Knowledge Base - DFIRe Documentation

What Belongs in the Knowledge Base?

The Knowledge Base is not meant to replace a full documentation platform. It is a convenient reference source for the material investigators reach for mid-case:

Standard operating procedures and triage checklists
Site- or customer-specific instructions ("how to request logs from site X")
Escalation paths, on-call rosters, and contact information
Tool notes, query snippets, and command references
Sensitive operational notes — protected with a password where warranted

Reading the Knowledge Base requires the Knowledge Base view permissions, which every default role includes — so out of the box, every user can browse it. Remove the view permissions from a role to withhold the Knowledge Base from it entirely: the Knowledge Base disappears from the navigation and from search for those users. Within the Knowledge Base, visibility is narrowed where you choose to narrow it, with access groups or password protection.

Organizing Content

Content is arranged file-manager style: folders contain pages and other folders, and pages hold the actual Markdown content. The tree on the left shows the full structure with branch lines connecting each item to its parent; the Top level node at the root is selectable and shows everything that isn't inside a folder.

Folders

Folders can nest to any depth. Each folder has a name and an optional description — a short note about what the folder is for and what a reader can expect to find inside, shown at the top of the folder view. Edit it from the folder's action menu (⋮ → Edit folder description).

Selecting a folder shows its contents: subfolders as cards, and pages in a table with their description, last edit time, last editor, and version. Click a column header to sort the table; click a third time to return to the manual order.

Moving and Reordering

Drag any page or folder in the tree to reorganize:

Drop onto a folder to move the item into it.
Drop onto the top or bottom edge of a row to reorder items within their container.
Drop onto the Top level node to move an item out of all folders.

The manual order you arrange is shared — everyone sees the same tree. Pages can also be moved from their action menu (Move page) if you prefer a dialog over dragging. The divider between the tree and the reading pane can be dragged to resize the tree; double-click it to reset.

Addresses and Breadcrumbs

Every page and folder has a stable, readable address built from its location — for example /kb/sops/network/dns-triage — so you can link directly to a page from a case note or chat message. A breadcrumb trail above each page and folder shows where you are and links back to every parent.

Renames change addresses: a page's address follows its title and location. If you rename or move a page, links that used the old address will no longer resolve. The page itself, and its history, are unaffected.

Writing Pages

Create a page with the New page button. The dialog asks for a title, an optional description, the destination folder, and whether to encrypt the page with a password from the start. Creating a page takes you straight into the editor.

The Editor

Pages are written in Markdown, in the same split editor used by the report editor: formatting toolbar on top, the page structure (parsed from your headings) on the left for quick navigation, and source and rendered preview side by side. Tables, task lists, code blocks, and links render in the preview exactly as readers will see them.

Saving is explicit: press Save when your edit is complete, and it is stored as a new version. The title and description are edited in the editor's sidebar.

Page Descriptions

A page's description is a one-or-two sentence summary shown under the title, in folder tables, and in search results. It is indexed into global search at all times — including when the page content is encrypted — which makes it the discoverable label for protected pages.

Descriptions are never encrypted. Like titles, they remain readable and searchable even on password-protected pages, by design. Never put passwords, secrets, or other sensitive material in a title or description.

Inline Images

Screenshots make instructions far easier to follow. Paste an image directly into the editor, or use the insert-image toolbar button. PNG, JPEG, and GIF are accepted, up to 8 MB per image. Images are stored inside the DFIRe database — they are covered by backups, and on a protected page they are encrypted together with the content.

Concurrent Edits

If someone else saves the page while you are editing it, your save is not silently applied over theirs — DFIRe warns you about the conflict and lets you choose: keep editing, or save anyway as the newest version. Either way the other person's text remains available in the version history.

Version History

Every save creates a new, immutable version recording the content, the title, the author, and the time. Open the history from the version number in the page header (or the action menu) to:

Review any previous version, rendered side by side with the version list.
Restore a previous version — restoring does not rewrite history; it creates a new version with the old content (and old title), so the trail of who changed what remains complete.

Versions cannot be edited or deleted individually. Deleting a page deletes the page together with its entire history.

