Side by side
DFIR-IRIS vs DFIRe
Both stand on case management software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan Open source APILinuxMac+3
DFIR-IRIS brings case records, evidence controls, collaboration and reporting into a self-hosted incident response platform. Its beta release status and restricted-environment guidance are important deployment considerations.
Visit DFIR-IRIS
Free plan APILinuxSelf-hosted+1
DFIRe brings case workflows, evidence records, integrations, and reporting together for self-hosted response teams. The annual licence is €9,900 a year for one production deployment, and customers retain responsibility for securing their environment.
Visit DFIReThe facts
| DFIR-IRIS | DFIRe | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Yes | No |
| Runs on | API, Linux, Mac, Self-hosted, Web, Windows | API, Linux, Self-hosted, Web |
| Lowest paid plan | Free or on request | Annual licence: €9,900 a year |
| Plans published | 2 | 3 |
| Maker | DFIR-IRIS | DFIRe |
| Website | dfir-iris.org | dfire.fi |
| On case management software | #1 of 177 | #3 of 177 |
DFIR-IRIS: what it does well
- Free and open-source with self-hosted deployment.
- Cases include an audit trail.
- Evidence verification supports three hash algorithms.
- Reports can be generated as PDF or DOCX.
What to know first
- Current v3 release is beta and not production-ready.
- Windows may need Dockerfile changes for file storage.
- Project advises against Internet exposure.
- Linux and macOS are the officially supported systems.
DFIRe: what it does well
- Escalates cases while preserving history
- Records evidence custody and transfers
- Includes customizable playbooks for fifteen case types
- Supports MISP and TAXII sharing
- Air-gapped deployment and offline licensing are supported
What to know first
- Customers secure infrastructure, storage, and backups
- Supported deployment is Docker Compose on Linux
- Annual licence covers one production deployment
- Database case data is stored in plaintext
Alternatives to DFIR-IRIS Alternatives to DFIRe The whole list