What it does
DFIR-IRIS is an open-source incident-response platform for organizing cases, timelines, evidence and collaborative investigation work.
DFIR-IRIS gives incident responders a self-hosted place to share technical investigation details. Its homepage currently previews v3, so the displayed war rooms and rebuilt case view should not be assumed to belong to the stable release. The official repository identifies v3.0.0-beta.1 as unsuitable for production and directs production users to v2.4.29. It also calls for database backups and a private dedicated network rather than exposing the interface publicly. Select the release documentation before planning the case workflow or an upgrade.
Strengths
- Self-hosted collaborative case-management approach
Watch out for
- The reviewed homepage presents v3 features as coming soon
Best for
- Teams organizing internally hosted incident cases
Sources
- DFIR-IRIS — Collaborative Incident Response Platform (Oct 26, 2026)
- IRIS official repository README (Oct 26, 2026)