Side by side

DFIR-IRIS vs Primero

Both stand on case management software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.

DFIR-IRIS

Free plan Open source APILinuxMac+3

DFIR-IRIS brings case records, evidence controls, collaboration and reporting into a self-hosted incident response platform. Its beta release status and restricted-environment guidance are important deployment considerations.

Visit DFIR-IRIS

Primero

Free plan AndroidAPIiPhone+2

Primero combines case intake and reporting tools with three deployment choices. The plans make the trade-offs in hosting and operational support explicit, from self-management to hosted or hybrid service.

Visit Primero

The facts

	DFIR-IRIS	Primero
Free plan	Yes	Yes
Open source	Yes	Not published
Runs on	API, Linux, Mac, Self-hosted, Web, Windows	Android, API, iPhone, Self-hosted, Web
Lowest paid plan	Free or on request	Tier 3: Full Service SaaS: $8,250 a year
Plans published	2	5
Maker	DFIR-IRIS	Primero
Website	dfir-iris.org	primero.org
On case management software	#1 of 177	#2 of 177

DFIR-IRIS: what it does well

Free and open-source with self-hosted deployment.
Cases include an audit trail.
Evidence verification supports three hash algorithms.
Reports can be generated as PDF or DOCX.

What to know first

Current v3 release is beta and not production-ready.
Windows may need Dockerfile changes for file storage.
Project advises against Internet exposure.
Linux and macOS are the officially supported systems.

Primero: what it does well

Case intake forms and custom fields
Audit trails and reporting dashboards
Free self-managed open-source plan
Full Service SaaS has no user or data-volume limits
Hybrid plan includes a locally hosted production instance

What to know first

DIY plan is self-managed
DIY includes documentation and community support
Full Service SaaS costs $8,250 per year
Hybrid deployment costs $25,000 per year

Alternatives to DFIR-IRIS Alternatives to Primero The whole list