Skip to content

Changelog

For upgrades instructions, please see the Upgrades page.

v3.0.0-beta.1 Not released yet

Not released yet

v3.0.0-beta.1 has not been tagged, and the ghcr.io/dfir-iris/iris-{backend,frontend,db,nginx}:v3.0.0-beta.1 images are not published. This entry describes the content of the upcoming tag. This line is a beta — it is not supported for production use.

Breaking changes

IRIS v3 is a major release. It cannot be upgraded in place, and integrations written against v2.4.x will stop working. Read both upgrade documents end to end before you start:

  • Migrating to IRIS v3 — deployment topology, API and integration impact, rollback semantics

  • iris-web/docs/upgrade-to-3.0.0.md — the operational procedure, including the automated pg_dumpall/restore script and the three rollback tiers

  • Legacy endpoints no longer work. nginx routes every URL that is not /api/* to the new frontend service, so the legacy /case/*, /alerts/*, /datastore/*, /dim/*, /global/* and non-/api/v2 /manage/* paths never reach the backend. /api/v2 is the only supported API surface in v3. Port your scripts, webhooks and modules before upgrading, using the legacy endpoint migration map.

  • PostgreSQL 12 → 18. The bundled database image jumps a major version. A PG18 server cannot read a PG12 data directory, so pulling the new image and restarting fails with database files are incompatible with server. A one-time dump-and-restore is required; scripts/upgrade-db-pg12-to-pg18.sh automates it. Client authentication also moves from md5 to scram-sha-256.
  • The UI is a separate service. The jQuery interface served by the Flask app is replaced by a SvelteKit SSR application running in its own frontend container. The stack grows from 5 to 6 services, and nginx proxies /api/* to the app and everything else to the frontend.
  • iris-web is now a meta-repository. The single monolithic repository is replaced by a slim meta-repo with two git submodules, iris-backend and iris-frontend. Building from source needs git clone --recursive (or git submodule update --init --recursive) and scripts/dev-up.sh. Pull-only operators do not need the submodules.
  • Images and containers renamed. The published images move from ghcr.io/dfir-iris/iriswebapp_{app,db,nginx} to ghcr.io/dfir-iris/iris-{backend,frontend,db,nginx}, and the default container names from iriswebapp_* to iris_*.
  • .env.model is replaced by .env.example at the meta-repo root, and a single IRIS_VERSION variable now pins all four image tags together. Several variables are new and required — a recycled v2 .env will not boot v3.
  • The GraphQL API is gone. It was removed in v2.4.28 and is not present in v3. Use the /api/v2 REST endpoints instead.
  • Session-based clients must re-authenticate. The refresh-token cookie format changed, so users need to log in once through the browser, or clients must call POST /api/v2/auth/login. API-key authentication (Authorization: Bearer <api_key>) is unaffected.
  • Kubernetes, Helm and EKS are not updated for v3. The bundled manifests still reference the v2 images and carry no frontend template. Follow the manual procedure in the upgrade document if you deploy on Kubernetes.

