DFIR-IRIS
8.2#3 in case management softwareFree planFree planWebAPILinuxmacOS
VisitDFIR-IRIS vs DFIRe
What both publish
| Fact | DFIR-IRIS | DFIRe |
|---|---|---|
| Deployment | The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths. | Installation uses a release-pinned Docker Compose bundle and supports manual or air-gapped deployment. |
| Free plan | Yes | Yes |
| Integrations | First-party modules include IrisVT for VirusTotal, IrisMISP for MISP, IrisCheck for validations and IrisWebHooks for URL destinations. | Native integrations include Slack case workflows, two-way Jira Cloud synchronization, outgoing webhooks and SIEM/SOAR forwarding. |
| Product | DFIR-IRIS is a collaborative incident-response platform for cases, timelines, evidence and war rooms. | DFIRe is self-hosted case management software for digital forensics and incident response. |
| Reports | Configurable Jinja templates can produce PDF or DOCX executive summaries, technical reports or court-ready documents. | Reports can generate title pages, timelines, indicator lists and evidence inventories from the case record, with optional LLM drafting. |
DFIR-IRIS plans
- Free and open-sourceFree
- Open-source self-hostedFree
DFIRe plans
- Annual licence€9,900 a year
- Non-commercialFree
- Small teamsPriced on request
Pick DFIR-IRIS if…
DFIR-IRIS suits incident response teams that need shared case records, alert triage, evidence controls, and investigation reporting. Organizations should be able to deploy it in a restricted environment.
Pick DFIRe if…
DFIRe suits digital forensics and incident response teams that need structured case and evidence workflows, including teams operating air-gapped networks. Customers must manage their own infrastructure security, storage, and backups.