No. 10 of 27 ·Incident Management Software

FIR (Fast Incident Response)

Web · Self-hosted · API

Freedom report

Two barsScore 6.3

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

FIR (Fast Incident Response) is ranked #10 of 27 in incident management software on Freedom251. It runs on API, Self-hosted, Web. There is a free plan.

FIR (Fast Incident Response) plans and pricing

All plans

FIR Free GPL-3.0 · self-hosted github.com · 4 Oct 2026

Best FIR (Fast Incident Response) alternatives

See all 20

Two bars DFIR-IRIS Free tier No. 1Free6.6 Two bars Grafana Cloud Application Observability Free tier No. 2$0.03/mo6.6 Two bars incident.io Free tier No. 3$15/mo6.6 Two bars ITOC360 Free tier No. 4$12/mo6.6 Two bars PagerDuty Free tier No. 5$233.33/mo6.6 Two bars Spectate Free tier No. 6Free6.6

The record

Purpose: FIR is a cybersecurity incident management platform for creating, tracking, and reporting incidents.
Intended users: The project says FIR is for teams that track cybersecurity incidents, including CSIRTs, CERTs, and SOCs.
Incident fields: Incidents can include category, status, detection method, severity from 1 to 4, date and time, description, and TLP confidentiality.
Artifacts: FIR extracts artifacts such as IP addresses, hostnames, URLs, email addresses, and hashes, and displays correlated artifacts from other incidents.
Incident workflow: Users can add comments, files, attributes, todos, or nuggets and change an event's status to open, blocked, or closed.
Reporting: The incident follow-up action opens a one-page report intended to be printed as a PDF for business lines.
Templates: Incident templates can prefill incident creation fields, and the project documentation says none are defined by default.
Custom attributes: Teams can define numeric incident attributes such as financial loss, stolen credential counts, or downtime and use them for statistics.
Integrations: The repository includes optional plugins for MISP, LDAP, OIDC, two-factor authentication, and an API.
Deployment: FIR can be run with Docker for testing or occasional use, or installed in a production environment for daily use.
Technical stack: FIR is written in Python with Django and Bootstrap, and the README describes MySQL while allowing other Django-compatible database adapters.
Deployment requirements: The README says FIR can run smoothly on an Ubuntu virtual machine with 1 core, 40 GB disk, and 1 GB RAM.
License: The public repository identifies its license as GPL-3.0.
Price from: Free

Where it ranks on Freedom251

Best Incident Management Software in 2026#10 of 27

Is FIR (Fast Incident Response) yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote FIR (Fast Incident Response)

Sources

github.com/certsocietegenerale/fir· checked 4 Oct 2026
github.com/certsocietegenerale/FIR/wiki/Creating-a· checked 4 Oct 2026
github.com/certsocietegenerale/FIR/wiki/Incident-T· checked 4 Oct 2026
github.com/certsocietegenerale/FIR/wiki/Attributes· checked 4 Oct 2026
github.com/certsocietegenerale/FIR· checked 4 Oct 2026
github.com/certsocietegenerale/FIR/wiki· checked 4 Oct 2026