What's changed

Added

  • War rooms — a collaborative workspace attachable to one or more cases, with chat (threads, topics, pins, polls, slash commands and datastore-backed attachments), notes organised in a folder tree with per-note revisions, tasks with subtasks and tag/status filters, multiple timelines including projected linked-case timelines, sitreps, teams for @-mention groups, members and ACLs, a live activity stream and archiving
  • Alert clusters — alerts are grouped into clusters with a correlation graph, driven by cluster rules with nested AND/OR conditions and JSONB path support, plus investigation flows that target alerts, clusters or both and can be deployed against existing data
  • Custom dashboards — dashboard and widget CRUD, a preset gallery, a query engine with named aggregations (MTTD, MTTR, false-positive and escalation rates, sliding windows), drag-and-drop layout with per-widget sizing, a visual/JSON editor with live preview, dashboard-level filter bars, and new statistics_read and custom_dashboards_{read,write,share} permissions
  • Notifications — in-app notifications with a SocketIO stream, per-user notification settings, analyst @-mentions and a mentionable-user directory
  • Collaborative editing — a server-side Yjs relay with per-document rooms, covering case summaries, notes and war-room summaries
  • Mail — inbound ingestion and outbound sending, with a rules engine and a secrets manager
  • MCP endpoint — /api/v2/mcp exposes IRIS as Model Context Protocol tools and resources to AI clients. Disabled by default, opt-out per user, API-key/Bearer only (session cookies are rejected), rate limited per user and logged to the activity trail
  • IRIS Assistant — an optional in-app assistant backed by Anthropic, OpenAI or Ollama, with an approval step before any write tool runs, IP/email/hash redaction, per-customer policies and an egress audit view for DPOs. Disabled by default
  • Interactive API reference — an OpenAPI 3.1 spec is generated from the route decorators and served, Redoc-rendered, at /api/v2/docs for authenticated users, with the raw document at /api/v2/openapi.yaml
  • Error reporting — optional Sentry/GlitchTip integration configured from the server settings, with header/body/stack-local redaction and X-Request-Id correlation, plus a fallback bug-report intake for the in-app "Report an issue" dialog
  • Named API keys — users can mint several named keys, each with its own scope mask that can only narrow the owner's permissions, self-service under /api/v2/me/api-keys and mirrored for administrators
  • User avatars, per-user preferences, and admin-managed banners with a timespan, purpose and dismissable flag
  • Case export and import, for moving a case between IRIS instances
  • Multiple named timelines per case, followed cases, search across every case element, and a Lucene search bar on the alerts queue
  • Saved filter presets on the cases overview, and neq / not_like operators in the filter builder
  • Traefik support, nginx certificate autodetection with reload polling, a CA-bundle drop-in directory and a certbot deploy hook

Changed

  • The /api/v2 surface is now complete — around 500 routes covering cases and every case object, alerts, assets, IOCs, notes and note revisions, tasks, events, evidences, activities, search, tags, taxonomies, access control, customers and contacts, modules and hooks, report and case templates, server settings, DIM tasks and Celery tasks, on top of the new v3 subsystems
  • MFA is enforced on token-authenticated endpoints, with a brute-force throttle, a re-enrolment guard and refresh propagation
  • OIDC gains a session-to-JWT exchange endpoint and a provider-discovery fallback

v2.4.29 April 28, 2026

What's changed

  • Fixed remaining styling issues in the dark theme

Full Changelog: https://github.com/dfir-iris/iris-web/compare/v2.4.28...v2.4.29

v2.4.28 April 27, 2026

What's changed

Security

  • Removed the GraphQL API, fixing GHSA-3mxh-x92q-9r25 at the same time. The /api/v2 REST endpoints cover the same ground.
  • Fixed the redirect after login — GHSA-vjc3-7jwv-j9qf
  • Fixed GHSA-8hwq-v6vm-9grr
  • Fixed GHSA-w78h-mx7h-qm3h
  • Fixed GHSA-g588-5gmf-p5cx
  • Added input sanitisation in multiple views

Improved

  • Greatly improved the editing of custom dashboard layouts
  • Improved the dashboard queries
  • Reworked the buttons layout
  • Updated dependencies, including the vendored jQuery UI and popper

Fixed

  • Fixed the MFA flow
  • Fixed styling issues in the dark theme
  • Fixed date rendering issues introduced by the moment update
  • Fixed the tag suggestions
  • Fixed markdown filtering in the case description modal

Full Changelog: https://github.com/dfir-iris/iris-web/compare/v2.4.27...v2.4.28

v2.4.27 Janv 27, 2026

What's changed

  • Fixed issues with nginx caching

Full Changelog: https://github.com/dfir-iris/iris-web/compare/v2.4.26...v2.4.27

v2.4.26 November 18, 2025

What's changed

  • Improved dashboard build with UI builder

Full Changelog: https://github.com/dfir-iris/iris-web/compare/v2.4.25...v2.4.26

v2.4.25 November 12, 2025

What's changed

  • Added possibility to create custom dashboards

Full Changelog: https://github.com/dfir-iris/iris-web/compare/v2.4.24...v2.4.25

v2.4.24 November 4, 2025

What's changed

  • Fixes permissions check ordering allowing to have restricted groups with alerts access only
  • Fixes GHSA-qhqj-8qw6-wp8v

