IRIS is a collaborative incident response platform designed to help security teams manage investigations and share technical information.
It brings alerts, cases, assets, indicators of compromise, notes, tasks, files and timeline events together in a central web interface.
The platform supports alert correlation and escalation, case templates, report generation, custom dashboards and granular access controls. Its modular architecture can enrich indicators and exchange data with services such as MISP, VirusTotal, Splunk and external webhook endpoints.
This is free and open source software.
Key Features
- Manage incident response cases through a collaborative web interface.
- Triage, correlate, merge and escalate security alerts.
- Track assets, indicators of compromise, notes, tasks and investigation files.
- Build investigation timelines with nested events and filtering.
- Create reusable case templates and generate case reports.
- Design custom dashboards for operational and investigation data.
- Extend functionality through modules for enrichment and external integrations.
- Control access using groups, customer assignments and granular permissions.
- Integrate with other tools through REST and GraphQL APIs.
- Deploy using Docker Compose, Kubernetes manifests or Helm charts.
Website: github.com/dfir-iris/iris-web
Support:
Developer: DFIR-IRIS Team
License: GNU Lesser General Public License v3.0
DFIR-IRIS is written in Python and JavaScript. Learn Python with our recommended free books and free tutorials. Learn JavaScript with our recommended free books and free tutorials.
Related Software
| Incident Response | |
|---|---|
| GRR | Remote live forensics for incident response |
| GoAlert | On-call scheduling, automated escalations and notifications |
| Alertmanager | Handles alerts sent by client applications such as the Prometheus server |
| Velociraptor | Endpoint visibility and collection tool |
| FIR | Cybersecurity incident management platform |
| Dispatch | Manage security incidents by deeply integrating with existing tools |
| Cabot | Monitoring and alerts service |
| Iris | Automated incident paging system at LinkedIn |
Read our verdict in the software roundup.
 Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category.This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form. |
Please read our Comment Policy before commenting.