DFIR-IRIS
8.2#3 in case management softwareFree planFree planWebAPILinuxmacOS
VisitDFIR-IRIS vs Forensicator
Forensicator
7.5#3 in incident response softwareFree planFree planWebAPILinuxmacOS
VisitWhat both publish
| Fact | DFIR-IRIS | Forensicator |
|---|---|---|
| Case management | Cases contain assets, IOCs, tasks, evidence and notes with severity, ownership, status and audit history. | Core organizes investigations, hosts, findings, notes, bookmarks, and incident-response playbooks into cases. |
| Deployment | The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths. | Core is self-hosted through Docker Compose or a Debian/Ubuntu host and supports offline update packages for air-gapped use. |
| Documentation | The documentation covers operations, modules, reports, upgrades, API reference, Python client and development topics. | The documentation site contains getting-started, Windows, Linux, macOS, output, advanced-usage, and changelog sections. |
| Purpose | DFIR-IRIS is an open-source incident response platform for running investigations collaboratively in one workspace. | Forensicator collects, analyzes, and interprets system artifacts during live investigations and produces structured HTML reports. |
| Reporting | Jinja templates can generate configurable executive, technical or court reports in PDF or DOCX. | Core exports executive and technical reports in PDF, CSV, JSON, and ZIP formats. |
DFIR-IRIS plans
- Free and open-sourceFree
- Open-source self-hostedFree
Forensicator plans
- ForensicatorFree
- Forensicator CoreFree
- Forensicator EnterprisePriced on request
Pick DFIR-IRIS if…
DFIR-IRIS suits incident response teams that need shared case records, alert triage, evidence controls, and investigation reporting. Organizations should be able to deploy it in a restricted environment.
Pick Forensicator if…
The free collector suits incident responders and digital forensics teams that need to gather and review system artifacts. Enterprise is presented for security operations centers, response and forensics teams, and MSSPs managing reports across teams.