Full Changelog: https://github.com/dfir-iris/iris-web/compare/v2.4.23...v2.4.24

v2.4.23 November 4, 2025

What's changed

  • Fixes hooks in comment
  • Adds not_like operator in alerts filtering
  • Updates webhooks module to v1.0.9

Full Changelog: https://github.com/dfir-iris/iris-web/compare/v2.4.22...v2.4.23

v2.4.22 June 3, 2025

What's changed

  • Fixes issues with notes not being created

Full Changelog: https://github.com/dfir-iris/iris-web/compare/v2.4.21...v2.4.22

v2.4.21 May 21, 2025

What's changed

  • Fixes the by-default latest tag pulling in .env.model
  • Fixes duplicated import of assets from alerts

Full Changelog: https://github.com/dfir-iris/iris-web/compare/v2.4.20...v2.4.21

v2.5.0-beta.1 February 27, 2025

What's changed

Preview release

v2.5.0-beta.1 was a preview of the API and interface rework. It was never promoted to a stable v2.5.0 — that work continued and ships as v3. See the warning on v2.4.20 below if you pulled this version by accident.

Added

  • New /api/v2 REST API covering cases, case assets, case IOCs, case tasks, alerts, context and dashboard, with consistent pagination (page, per_page, order_by, sort_dir) and proper HTTP status codes
  • Legacy /case/*, /manage/* and /alerts/* endpoints now carry a deprecation notice pointing at their /api/v2 replacement, and the web interface was moved over to the new endpoints
  • First iteration of the SvelteKit interface, in a new ui/ project, together with an alternative nginx configuration selectable at image build time through the NGINX_CONF_FILE build argument and a docker-compose development overlay
  • End-to-end tests in CI, and a devcontainer configuration

Changed

  • IOCs are now owned by a single case — the ioc_link many-to-many table is folded into a case_id column on ioc, and the migration splits previously shared IOCs into one row per case, carrying their comments, asset links and timeline links across
  • The application now runs on Python 3.12
  • The vendored front-end assets are no longer committed; they are built from the ui/ npm project during the image build

Fixed

  • Several data-integrity issues around deletion — deleting an asset linked to an IOC, deleting a case holding commented IOCs, and deleting an asset with attached comments
  • Deduplication of IOCs and assets when merging an alert into an existing case
  • Datastore uploads
  • Error handling on the alerts page
  • Open redirect on the authentication routes

Full Changelog: https://github.com/dfir-iris/iris-web/compare/v2.4.20...v2.5.0-beta.1

v2.4.20 January 15, 2025

What's changed

  • Fixes an issue with alerts correlation that increases creation delay as more and more alerts are added to the system.

!!! warning "Warning" An issue has been identified when pulling the last version of IRIS. Even after checkout to v2.4.20, the version v2.5.0-beta would be downloaded. This is due to an automatic tagging of Github Registry and an environment variable set by default to latest in the .env. See our annoucement

v2.4.19 December 21, 2024

What's changed

  • Issue with and_ conditions in alerts #656
  • Issue when logging out in local auth mode.

v2.4.17 December 9, 2024

What's changed

  • Upgraded psycopg2 to the latest version to avoid the issue "SCRAM authentication" by @rios0rios0 in #637
  • Added severity_id for creating cases by @Vladimir-A in #653
  • Fixed OIDC login issue.
  • Added filtering options in the timeline.

v2.4.16 November 9, 2024

What's changed

  • Fixes an issue preventing to use hybrid mode with OIDC / Local when MFA is enabled

v2.4.15 November 9, 2024

What's changed

  • Fixes memory issues in alerts leading to memory exhaustion
  • Adds filter fir alert source ref
  • Adds new relations in alerts for future use
  • Better UI for comments indicators

v2.4.14 October 1st, 2024

What's changed

  • Fixes error when deleting a case with notes revisions
  • Fixes alerts similarities associated with alternate customers
  • Improves alerts graph by adding more info at a glance
  • Adds additional filters on alerts

v2.4.13 September 14, 2024

What's changed

  • Add OIDC in beta
  • Fix broken merge of alerts in assets
  • Fix alerts and customers checks

v2.4.12 August 28, 2024

What's changed

  • Added module to support Seika.io
  • Improved IRIS Webhook module
  • Fixed spelling in editors

