Overview

DFIR-IRIS grew from an idea within Airbus CyberSecurity’s commercial CSIRT in France in 2019 and became open source in December 2021 with Airbus CyberSecurity’s agreement and support. It gives investigations a common workspace rather than scattering case materials across separate processes. That is a strong fit for teams coordinating complex response work, provided they can manage a self-hosted system and its security.

Key features

Cases, alerts and evidence

Each case can hold assets, indicators of compromise, tasks, evidence and notes, with an audit trail. Alerts from SIEM and EDR tools, MISP, IntelOwl or REST endpoints can be collected, triaged and promoted to cases. This connects alert handling to subsequent investigation work without treating each alert as an isolated item.

Evidence supports SHA-256, MD5 and SHA-1 verification, access restrictions, and logged downloads, views and changes. Those controls are useful when teams need to account for access and document handling; they do not remove the need to operate IRIS in an appropriately restricted environment.

Collaboration and reporting

War rooms combine real-time chat and threaded discussion with per-room teams and slash commands that record decisions and case actions. Configurable Jinja templates can generate PDF or DOCX executive summaries, technical reports or court-ready documents. The combination helps carry discussion and decisions into a case record and its outputs.

Integrations and permissions

Named modules include IrisVT, IrisMISP, IrisCheck and IrisWebHooks. IRIS also provides a REST API and 162 hook binding points, offering teams several routes to connect it with their workflows. Role-based permissions and case-level controls include deny-all, read-only and full-access levels, allowing access to be scoped beyond a single broad permission.

Pricing

Free and open-source: 0.00 USD per free. The plan has no licence fee and uses self-hosted deployment. That makes the software accessible without a licence charge, but organizations must take responsibility for running the platform themselves. The project lists getting-started help, support and implementation, and training; contact contact@dfir-iris.org for details.

Platforms

DFIR-IRIS supports API, Linux, macOS, self-hosted, web and Windows. Its documentation recommends Docker and Docker Compose; Linux and macOS are officially supported, while Windows may require Dockerfile changes for file-storage paths. Teams planning a Windows deployment should account for that extra adjustment.

The documentation identifies v3.0.0-beta.1 as the current v3 release and cautions that beta versions are not production-ready. It also advises keeping IRIS within a restricted environment and not exposing it to the Internet. Those are material constraints: this is not a default choice for teams seeking a production-ready, publicly reachable hosted service.

Who it's for

DFIR-IRIS suits digital forensics and incident response teams that want to coordinate alerts, investigations, evidence and reporting in a shared case workspace, and have the capability to deploy and secure it. It is a weaker fit for organizations that need a production-ready release now, cannot self-host, or need Internet-facing access.

Pros and cons

Pros

Case records unite assets, indicators, tasks, evidence and notes with an audit trail, supporting continuity across an investigation.
Evidence verification and logged access actions provide concrete accountability controls for sensitive case materials.
War rooms, configurable reports, named modules and API hooks connect collaboration and workflow integration to casework.
No licence fee lowers the software cost for teams able to operate a self-hosted deployment.

Cons

The current v3 release is beta and explicitly not production-ready, which limits its suitability for operational adoption.
Deployment requires self-hosting; Windows may need file-storage path changes in the Dockerfile.
The project advises against Internet exposure, ruling it out for deployments that require a publicly accessible service.

Alternatives

For a free plan with capped staffing and document allowances, Socianote offers up to 3 staff, 50 people, 1 programme and 200 documents; it is a different option for teams whose work fits those limits and its Android, iOS or web platforms.

Pega Investigative Case Management is a paid web, iOS and Android alternative. IntegrityLog is another paid option, available on web, iOS and Android.

Marble Case Manager has a free, open-source self-hosted plan with a real-time decision engine and community support, making it an alternative for case management needs centered on that offer.

UiPath Maestro Case Management offers a free trial and is self-hosted; consider it if a trial-based alternative is preferable. ServiceNow HR Service Delivery includes HR Knowledge Search and Virtual Agent capabilities, making it a different choice for HR service delivery rather than incident response.

Collaborate uses custom pricing based on organization size, user count and modules, with no per-seat licensing fees; it may suit organizations looking for that pricing structure. Primero offers a free, open-source self-managed tier, with documentation and community support, for teams seeking that kind of deployment.

For broader comparisons, see Case Management Software, Incident Response Software and Incident Management Software.

Verdict

Choose DFIR-IRIS if your response team needs a no-licence-fee, self-hosted workspace that ties alert triage to auditable casework, evidence handling and reporting. Look elsewhere if production readiness or Internet exposure is essential: the v3 release is beta, and the project advises against exposing the system to the Internet.

	DFIR-IRIS	Referra OS
Free plan	Yes	No
Free trial	No	No
Paid from	Free	—
Open source	No	No
Platforms	api, Linux, macOS, self-hosted, Web, Windows	Web
Free plan	Yes	No
Audit trail	—	Yes
Reporting dashboards	—	Yes
Deployment	—	cloud

DFIR-IRIS vs Referra OS

DFIR-IRIS

Referra OS