEM/SOAR forwarding. |
| Reports | It generates reports from user-supplied Word, Excel/Calc, Writer, and Impress templates in .docx, .ods, .odt, and .odp formats. | Reports can generate title pages, timelines, indicator lists and evidence inventories from the case record, with optional LLM drafting. |
| Security controls | The configuration reference says secure cookies and the Strict-Transport-Security header are enabled by default, and describes a compressed and decompressed archive size limit of 10 GiB each. | The security documentation describes OIDC single sign-on, two-tier role-based access control, AES-256-GCM attachment encryption, and an immutable fail-closed audit trail. |
Dagobert plans
No prices published.
DFIRe plans
- Annual licence€9,900 a year
- Non-commercialFree
- Small teamsPriced on request
Pick Dagobert if…
Dagobert is primarily intended for DFIR consultants handling cases for outside clients, with internal CIRT and SOC teams as a secondary audience. It suits teams able to self-host and manage access and deployment security.
Pick DFIRe if…
DFIRe suits digital forensics and incident response teams that need structured case and evidence workflows, including teams operating air-gapped networks. Customers must manage their own infrastructure security, storage, and backups.