FIR (Fast Incident Response)

6.8easy start · #14 of 28
in Incident Management Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you worknot on record

Runs on api, self-hosted, Web.

FIR (Fast Incident Response) is ranked #14 of 28 in incident management software on The Geeks Club. It runs on API, Self-hosted, Web. There is a free plan.

FIR (Fast Incident Response) plans and pricing

All plans

FIR Free GPL-3.0 · self-hosted github.com · 4 Oct 2026

Best FIR (Fast Incident Response) alternatives

See all 20

ITOC360 0 of 4 in the starter kit Lesson 17.9 AlertOps 0 of 4 in the starter kit Lesson 27.8 PagerDuty 0 of 4 in the starter kit Lesson 37.8 xMatters 0 of 4 in the starter kit Lesson 47.8 DFIRe 0 of 4 in the starter kit Lesson 57.7 FireHydrant 0 of 4 in the starter kit Lesson 67.6

The record

Purpose: FIR is a cybersecurity incident management platform for creating, tracking, and reporting incidents.
Intended users: The project says FIR is for teams that track cybersecurity incidents, including CSIRTs, CERTs, and SOCs.
Incident fields: Incidents can include category, status, detection method, severity from 1 to 4, date and time, description, and TLP confidentiality.
Artifacts: FIR extracts artifacts such as IP addresses, hostnames, URLs, email addresses, and hashes, and displays correlated artifacts from other incidents.
Incident workflow: Users can add comments, files, attributes, todos, or nuggets and change an event's status to open, blocked, or closed.
Reporting: The incident follow-up action opens a one-page report intended to be printed as a PDF for business lines.
Templates: Incident templates can prefill incident creation fields, and the project documentation says none are defined by default.
Custom attributes: Teams can define numeric incident attributes such as financial loss, stolen credential counts, or downtime and use them for statistics.
Integrations: The repository includes optional plugins for MISP, LDAP, OIDC, two-factor authentication, and an API.
Deployment: FIR can be run with Docker for testing or occasional use, or installed in a production environment for daily use.
Technical stack: FIR is written in Python with Django and Bootstrap, and the README describes MySQL while allowing other Django-compatible database adapters.
Deployment requirements: The README says FIR can run smoothly on an Ubuntu virtual machine with 1 core, 40 GB disk, and 1 GB RAM.
License: The public repository identifies its license as GPL-3.0.
Price from: Free

Where it ranks on The Geeks Club

Best Incident Management Software in 2026#14 of 28

Is FIR (Fast Incident Response) yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote FIR (Fast Incident Response)

Sources

github.com/certsocietegenerale/fir· checked 4 Oct 2026
github.com/certsocietegenerale/FIR/wiki/Creating-a· checked 4 Oct 2026
github.com/certsocietegenerale/FIR/wiki/Incident-T· checked 4 Oct 2026
github.com/certsocietegenerale/FIR/wiki/Attributes· checked 4 Oct 2026
github.com/certsocietegenerale/FIR· checked 4 Oct 2026
github.com/certsocietegenerale/FIR/wiki· checked 4 Oct 2026