Documentation
Everything you need to run IRIS.
Install it, operate it, extend it. These pages cover the whole platform — from
docker compose up on a laptop to writing your own modules against the API.
Everything in one workspace
The full DFIR toolkit, one open-source platform.
-
Alerts
SIEM, EDR, and REST-fed alerts land in one queue. Cluster, triage, promote to a case in one click.
-
Cases
The spine of IRIS. Assets, IOCs, tasks, evidence — one authoritative record with a full audit trail.
-
IOCs
Indicators typed, tagged, and enriched from VirusTotal or MISP without leaving the case.
-
Tasks
Assign work, track state, keep the checklist honest. Tasks live inside cases and war rooms.
-
Notes
Rich-text notes saved as you type. Group them by directory, link them to assets.
-
Evidence
Drop artefacts — IRIS hashes and tags them. Chain of custody, verified by SHA-256.
-
Timeline
Every event, alert, and action on one investigation timeline. Exportable as a narrative.
-
War Rooms
Real-time chat, slash commands, per-room teams. Decisions on the record, attachments to evidence.
-
Modules
IrisMISP, IrisVT, IrisCheck, IrisWebHooks. 162 hook bindings — extend IRIS without forking it.
-
REST API
Every action in IRIS is scriptable. Push data in, pull reports out — IRIS is a platform, not a silo.
-
Access Control
Case-level and group-level RBAC. Restrict read/edit/export with a full audit trail behind every action.
-
Reports
One click turns the case into an executive brief, technical report, or court-ready PDF.
Get up and running
Three ways to start.
-
Deploy locally
Clone the repo, run
docker compose up, and IRIS is on your laptop in under five minutes. -
Try the demo
A free rolling demo instance you can open right now — no install, no signup, real IRIS.
-
Read the source
IRIS is fully open source. Fork it, patch it, ship your own modules against the documented API.