Dashboard

The Dashboard is the first page you see after logging in to DFIRe. It provides a centralized view of all cases you have access to, along with filtering controls and summary statistics to help you stay on top of your investigations and incidents.

Case List

The Dashboard displays your cases as a list of cards. Each case card provides a quick overview of the most important details at a glance:

  • Case number - The unique identifier assigned to the case (e.g., CASE-2026-001)
  • Severity badge - Color-coded indicator showing the severity level (Critical, High, Medium, Low, or Info)
  • Status - Current case status (Open, Closed, or Archived)
  • Project - The project the case belongs to, if any
  • Classification / Type - The case type that defines the schema and workflow
  • Title - The descriptive name of the case
  • Description - A brief summary of the investigation or incident
  • Lead investigator and team count - Who is leading the case and how many team members are assigned
  • Evidence count - The number of evidence items attached to the case
  • Attachment count - The number of files uploaded to the case
  • Compliance timer countdown - Remaining time on active compliance deadlines, if applicable
  • Incident phase - The current response phase for incident cases
  • Creation date - When the case was created

The information shown on the card varies slightly depending on the case mode. Incident cases display a progress bar representing the completion status of response actions, along with the current incident phase. Investigation cases show the creation date prominently.

Filtering Cases

The Dashboard provides a comprehensive set of filters to help you narrow down the case list to exactly what you need.

Filter Dropdowns

A row of dropdown filters is available at the top of the case list:

  • All Projects - Filter cases by project. Select a specific project to show only cases belonging to it.
  • All Investigators - Filter cases by the lead investigator or team member assigned.
  • All Statuses - Filter by case status (Open, Closed, or all).
  • All Severities - Filter by severity level to focus on the most critical cases.

Mode Toggle

Use the mode toggle to switch between viewing all cases, only investigations, or only incidents:

  • All - Displays both investigation and incident cases
  • Investigations - Shows only investigation-mode cases
  • Incidents - Shows only incident-mode cases

Active and Archived Tabs

Two tabs at the top of the case list let you switch between active and archived cases:

  • Active Cases - Cases that are currently open or closed but not archived
  • Archived - Cases that have been archived and are no longer actively worked on

Summary Statistics

A statistics bar is displayed above the case list, providing a high-level overview of your caseload. The statistics shown include:

  • Total cases - The total number of cases matching the current filters
  • Open count - Number of cases with Open status
  • Closed count - Number of cases with Closed status
  • Archived count - Number of archived cases
  • Investigation / Incident split - Breakdown of cases by mode
  • Severity donut chart - A visual chart showing the distribution of cases across severity levels
  • MTTR (Mean Time To Resolve) - The average time taken to resolve cases

The summary statistics update dynamically as you apply or change filters. This means the numbers and charts always reflect the currently visible subset of cases, not the entire case database.

Creating Cases and Projects

The Dashboard provides quick access to creating new cases and projects directly from the top of the page.

New Case

Click the "New Case" button to open the case creation modal. This allows you to set up a new investigation or incident with all the required details including mode, severity, classification, and description.

New Project

Click the "New Project" button to create a new project for grouping related cases together. Projects help you organize cases that share a common context, client, or scope of work.

For detailed instructions on creating and configuring cases, including mode selection, severity levels, and team assignment, see the Case Management documentation.

Navigation

The header bar at the top of the application provides quick navigation to key areas of DFIRe from any page:

  • Dashboard icon (list icon) - Returns to the Dashboard case list from any page
  • IOC Registry (fingerprint icon) - Opens the global Indicators of Compromise registry to browse, manage, and search all IOC indicators across the system
  • Entities button - Navigate to the Entities section to manage persons and organizations associated with your cases
  • Search button - Opens the global search interface for full-text search across all cases, evidence, notes, indicators, and attachments
  • User avatar menu - Access your user profile, system settings (for administrators), and log out

These navigation elements are always available in the header, regardless of which page you are currently viewing.