DFIR-IRIS
8.2#3 in case management softwareFree planFree planWebAPILinuxmacOS
VisitDFIR-IRIS vs ORNA
What both publish
| Fact | DFIR-IRIS | ORNA |
|---|---|---|
| Case management | Cases contain assets, IOCs, tasks, evidence and notes with severity, ownership, status and audit history. | Alerts can be escalated into incidents with one action, while ORNA automatically generates and assigns attack-specific tasks based on team roles. |
| Deployment | The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths. | ORNA says it can be deployed on-premises as well as in the cloud and can receive custom enterprise features and integrations. |
| Integrations | First-party modules include IrisVT for VirusTotal, IrisMISP for MISP, IrisCheck for validations and IrisWebHooks for URL destinations. | ORNA states that it has 200+ integrations, including FortiGate, SonicWall, Entrust, Cisco VPN, Palo Alto firewalls, Symantec WAF, VMware Carbon Black EDR, Docker, Kaspersky, McAfee and Microsoft Exchange. |
| Product | DFIR-IRIS is a collaborative incident-response platform for cases, timelines, evidence and war rooms. | ORNA is an AI-guided cyberattack response automation and cyber incident response case-management platform. |
| Reporting | Jinja templates can generate configurable executive, technical or court reports in PDF or DOCX. | ORNA produces detailed or executive incident reports with built-in evidence analysis in seconds. |
DFIR-IRIS plans
- Free and open-sourceFree
- Open-source self-hostedFree
ORNA plans
- Self-Managed FreeFree
- ManagedPriced on request
- Self-Managed ProPriced on request
- Self-Managed Pro + AlertsPriced on request
Pick DFIR-IRIS if…
DFIR-IRIS suits incident response teams that need shared case records, alert triage, evidence controls, and investigation reporting. Organizations should be able to deploy it in a restricted environment.
Pick ORNA if…
ORNA is presented for agile digital forensics and incident response teams, with free access specifically for midsize businesses. It may suit organizations seeking incident workflows, integrations and on-premises or cloud deployment.