Visibility: Access Groups

By default everything in the Knowledge Base is visible to every user who can read it. To limit who can see a folder or page, assign it access groups from the action menu (Manage access groups):

No groups selected — visible to everyone who can read the Knowledge Base.
Groups selected — visible only to members of at least one selected group (and superusers).

Groups are the same roles managed in the Role Editor. Restrictions are inherited: limiting a folder limits everything inside it, and a page is visible only when every folder on its path is visible too. Content hidden by an access group simply does not appear — not in the tree, not in folder listings, not in search.

Access groups work together with the Knowledge Base view permissions: the view permission decides whether a role can enter the Knowledge Base at all, and access groups decide which content is visible inside it. You can, for example, grant every role view rights, publish most documentation openly, and restrict a folder of sensitive procedures to Team Leads — while a role that has no need for documentation gets no Knowledge Base at all.

You cannot lock yourself out. The creator of a page or folder always retains access to it, even when they restrict it to groups they do not belong to. Restrictions placed on parent folders by others still apply normally.

Who Can Read and Edit?

Knowledge Base access is controlled through two permission groups in the Role Editor (under Collaboration): Knowledge Base Folders and Knowledge Base Pages. The View capabilities gate reading — a role without them has no Knowledge Base access at all — and the remaining capabilities cover creating, editing, moving, reordering, protecting, and deleting. Every default role includes the view capabilities; investigator roles also include the writing ones.

For administrators: on upgrade, the view permissions are granted automatically to every existing role, so nobody loses access they had before. Writing permissions were likewise granted to every role that can create cases when the Knowledge Base was introduced. Review the grants in the Role Editor to narrow reading or authoring to the roles that need them.

Password Protection

For genuinely sensitive material, visibility rules may not be enough — the Knowledge Base also offers real encryption. Protection comes in two forms with deliberately different behavior:

	Protected page	Protected folder (vault)
What is encrypted	The page's content and images, including all history versions	The content and images of every page inside the folder
What others see	The page stays visible and searchable: title, description, author, and version show, so a reader can ask the author for access	Nothing — the folder shows as a locked node, and its entire contents (names, structure, pages) are hidden everywhere, including search, until unlocked
Who can see inside	Anyone with the page password	Anyone with the folder password — superusers included, no one bypasses a vault
Typical use	A sensitive page in an otherwise open space	A compartment of related sensitive material

Protect a page or folder from its action menu (Set page password / Protect with password), or enable encryption directly when creating a page. A page inside a protected folder can additionally have its own password — opening it then requires both.

Entered passwords are kept only in your browser's memory for the current session: reloading the page re-prompts. Unlocking is per user — it never unlocks the content for anyone else.

A forgotten password is unrecoverable — permanently. The password itself is the encryption key. DFIRe stores nothing that can decrypt protected content, there is no administrator reset, and this applies to every history version and image of the page. Treat Knowledge Base passwords with the same care as any other key material.

Protection Is Also a Delete Lock

Password protection guards against deletion as well as reading:

Deleting a protected page requires entering its password first — proof that the deleter could read what they are destroying.
A folder cannot be deleted at all while anything inside it is password-protected. Remove the protection or move the protected content out first.

Superusers are exempt from both rules for administrative cleanup — though even they cannot read the encrypted content without the password.

Failed Attempts

Wrong password attempts are recorded in the audit log and rate-limited: after ten failed attempts within five minutes, further attempts are refused for a cool-down period.

Finding and Sharing Content

Search

Knowledge Base pages appear in global search alongside cases, evidence, and indicators. Titles and descriptions are always searchable; page content is searchable while it is unencrypted. Results respect the Knowledge Base view permission and access groups, and the contents of locked vault folders are excluded entirely until unlocked.

Export

Any page you can read can be exported from its action menu:

Markdown (.md) — the raw source, suitable for re-use elsewhere.
HTML (.html) — a self-contained rendered document with images embedded, suitable for sharing outside DFIRe.

Backups

All Knowledge Base content — pages, history, and images, including encrypted material — is stored in the DFIRe database and therefore included in standard backups. Encrypted content remains encrypted in the backup.