Fully-featured case management platform for SecOps, Incident Response, and Digital Forensics teams.
Track investigations, manage evidence with chain of custody, enrich threat indicators from leading intelligence providers, coordinate response with your team in Slack, and generate AI-assisted reports — all on your own infrastructure.
90-day free trial. No credit card required.
DFIRe is a fully self-hosted solution. Deploy it on your own servers, behind your firewall, with your security policies. No incident data ever leaves your infrastructure.
Everything your team needs to manage forensic investigations and incident response workflows.
Organize investigations with customizable case types, severity levels, and team assignments. Support for both triage investigations and escalating to incident response workflows.
Track digital and physical evidence with hierarchical organization, configurable attributes, and an immutable chain-of-custody record with printable receipts. Procedural runbooks attach to evidence and actions so handling steps are documented and auditable.
Visual timeline for tracking incident phases, from detection through recovery. Guided response actions with phase-based checklists and automatic progress tracking. Connect webhooks with runbooks to automate common response activities.
Built-in tracking for regulatory reporting requirements like GDPR breach notifications. Customizable timer definitions, automatic reminders, and deadline tracking to ensure your legally mandated reporting obligations are met.
Encrypted Storage protects attachments up to 4 GB with AES-256 and a three-layer key hierarchy (tenant, case, and item keys), so data is unreadable even if the storage backend gets compromised. Larger forensic-scale files stream through the Direct Storage tier straight to a configurable backend without DFIRe-layer encryption.
Role-based access control with customizable permission groups for lead investigators, case members, and viewers. Slack integration for workflow management, inline action controls, and an in-channel AI assistant that answers questions and summarizes cases on demand.
Structured investigation reports with customizable sections, QA workflow, and markdown support. Auto-generated evidence inventories and timelines. Optional AI generation for CAN reports and individual sections using Anthropic, Gemini, Azure OpenAI, GitHub Models, or any OpenAI-compatible provider including local LLMs.
Bidirectional Jira Cloud sync, outbound webhooks with templated payloads for SIEM and SOAR platforms, audit-log forwarding, and per-user API keys with full OpenAPI docs for automated case creation and any other integration.
SSO integration via the OIDC standard, compatible with any OIDC provider including Google Workspace, Microsoft Entra ID, and other providers. Session management with instant revocation and IP tracking.
Built-in IOC registry across all STIX 2.1 types with automatic enrichment from leading intelligence providers including VirusTotal, AbuseIPDB, Shodan, GreyNoise, MISP, urlscan, and Spur.us. Hierarchical decomposition, cross-case correlation, TAXII 2.1 server, and MISP-compatible feed for downstream consumers.
Per-case AI assistant for summaries and Q&A in the web UI and Slack. Auto-generate CAN reports and structured report sections with the configured LLM provider. Built-in MCP server lets agents like Claude Code act as virtual responders with full RBAC and audit logging.
AES-256-GCM encrypted database backups with configurable schedules, deep validation, and one-click restore. Per-target storage roles isolate backups from primary case storage.
Modern, intuitive interface designed for efficiency. Use the arrows or drag to browse.
Dashboard Overview
Case Report Tab
Case Timeline
Case Actions & Workflows
Case Notes
Encrypted Attachments
Case Evidence
Evidence Item Detail
Chain of Custody
Compliance Timers
Investigation Report
IOC Registry
IOC Enrichment
Add IOC
Global Search
Playbook Designer
Storage Targets
System Audit Log
One license fee covers your entire deployment regardless of seat count, company size, or which features you use.
Start with a 90-day free trial. No credit card required.
Deploy DFIRe with Docker Compose. Self-hosted means your data stays on your infrastructure. The install script installs or upgrades DFIRe to the latest version automatically.
curl -fsSL https://dfire.fi/install.sh -o install.sh
chmod +x install.sh && ./install.sh
The script will guide you through configuration and start the services.
https://your-server:443
Create your admin account and start investigating.
For advanced deployments, custom configurations, or air-gapped environments, see the deployment documentation.