DFIR-IRIS
8.2#3 in case management softwareFree planFree planWebAPILinuxmacOS
VisitDFIR-IRIS vs Request Tracker for Incident Response
Request Tracker for Incident Response
6.8#14 in incident management softwareFrom $450 a monthFree planWebAPILinuxSelf-hosted
VisitWhat both publish
| Fact | DFIR-IRIS | Request Tracker for Incident Response |
|---|---|---|
| Deployment | The documentation recommends Docker and Docker Compose; it says Linux and macOS are officially supported and Windows may need Dockerfile changes for file storage paths. | RT and RTIR are available for free download and self-hosting, and the vendor also offers Cloud RT. |
| Purpose | DFIR-IRIS is an open-source incident response platform for running investigations collaboratively in one workspace. | RTIR builds on RT with preconfigured queues and workflows designed for incident response teams and is used by CERT and CSIRT teams. |
| Reporting | Jinja templates can generate configurable executive, technical or court reports in PDF or DOCX. | RTIR can generate activity reports in HTML, text, or spreadsheet format and report activity by dates and constituencies. |
DFIR-IRIS plans
- Free and open-sourceFree
- Open-source self-hostedFree
Request Tracker for Incident Response plans
- CommunityFree
- Build$450 a month
- Scale$1,650 a month
- TransformPriced on request
Pick DFIR-IRIS if…
DFIR-IRIS suits incident response teams that need shared case records, alert triage, evidence controls, and investigation reporting. Organizations should be able to deploy it in a restricted environment.
Pick Request Tracker for Incident Response if…
RTIR suits incident-response teams that need structured queues, linked-report handling, and communication across internal and external responders. It also fits organizations that want to download and self-host RTIR or select Cloud RT.