Overview

DFIRe brings investigation workflows, evidence records, compliance deadlines, threat intelligence, and reporting together in a self-hosted product. Teams can move cases from triage into incident response while retaining their history, which suits work that needs a documented process from intake through resolution. Its focus is narrower than general case management, and its deployment model places infrastructure security and upkeep with the customer.

Key features

Custom case types, severities, assignments, and escalation let organizations shape their process around different kinds of incidents. Fifteen default playbooks give teams a starting point for common cases, and they can customize or replace them. That flexibility is useful for established response programs, though teams still need to define and maintain procedures that match their own work.

Evidence is organized hierarchically, with configurable attributes, verifiable custody records, printable receipts, and transfer records. These features make DFIRe a focused option when documenting evidence handling is part of the investigation, rather than relying on a general-purpose task tracker.

Compliance timers and reminders help teams track breach notifications, statutory reporting, and service-level deadlines. The IOC registry supports STIX 2.1 types, enrichment from named threat intelligence providers, and sharing through MISP and TAXII. Slack collaboration, two-way Jira synchronization, webhooks, and SIEM or log-forwarding integrations connect case work to neighboring tools.

Reports combine structured sections, a quality-assurance workflow, and generated evidence inventories. Optional LLM drafting uses a provider chosen by the customer, leaving the provider choice with the organization. Security controls include OIDC single sign-on, two-tier role-based access, AES-256-GCM attachment encryption, and an immutable audit trail that fails closed.

DFIRe supports air-gapped deployment and offline licensing, which can suit networks without internet access. It tests and supports Docker Compose on Linux; other container platforms are outside its supported deployment model. Production requires Docker Engine 24.0 or later, Compose 2.24.4 or later, and PostgreSQL 16 or later. Customers must secure the database, file storage, network, servers, and backups; case data remains plaintext in the database for performance and full-text search.

Pricing

DFIRe uses a freemium model, with a free plan and a 90-day trial. The Non-commercial plan is granted case by case for individual, student, educational, charity, and community use, with all features included. It can serve qualifying users who need the full product without a commercial licence.

The Annual licence costs 9,900.00 EUR per year, billed at 9,900 EUR / year, with VAT at 0%, added per EU rules. It includes unlimited users and cases for a single production deployment and can be converted to an offline licence. The 90-day trial provides time to assess the deployment before committing. This plan fits organizations with a production response program; the single-deployment limit matters to teams that need separate production installations.

Small teams have custom pricing for small organisations, with the same deployment model and features and unlimited cases. It may better fit a smaller organization than the annual licence, though the price depends on a custom quote.

Platforms

DFIRe runs on Linux as a self-hosted web application and supports an API. Docker Compose is the supported deployment route. Air-gapped operation and offline licensing make it usable in networks that cannot rely on internet access, provided the organization can operate and secure the underlying infrastructure.

Who it's for

DFIRe suits digital forensics and incident response teams that need structured escalation, defensible evidence records, compliance reminders, and connections to threat intelligence or operational tools. It is particularly relevant to organizations that require offline operation or want case data inside infrastructure they manage. Teams without Linux and Docker Compose capacity, or those seeking a hosted service with infrastructure security handled for them, should look elsewhere.

Pros and cons

Purpose-built evidence custody: Hierarchical evidence records, verifiable custody, receipts, and transfer history support investigations where handling records matter.
Flexible response process: Configurable cases and editable playbooks accommodate different incident workflows while preserving case history.
Useful for restricted networks: Air-gapped deployments and offline licensing support environments without internet access.
Substantial operational burden: Customers secure and maintain the database, storage, network, server, and backups; the database stores case data in plaintext.
Narrow deployment support: The supported setup requires Linux and Docker Compose, limiting fit for teams standardized on other container platforms.
High commercial commitment: The 9,900 EUR annual licence covers one production deployment, even though users and cases are unlimited.

Alternatives

DFIR-IRIS is the clearest alternative for teams seeking free, self-hosted digital forensics and incident response software; DFIRe is the choice when its specific custody, playbook, and compliance controls justify a paid licence. UiPath Maestro Case Management is another self-hosted case management option, with a free trial and a demo request path.

Newgen Dynamic Case Management may suit teams looking for a web-based paid product with a free trial and a stated entry allowance of 10 users, 100 GB of storage, and 50,000 API calls per month. Case Closed Software offers custom pricing and spans more platforms, including mobile and desktop systems.

Socianote has a free plan capped at 3 staff, 50 people, 1 programme, and 200 documents, making it a different option for small teams working within those limits. Whistleblower Software is a paid web product with a free trial and annual-billed monthly pricing that varies by employee band.

IntegrityLog is a paid web and mobile alternative. SecureRelease is another paid web option.

For broader comparisons, see case management software, incident response software, and incident management software.

Verdict

Choose DFIRe if your forensic or incident response team needs auditable evidence custody, adaptable case workflows, and offline-capable self-hosting, and has the people to operate the required infrastructure. Its main advantage is the depth of its investigation controls in one system. Look elsewhere if you need a hosted service, a deployment beyond supported Docker Compose, or a lower-cost option such as free, self-hosted DFIR-IRIS.

	DFIRe	ServiceNow HR Service Delivery
Free plan	Yes
Free trial	Yes
Platforms	api, Linux, self-hosted, Web	Android, api, iOS, Web
Free plan	Yes
Audit logs	Yes
Workflow automation		Yes
Case intake options		omnichannel
SLA tracking		Yes
HR knowledge base		Yes
Request catalog		Yes
HRIS synchronization		Yes
Knowledge base		Yes

DFIRe vs ServiceNow HR Service Delivery

DFIRe

ServiceNow HR Service Delivery