DFIRe review
A compliance-focused investigation workspace, with a €9,900 annual licence and self-hosted deployment.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
DFIRe is a self-hosted case-management platform for digital forensics and incident-response teams. It brings investigations, incidents, evidence, indicators, workflows, reports, compliance timers, and team assignments into one deployment. Its focus is investigations that may need to become incident-response work, making it a fit for security teams that need structured records and evidence handling rather than a general-purpose on-call service.
The investigation workflow is a central strength: cases can be escalated into incidents, then managed through phases with assigned action checklists and custom playbooks or runbooks. Evidence management includes chain of custody, while reports can generate evidence inventories and timelines. Compliance timers and reminders support time-bound processes, and append-only searchable audit logs can be forwarded to SIEM systems. Role-based permissions and OIDC single sign-on add access controls. Encrypted attachment storage and scheduled backups are part of the offering; customer-controlled infrastructure and air-gapped deployment are options for teams with infrastructure constraints.
Pricing is structured around deployments, not user seats. The annual licence is €9,900 per year and includes unlimited users and cases for a single production deployment; it starts with a 90-day trial and can be converted to an offline licence. A non-commercial plan, granted case by case, includes all features for individual, student, educational, charity, and community use. Small organisations can request custom pricing for the same deployment model and features, with unlimited cases. DFIRe integrates with Slack, Jira, SIEM and log-management systems, S3-compatible storage, SMB/CIFS, and SFTP, and offers an API and webhooks. It suits teams prioritising investigation process, custody, and compliance; organisations seeking on-call coordination, escalation, status pages, or mobile features should consider alternatives.
DFIRe pros and cons
- Where it wins
- Tracks evidence custody, compliance timers, and investigation-to-incident escalation
- Includes phase-based workflows, custom playbooks, and structured reports
- Supports self-hosting, air-gapped deployments, audit logs, and SIEM forwarding
- Where it doesn't
- Annual commercial licence costs €9,900 and is deployment-based
- The free plan is case by case and limited to qualifying non-commercial use
- No on-call, escalation, status-page, or mobile features
DFIRe fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update