Full Changelog

v2.4.10 July 29, 2024

What's changed

Fixed
* Issue with errornous outcome setting in cases

Full Changelog

v2.4.9 July 17, 2024

What's changed

Fixed
* Issue with notes revisions assigning wrong user to the revision

Full Changelog

v2.4.8 July 16, 2024

What's changed

Added * Publication of the docker images on Github Container Registry (GHCR) * New GraphQL API endpoints for IOCs and cases * Automatic load of alerts relations * Notes revisions history

Fixed
* Mutliple issues

Full Changelog

v2.4.7 March 18, 2024

What's changed

Fixed
* Issues in the datastore preventing to upload multiple files

Full Changelog

v2.4.6 March 18, 2024

What's changed

⚠️ Important changes are done in the Access Control. If you are upgrading, please carefully read the upgrades instructions. The layout of the reports has been changed. Reports template need to be upgraded as well.

Improved

  • New notes layout
  • New timeline layout with tree view
  • New timeline feature allowing to create child events
  • New access control feature allowing to associate users with customers
  • CI/CD init by @c8y3 in #401, #400, #402

Fixed

  • Fix CSS issue by @whikernel in #377
  • Fixes addition of case templates in #379
  • Fix issues with case templates usage in #381
  • Fix issue with IOC lookups in the timeline in #382
  • Fix major collaboration issue in notes in #385
  • Fix PG Extension not being setup properly in #390
  • Fix multiple security issues impacting case reports and editors

New Contributors

  • @MikaelFangel made their first contribution in #414

Full Changelog

v2.3.7 December 14, 2023

What's Changed

Fixed

  • Fixes an issue with download of files from the datastore #347
  • Fixes an issue with the addition of protagonist in cases
  • Fixes an issue with case edition modal

Improved

  • Improved timeline rendering
  • Improved security in Datatables

Full Changelog

v2.3.6 December 7, 2023

What's Changed

Fixed

  • Fixes an error preventing the proper generation of reports
  • Fixes an issue with filtering in the overview tab
  • Adds more filtering options in the overview tab

Full Changelog

v2.3.5 November 30, 2023

What's Changed

Fixed

  • Fixes an issue introduced in v2.3.4 where the cases metadata are not properly saved.

Full Changelog

v2.3.4 November 29, 2023

A severe bug has been introduced in this version. Please upgarde to v2.3.5.

What's Changed

Added

  • Added support for evidences types
  • Added support for cases severity
  • Improved search in context switcher

Fixed

  • Fixed overview page
  • Fixed dashboard filtering

❗ The layout of the reporting has slightly changed. Custom report templates might not work anymore. You can use https://<server>/case/export?cid=<case_id> to get all the possible fields.

Full Changelog

v2.3.3 October 5, 2023

What's Changed

Fixed

  • Fixed breaking of manage case list if percentage in title
  • Fixed broken title search in overview
  • Fixed sorting of owners in overview
  • Fixed quick look in overview
  • Fixed alert page breaking if username contains trailing space
  • Fixed IrisVTModule links
  • Fixed IrisWebhookModule
  • Fixed refresh after closing of notes

@Scriptception made their first contribution in 313

Full Changelog

v2.3.2 August 2, 2023

What's Changed

Fixed

Patches a critical issue corrupting files uploaded to the DataStore via the IOC option or when a password is set

Full Changelog

v2.3.1 July 23, 2023

What's Changed

Improved

  • Overview page and quick view layout
  • Auto assignment of alerts when not assigned
  • Possibility to filter tags by clicking on them in alerts

Fixed

  • Call of modules when done from the modals
  • UI

Full Changelog

v2.3.0 July 09, 2023

What's Changed

Added

  • Collaborative editor in notes
  • Possibility to add case peer-reviews
  • Alerts resolution status
  • Auto closing of alerts with resolution for linked alerts
  • New webhook module
  • Enhanced overview page
  • Attributed open cases in dashboard
  • Assets and IOCs multi-additions from the UI
  • New UI design

Fixed

  • Password change for users
  • Description breaking in alerts and events
  • Missing icons in MD rendering for know links
  • Alerts rendering

