DFIR-IRIS
8.2#3 in case management softwareFree planFree planWebAPILinuxmacOS
VisitDFIR-IRIS vs Grail
What both publish
| Fact | DFIR-IRIS | Grail |
|---|---|---|
| Deployment | The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths. | Grail says deployment takes under a day for most environments and uses Velociraptor on demand without a persistent endpoint installation. |
| Integrations | First-party modules include IrisVT for VirusTotal, IrisMISP for MISP, IrisCheck for validations and IrisWebHooks for URL destinations. | The site lists Sentinel, Splunk, CrowdStrike, SentinelOne, and Elastic for alert intake, plus Jira, ServiceNow, carrier claims APIs, and custom webhooks for case output. |
| Reports | Configurable Jinja templates can produce PDF or DOCX executive summaries, technical reports or court-ready documents. | Reports include an executive summary, technical appendix, and evidence index, with findings linked to artifacts, lines, and SHA-256 hashes. |
DFIR-IRIS plans
- Free and open-sourceFree
- Open-source self-hostedFree
Grail plans
- Engagement-based pricingPriced on request
Pick DFIR-IRIS if…
DFIR-IRIS suits incident response teams that need shared case records, alert triage, evidence controls, and investigation reporting. Organizations should be able to deploy it in a restricted environment.
Pick Grail if…
Grail names regulated security teams in healthcare, fintech, and regional infrastructure, along with cyber insurance carriers, MGAs, and reinsurers, as intended customers. It may suit organizations that need evidence-linked incident reports and case management.