DFIRe
DFIRe: A compliance-focused investigation workspace, with a €9,900 annual licence and self-hosted deployment. Ranked #21 of 28 in Incident Management Software by our editors (6.9/10); pricing: Free plan · 90-day trial; best for security teams needing compliance-focused investigations.
At a glance
- Editor score6.9 / 10
- PricingFree plan · 90-day trial
- Best forSecurity teams needing compliance-focused investigations
- Free planYes
- Paid from€9,900/yr
- Facts checked19 Sep 2026
Where it wins
- Tracks evidence custody, compliance timers, and investigation-to-incident escalation
- Includes phase-based workflows, custom playbooks, and structured reports
- Supports self-hosting, air-gapped deployments, audit logs, and SIEM forwarding
Where it doesn't
- Annual commercial licence costs €9,900 and is deployment-based
- The free plan is case by case and limited to qualifying non-commercial use
- No on-call, escalation, status-page, or mobile features
Our verdict on DFIRe
DFIRe is a self-hosted case-management platform for digital forensics and incident-response teams. It brings investigations, incidents, evidence, indicators, workflows, reports, compliance timers, and team assignments into one deployment. Its focus is investigations that may need to become incident-response work, making it a fit for security teams that need structured records and evidence handling rather than a general-purpose on-call service.
The investigation workflow is a central strength: cases can be escalated into incidents, then managed through phases with assigned action checklists and custom playbooks or runbooks. Evidence management includes chain of custody, while reports can generate evidence inventories and timelines. Compliance timers and reminders support time-bound processes, and append-only searchable audit logs can be forwarded to SIEM systems. Role-based permissions and OIDC single sign-on add access controls. Encrypted attachment storage and scheduled backups are part of the offering; customer-controlled infrastructure and air-gapped deployment are options for teams with infrastructure constraints.
Pricing is structured around deployments, not user seats. The annual licence is €9,900 per year and includes unlimited users and cases for a single production deployment; it starts with a 90-day trial and can be converted to an offline licence. A non-commercial plan, granted case by case, includes all features for individual, student, educational, charity, and community use. Small organisations can request custom pricing for the same deployment model and features, with unlimited cases. DFIRe integrates with Slack, Jira, SIEM and log-management systems, S3-compatible storage, SMB/CIFS, and SFTP, and offers an API and webhooks. It suits teams prioritising investigation process, custody, and compliance; organisations seeking on-call coordination, escalation, status pages, or mobile features should consider alternatives.
Your product? Our editors can test DFIRe in depth and publish a review, labelled as paid · from $149/mo →
DFIRe pricing
All 3 DFIRe plans and prices →
DFIRe fact sheet
| Free plan | Yes |
|---|---|
| Paid from | €9,900/yr |
| Escalation policies | Not verified |
| Post-incident reviews | Not verified |
| Status pages | Not verified |
| Mobile apps | Not verified |
| Audit logs | Yes |
| Incident retention | Not verified |
| Free trial | 90 days |
| Deployment | Cloud, Desktop, Self-hosted |
| Platforms | Web, Linux |
| Integrations | 6 integrations: Slack, Jira, SIEM and log-management systems, S3-compatible storage, SMB/CIFS, SFTP |
| Pricing | Free plan · 90-day trial (source) |
| Website | dfire.fi |
| Facts checked | 19 Sep 2026 |
DFIRe integrations
DFIRe lists 6 integrations on its own site.
- Slack
- Jira
- SIEM and log-management systems
- S3-compatible storage
- SMB/CIFS
- SFTP
Alternatives to DFIRe
- AlertOpsBroad incident response coverage with a free plan and paid tiers from $10 per user monthly.9.4
- PagerDutyPagerDuty routes incidents to on-call responders and coordinates response across teams.9.3
- incident.ioA chat-native incident platform with on-call, workflows, status pages, and postmortems.9.1
Also Ranked In
DFIRe is ranked in 3 of our directories.
Used DFIRe? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used DFIRe for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
DFIRe is listed in our Incident Management Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/dfire/"><img src="https://www.itechguides.com/best/badge/dfire.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update