DFIR-IRIS
DFIR-IRIS: A free, self-hosted platform for structured security incident investigations. Ranked #13 of 28 in Incident Management Software by our editors (7.8/10); pricing: Free plan; best for open-source security case management.
At a glance
- Editor score7.8 / 10
- PricingFree plan
- Best forOpen-source security case management
- Free planYes
- Paid fromFree
- Founded2019
- Facts checked19 Sep 2026
Where it wins
- Organizes alerts, evidence, tasks, timelines and reports in incident cases
- Supports evidence hashing, chain of custody and activity audit trails
- Connects through REST API, webhooks and security tools such as MISP
Where it doesn't
- Self-hosted deployment requires teams to manage their own infrastructure
- Focuses on security investigations rather than on-call and escalation workflows
- No verified postmortem, status-page or mobile capabilities
Our verdict on DFIR-IRIS
DFIR-IRIS is an open-source incident response platform for teams investigating security incidents. Its case management brings alerts, assets, indicators of compromise, tasks, notes, evidence, timelines and reports together. That makes it a fit for security operations and digital forensics teams that need an organized investigation record, rather than a general incident-management tool centered on on-call coordination.
The product’s depth is concentrated in the investigation itself. Alerts can be ingested, clustered, triaged and promoted to cases; investigators can build timelines and export a narrative. Collaborative war rooms provide chat, threads, teams and slash commands. For evidence handling, DFIR-IRIS supports hashing, tagging, chain of custody and manifest export, while configurable PDF and DOCX templates help document outcomes. Case- and group-level role-based access control and audit trails cover permissions and activity. These features suit teams that need detailed, collaborative casework and traceable evidence handling.
DFIR-IRIS is designed for self-hosted deployment, including Docker-based installation, and offers a REST API, Python modules and webhook integrations. Listed integrations include MISP, VirusTotal, IntelOwl, SIEM and EDR, so it can fit into a security tooling environment that the team operates. The tradeoff is operational responsibility for hosting and maintaining the platform. Its focus is case investigation, not the broader incident-response workflow: teams prioritizing on-call schedules, escalation, postmortems, status pages or mobile access should look elsewhere. Choose DFIR-IRIS when open-source, self-hosted security case management is the priority.
Your product? Our editors can test DFIR-IRIS in depth and publish a review, labelled as paid · from $149/mo →
DFIR-IRIS pricing
DFIR-IRIS fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Escalation policies | Not verified |
| Post-incident reviews | Not verified |
| Status pages | Not verified |
| Mobile apps | Not verified |
| Audit logs | Yes |
| Incident retention | Not verified |
| Deployment | Cloud, Self-hosted |
| Platforms | Web |
| Integrations | 8 integrations: MISP, VirusTotal, IntelOwl, SIEM, EDR, Webhooks … |
| Pricing | Free plan |
| Website | dfir-iris.org |
| Facts checked | 19 Sep 2026 |
DFIR-IRIS integrations
DFIR-IRIS lists 8 integrations on its own site.
- MISP
- VirusTotal
- IntelOwl
- SIEM
- EDR
- Webhooks
- REST API
- IrisCheck
Alternatives to DFIR-IRIS
- AlertOpsBroad incident response coverage with a free plan and paid tiers from $10 per user monthly.9.4
- PagerDutyPagerDuty routes incidents to on-call responders and coordinates response across teams.9.3
- incident.ioA chat-native incident platform with on-call, workflows, status pages, and postmortems.9.1
See all DFIR-IRIS alternatives →
Also Ranked In
DFIR-IRIS is ranked in 3 of our directories.
Used DFIR-IRIS? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used DFIR-IRIS for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
DFIR-IRIS is listed in our Incident Management Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/dfir-iris/"><img src="https://www.itechguides.com/best/badge/dfir-iris.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update