Full Changelog

v2.2.3 June 19, 2023

What's Changed

Added

  • Possibility to use LDAP and local auth as fallback
  • Possibility to add multiple IOCs at once from the UI
  • Possibility to add multiple assets at once from the UI
  • Support for hooks and module calls in alerts
  • URL redirection after login

Fixed

  • Similarities in alerts when no assets are provided
  • Assertion of data in marshmallow
  • MD editor new lines handling
  • Unicode in datastore
  • Alerts share links
  • Modules info when registering a module
  • UI fixes

Full Changelog

v2.2.2 May 30, 2023

What's Changed

Added

  • Possibility to pivot on assets and IOCs from the alerts graph

Fixed - Delete character escaping for passwords by @juadde in #253 - Case template of tasks without tags - Shortening of case names during updates - Bad handling of certain requests without CID - Deletion of assets related to alerts once merge into a case

Full Changelog

v2.2.1 May 24, 2023

What's Changed

Note 1: This version contains a security fix for iris-web (see CVE-2023-30615)
Note 2: on_postload_case_info_update hook has been renamed to on_postload_case_update

Added

  • Add newly created users after a LDAP authentication to group Analysts by @c8y3 in #247

Fixed

  • Security fix of CVE-2023-30615 - GHSA-gc6j-6276-2m49 impacting iris-web < v2.2.1
  • Deletion of cases with assigned tasks
  • Merge of multiple alerts
  • Import of IOCs and Assets in case multiple alerts are merged

Full Changelog

v2.2.0 May 22, 2023

What's Changed

Added

  • Basic csv events file import (with default options) by @realsec in #240
  • New endpoints to search for manageable objects such as assets types etc,
  • New search by asset IDs, IOC IDs and events IDs in the timeline

Fixes

  • Some configuration checks when LDAP and automatic user creation are set by @c8y3 in #246
  • Ensure database connectivity before trying to create tables by @weslambert in #248
  • Merge of multiple alerts in one case not merging the IOCs and assets
  • Bug allowing to add an asset to a timeline not belonging to the same case
  • UI bug fixes

New Contributors

  • @realsec made their first contribution in #240
  • @weslambert made their first contribution in #248

Full Changelog

v2.1.0 May 15, 2023

If you are using custom SSL certificates, please read the upgrade instructions when upgrading from previous versions.

What's Changed

Added

  • Full support of alerts
  • Case templates
  • Provisioning of users
  • Service accounts
  • New permissions

Fixed

  • Variable LDAP_AUTHENTICATION_TYPE in .env.model by @c8y3 in #217
  • Automatic creation of users with ldap authentication by @c8y3 in #227
  • Update nginx.conf for Security HTTP headers to work. by @oikuda in #216
  • Columns in manage cases #205
  • Customer contact deletion #239
  • Search permissions #237
  • Customer permissions #235
  • Toast split #226
  • Assets exporting #224
  • Assets IOC filtering #223
  • ADM username not enforced #218
  • JIT provisioning of users in LDAP #203

New Contributors

  • @c8y3 made their first contribution in #217
  • @oikuda made their first contribution in #216

Full Changelog

v2.0.2 April 18, 2023

What's Changed

Fixed
* Update case_notes_db.py for bug fix #200 by @LoneWolf-96 in #208 * Do not escape_filter_chars for NTLM username by @juadde in #212 * docker-compose cleanup by @juadde in #213 * Listening port not being propagated in nginx docker

New Contributors
* @LoneWolf-96 made their first contribution in #208 * @juadde made their first contribution in #212

Full Changelog

v2.0.1 April 05, 2023

What's Changed

Fixed [FIX] Additional table header in case management breaking proper loading of data in #206

Full Changelog

v2.0.0 March 26, 2023

What's Changed

In addition to the features listed below, we are changing the way we are issuing releases. From now on, IRIS follows the Semantic Versioning 2.0 guidelines.
The code ready for production is always tagged with a version number. alpha and beta versions are not production-ready.

Do not use the master branch in production.

A website with the current development version is also provided and freely accessible. It serves as a beta before public releases.

