DFIRe

Overview

DFIRe is a self-hosted case-management system for digital forensics and incident response. It is best suited to teams that need structured investigations and accountable evidence handling within infrastructure they operate. Its specialized workflow and offline option are appealing, but the annual licence and the work of securing and maintaining the deployment rule it out for teams seeking a managed service.

Key features

Teams can tailor case types, severity levels, assignments, and escalation, carrying a case from triage into incident response without losing its history. Fifteen default playbooks provide a useful starting framework, and teams can edit or replace them. That flexibility suits organizations with established procedures, though it also means they must decide how those procedures should work.

Evidence is organized hierarchically, with configurable attributes, verifiable custody records, printable receipts, and transfer records. That makes DFIRe more purpose-built for investigations where evidence handling must be documented than a general case tracker. Compliance timers and reminders can cover breach notifications, statutory reporting, and SLAs, helping teams keep deadlines attached to case work.

The IOC registry supports STIX 2.1 types, enrichment from named threat-intelligence providers, and sharing through MISP and TAXII. Slack collaboration, bidirectional Jira synchronization, webhooks, and SIEM or log-forwarding integrations connect investigations to surrounding operations. Reports have structured sections, a QA workflow, and generated evidence inventories; optional LLM drafting uses a provider chosen by the customer, giving teams a drafting aid without binding them to one provider.

Documented security controls include OIDC single sign-on, two-tier role-based access control, AES-256-GCM encryption for attachments, and an immutable, fail-closed audit trail. Those controls do not remove the operator's security burden: customers must secure the database, file storage, network, server infrastructure, and backups, and case data remains plaintext in the database for performance and full-text search.

Pricing

The Non-commercial plan has custom pricing and is granted case by case to individuals, students, educational organizations, charities, and community users. It includes all features, making it the relevant route for qualifying non-commercial use, but access is not automatic.

The Annual licence costs €9,900 a year, billed 9,900 EUR / year, with VAT 0%, added per EU rules. It includes unlimited users and cases for a single production deployment, can be converted to an offline licence, and starts with a 90-day trial. The unlimited case and user allowance avoids per-seat or case caps, but the single-deployment term matters to organizations that need separate production instances.

Small teams pricing is custom for small organisations, with the same deployment model and features and unlimited cases. It may suit a smaller organization that needs the full deployment model, but no published price allows a direct cost comparison. The free plan and trial offer an entry point, while the 90-day trial gives teams a defined evaluation period before a paid annual commitment.

Platforms

DFIRe supports API, Linux, self-hosted, and web use. The tested and supported deployment model is Docker Compose on a Linux host; other container platforms are not supported. Production requires Docker Engine 24.0 or later, Compose 2.24.4 or later, and PostgreSQL 16 or later. Air-gapped deployment and offline licensing make it viable for networks without internet access, provided the organization can operate the required infrastructure.

Who it's for

DFIRe fits digital forensics and incident-response teams that need customizable case processes, traceable evidence custody, reporting, and integrations in a self-managed environment. Its offline capability is useful for isolated networks. Teams without Linux and database operations capacity, or those wanting a vendor-managed environment, should look elsewhere.

Pros and cons

• Pros: Unlimited users and cases on the annual licence avoid scaling charges tied to case volume or team size.
• Pros: Evidence custody records, receipts, transfers, and an immutable audit trail support accountable investigation workflows.
• Pros: Air-gapped deployment and offline licensing serve teams working without internet access.
• Cons: One production deployment per annual licence can constrain organizations that need multiple live environments.
• Cons: Customers must secure and back up the entire stack, while case data is stored plaintext in the database.
• Cons: Docker Compose on Linux is the supported deployment model, limiting teams standardized on other container platforms.

Alternatives

DFIR-IRIS is worth considering when a no-licence-fee, self-hosted option matters more than DFIRe's particular evidence and case-workflow controls; it is free and open-source, with API, Linux, macOS, web, and Windows platforms.

Forensicator is a free, open-source cross-platform incident response toolkit for teams looking for a toolkit rather than DFIRe's case-management focus. GRR Rapid Response is another free, self-hosted option, released under Apache License 2.0.

LimaCharlie may suit teams wanting a free Community tier for up to two endpoints, with EDR free and CNAPP at $150/organization. ORNA offers a self-managed free plan for teams seeking a free platform option.

SIFT Workstation is a free, open-source choice for teams looking for a forensic workstation, with an OVA download and Ubuntu 22.04 installation options. TraceLock CRM is a free, open-source self-hosted CRM with no per-seat pricing, a different fit for teams prioritizing CRM use.

Binalyze AIR is an alternative with a free trial for teams comparing paid incident-response software.

Browse Incident Response Software, Incident Management Software, or Case Management Software for more options in adjacent categories.

Verdict

Choose DFIRe if your forensics or incident-response team needs adaptable case workflows, documented evidence custody, and offline self-hosting, and can take responsibility for operating the stack. Its unlimited users and cases strengthen the proposition for one production deployment, but teams that need managed hosting, multiple licensed deployments, or a lower-cost entry point should look elsewhere.