FREEDOM251

Freedom251 › Incident Management Software

FIR (Fast Incident Response)

Free plan APISelf-hostedWeb

Visit FIR (Fast Incident Response) Alternatives Pricing

FIR (Fast Incident Response)'s own site

What FIR (Fast Incident Response) is

FIR (Fast Incident Response) is a free, self-hosted cybersecurity incident management platform for creating, tracking, and reporting incidents. The project names CSIRTs, CERTs, and SOCs among its intended users. Incidents can record a category, status, detection method, severity from 1 to 4, date and time, description, and TLP confidentiality. FIR extracts artifacts such as IP addresses, hostnames, URLs, email addresses, and hashes, and can show correlated artifacts from other incidents. Teams can add comments, files, attributes, todos, or nuggets, then set an incident to open, blocked, or closed. A follow-up action creates a one-page report intended for printing as a PDF for business lines. Templates can prefill incident fields, but the documentation says none are defined by default. Teams can also define numeric attributes for statistics. Optional plugins cover MISP, LDAP, OIDC, two-factor authentication, and an API. FIR is written in Python with Django and Bootstrap, and its repository identifies GPL-3.0 as the license. Docker is described for testing or occasional use; production installation is available for daily use.

Who it suits

FIR suits incident-response teams such as CSIRTs, CERTs, and SOCs that need to manage incident details and follow-up. It is designed to be self-hosted.

What it does well

  • Free under the GPL-3.0 license
  • Tracks incident details and correlated artifacts
  • Supports comments, files, attributes, todos, and nuggets
  • Creates a one-page follow-up report
  • Optional plugins include MISP, LDAP, and OIDC

What to know first

  • No incident templates are defined by default
  • Docker is described for testing or occasional use

Plans

PlanBilled and limitsPrice
FIRGPL-3.0 · self-hostedFree

As github.com lists them, read 4 Oct 2026. The maker's own page has the final word.

Getting started

  1. Open the FIR GitHub repository.
  2. Choose Docker for testing or occasional use, or install FIR in a production environment for daily use.
  3. Configure a Django-compatible database; the README describes MySQL.
  4. Add incident templates if you want prefilled fields; none are defined by default.
  5. Create an incident and track its details, artifacts, and follow-up.

Verdict

FIR brings incident tracking, artifact correlation, and reporting into a self-hosted platform. Teams should account for its self-hosted deployment and prepare their own templates if needed.

Questions

Is FIR free?

Yes. FIR is identified as open source under the GPL-3.0 license, and its listed plan is free.

Who is FIR for?

The project describes it for teams tracking cybersecurity incidents, including CSIRTs, CERTs, and SOCs.

Can FIR be self-hosted?

Yes. Its listed platforms include self-hosted, web, and API. Docker is described for testing or occasional use, with production installation for daily use.

What integrations are available?

Optional plugins in the repository cover MISP, LDAP, OIDC, two-factor authentication, and an API.

What can an incident record contain?

Records can include category, status, detection method, severity from 1 to 4, date and time, description, and TLP confidentiality. Teams can also add comments, files, attributes, todos, or nuggets.

What technology and license does FIR use?

FIR is written in Python with Django and Bootstrap. The public repository identifies GPL-3.0 as its license and describes MySQL while allowing other Django-compatible database adapters.

Facts from FIR (Fast Incident Response)'s own pages

Artifacts
FIR extracts artifacts such as IP addresses, hostnames, URLs, email addresses, and hashes, and displays correlated artifacts from other incidents. · github.com, 4 Oct 2026
Custom attributes
Teams can define numeric incident attributes such as financial loss, stolen credential counts, or downtime and use them for statistics. · github.com, 4 Oct 2026
Deployment
FIR can be run with Docker for testing or occasional use, or installed in a production environment for daily use. · github.com, 4 Oct 2026
Deployment requirements
The README says FIR can run smoothly on an Ubuntu virtual machine with 1 core, 40 GB disk, and 1 GB RAM. · github.com, 4 Oct 2026
Incident fields
Incidents can include category, status, detection method, severity from 1 to 4, date and time, description, and TLP confidentiality. · github.com, 4 Oct 2026
Incident workflow
Users can add comments, files, attributes, todos, or nuggets and change an event's status to open, blocked, or closed. · github.com, 4 Oct 2026
Integrations
The repository includes optional plugins for MISP, LDAP, OIDC, two-factor authentication, and an API. · github.com, 4 Oct 2026
Intended users
The project says FIR is for teams that track cybersecurity incidents, including CSIRTs, CERTs, and SOCs. · github.com, 4 Oct 2026
License
The public repository identifies its license as GPL-3.0. · github.com, 4 Oct 2026
Purpose
FIR is a cybersecurity incident management platform for creating, tracking, and reporting incidents. · github.com, 4 Oct 2026
Reporting
The incident follow-up action opens a one-page report intended to be printed as a PDF for business lines. · github.com, 4 Oct 2026
Technical stack
FIR is written in Python with Django and Bootstrap, and the README describes MySQL while allowing other Django-compatible database adapters. · github.com, 4 Oct 2026
Templates
Incident templates can prefill incident creation fields, and the project documentation says none are defined by default. · github.com, 4 Oct 2026

Where FIR (Fast Incident Response) stands on Freedom251

Look at these too