Added

  • Groups management
  • Case access control and basic permissions
  • Comments support on a call objects
  • Markdown editors in all case objects
  • Customers dedicated pages with additional information and cases stats
  • LDAP authentication
  • Markdown reporting
  • Case owners, classifications, outcome and tags
  • Possibility to update case basic infornations
  • Case overview page
  • Unique UUID on all case objects
  • Multiple assignees support in case tasks
  • Deletion confirmation prompt on all case objects as an option
  • IOC in events plus optional synchronization with assets
  • Events flagging in the timeline
  • MD links on every case objects

Improved

  • Dark mode
  • Uniformity of modals
  • Overall UI and UX
  • Compromised status in assets
  • Error reporting in the UI

Fixed

  • Manual call of modules when multiple modules are availables
  • Multiples bugs fixes
  • Security fixes

Full Changelog

v1.4.5 June 9, 2022

What's Changed

  • Added a datastore in #115, fixes #30 :
    • Upload and store any files on IRIS
    • Password protect them as an option
    • Download
    • Add to IOC and/or evidences automatically
    • Reference to files in notes, summary or any textual input
    • Copy/paste of images directly in notes and summary
    • Virtual folders to arrange files
  • Ability to configure password policy in #117, fixes #116
  • Dark mode improved, flickering removed
  • Multiples bugs fixes
  • Security fixes

Full Changelog

Notes: Changes are made to the Nginx docker to allow upload of big files, hence specific upgrades are needed and auto-updates is not yet supported for this version. Please see the upgrades instruction for more details.

v1.4.4 May 18, 2022

What's Changed

  • Implementation of bulk events editing by @sebastiandemmer in #110
  • Fixes context switch button doesn't load cases by @DevJoost in #112
  • Fixes multiple minor bugs

Full Changelog

v1.4.3 May 13, 2022

What's changed

  • Managed IRIS updates from itself
  • Custom icons for assets - fixes #44 by @sebastiandemmer
  • IOCs link in timeline and graph - fixes #50
  • History of modifications in timeline
  • User id in timeline export as an option - fixes #65
  • Backup of database from the interface
  • Minimisation of modals in cases
  • New UI improvements in timeline
  • New minimal notifications for almost all activities
  • Improved overall responsiveness and speed
  • Improved error feedbacks to users
  • Improved load of tasks results by x10
  • Code cleaning
  • Multiple bug fixes

Full Changelog

v1.4.2 April 22, 2022

Improvements :

  • Possibility to duplicates events in timeline - #91
  • Possibility to filter timeline with basic query - #94

Fixes :

  • Integer limit on file size in evidences - #89
  • Gradient in closed cases
  • on-preload hooks list handling - #92
  • tags issue - #88
  • Case info modal from case - #93
  • Multiple UI issues

v1.4.1 April 8, 2022

v1.4.0 April 6, 2022

A bug fixe exists for this version. See v1.4.3

  • Hooks, adding the ability for modules to react on almost anything happening on the plateform in #75
  • New type of modules that can handles hooks
  • VirusTotal beta integration as a processor module
  • MISP beta integration as a processor module
  • Custom attributes on all case objects allowing to extend the default fields
  • A compact timeline view for better visbility
  • Premises of a dark theme
  • Resiliency of docker volume in #80
  • Minor improvements in #69, #79
  • Bug fixes in #70, #73, #77
  • Security fixes

v1.3.1 March 19, 2022

  • Fixes wheel issue preventing proper build of the docker, as described in #83

v1.3.0 January 24, 2022

  • Added the ability to batch upload IOC from a CSV file in #26
  • Added the ability to batch upload assets from a CSV
  • Screenshot - Export contents of any case pages as PNG in #35
  • Export timeline as CSV in #47
  • Improved timeline loading time by x10 - loads thousands of events in a sec
  • New auto parsing of dates in events addition/updates
  • Brand new timeline visualisations
  • Improved assets loading time
  • Shared links - easily share any case objects with your collaborators
  • Right panel now offers last activities for user's current case
  • Added assets tags in #37
  • New API endpoints in #53
  • Auto migration of database for next releases
  • Indication of mandatory fields in forms
  • General bug fixes, stability and UI improvement

v1.2.1 December 31, 2021

  • Added ATT&CK tactics by @ecapuano in #9
  • Added screenshot and video link in readme in #12
  • Fixed duplicated path to add customer in #4
  • Fixed asset description data validation client side in #7
  • Fixed tooltip in #10
  • Add a per-column filtering field in the case view by in #15