dfir-iris/iris-web

Health v2 · maintenance only

Adoption not part of the score

1546 stars · 321 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

IRIS is a self-hosted, collaborative web platform for incident responders to share technical details and manage investigations. It ships as Docker containers with a web app, PostgreSQL database, RabbitMQ job queue, worker, and NGINX reverse proxy, and is extensible via IrisModules.

Use cases

• manage incident response investigations with a team
• track forensic evidence and timelines for a security incident
• enrich IOCs with MISP and VirusTotal during an investigation
• run a CSIRT case management platform
• share investigation details across incident responders
• upload EVTX logs and inject them into Splunk from a case

When to choose

• you need a collaborative DFIR case management platform you can self-host
• your CSIRT wants shared timelines, tasks, and IOC enrichment in one place
• you want a Docker-deployable incident response tool with an API and plugin modules

When to avoid

• you need a SIEM or log aggregation platform rather than case management
• you want a lightweight single-user forensics toolkit without a web server
• you cannot run Docker or PostgreSQL infrastructure

Facets

application · maturity active

self-hosted workflow-automation developer-tools security developer-tools self-hosted self-hosted incident-response digital-forensics dfir csirt case-management collaboration soc docker web-server linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="dfir-iris/iris-web")