DFIR-IRIS
8.2#3 in case management softwareFree planFree planWebAPILinuxmacOS
VisitDFIR-IRIS vs Primero
What both publish
| Fact | DFIR-IRIS | Primero |
|---|---|---|
| Case management | Cases contain assets, IOCs, tasks, evidence and notes with severity, ownership, status and audit history. | Case management workflows cover identification, registration, assessment, planning, referrals and transfers, and case closure, with supervision, notifications, and tasking tools. |
| Deployment | The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths. | hybrid |
| Founded | 2019 | 2013 |
| Free plan | Yes | Yes |
| Purpose | DFIR-IRIS is an open-source incident response platform for running investigations collaboratively in one workspace. | Primero is an open-source information management platform for protection-related data, including child protection and gender-based violence case management, incident monitoring, and family tracing and reunification. |
DFIR-IRIS plans
- Free and open-sourceFree
- Open-source self-hostedFree
Primero plans
- Tier 3: Full Service SaaS$8,250 a year
- Tier 4: Hybrid deployment$25,000 a year
- Tier 1: DIYFree
- Tier 2: Single organizationPriced on request
- Tier 5: Custom packagePriced on request
Pick DFIR-IRIS if…
DFIR-IRIS suits incident response teams that need shared case records, alert triage, evidence controls, and investigation reporting. Organizations should be able to deploy it in a restricted environment.
Pick Primero if…
Primero suits organizations that need structured case intake, custom fields, audit trails, and reporting. Its deployment options fit teams considering self-management, hosted service, or a hybrid setup.