IRIS is a collaborative incident response platform designed to help security teams manage investigations and share technical information.
It brings alerts, cases, assets, indicators of compromise, notes, tasks, files and timeline events together in a central web interface.
The platform supports alert correlation and escalation, case templates, report generation, custom dashboards and granular access controls. Its modular architecture can enrich indicators and exchange data with services such as MISP, VirusTotal, Splunk and external webhook endpoints.
This is free and open source software.
Key Features
- Manage incident response cases through a collaborative web interface.
- Triage, correlate, merge and escalate security alerts.
- Track assets, indicators of compromise, notes, tasks and investigation files.
- Build investigation timelines with nested events and filtering.
- Create reusable case templates and generate case reports.
- Design custom dashboards for operational and investigation data.
- Extend functionality through modules for enrichment and external integrations.
- Control access using groups, customer assignments and granular permissions.
- Integrate with other tools through REST and GraphQL APIs.
- Deploy using Docker Compose, Kubernetes manifests or Helm charts.
Website: github.com/dfir-iris/iris-web
Support:
Developer: DFIR-IRIS Team
License: GNU Lesser General Public License v3.0
DFIR-IRIS is written in Python and JavaScript. Learn Python with our recommended free books and free tutorials. Learn JavaScript with our recommended free books and free tutorials.
Related Software
| Incident Response | |
|---|---|
| GRR | Remote live forensics for incident response |
| GoAlert | On-call scheduling, automated escalations and notifications |
| OneUptime | Unified observability, on-call scheduling, and incident response |
| Keep | AI-powered alert correlation and workflow automation for operations teams |
| Alertmanager | Handles alerts sent by client applications such as the Prometheus server |
| Shuffle | Connects security tools to automate workflows and accelerate response |
| Velociraptor | Endpoint visibility and collection tool |
| DFIR-IRIS | Collaborative case management for forensics and incident response. |
| FIR | Cybersecurity incident management platform |
| Iris | Automated incident paging system at LinkedIn |
| Dispatch | Manage security incidents by deeply integrating with existing tools |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.