DFIRe documentation

How to deploy DFIRe, configure it for the way your team works, and use it day to day. If you are installing for the first time, start with the quick start.

Quick start Production deployment

Start here

Quick start

Install with Docker Compose and open your first case.

Configuration

Environment variables, secrets and the settings that matter on day one.

Cases

How a case is structured and how work moves through it.

Evidence

Items, attributes, custody records and printable receipts.

Single sign-on

Connect an OIDC provider and map roles to your groups.

Backup and recovery

Schedules, validation and restoring an instance.

System requirements

Component	Small evaluation	Production starting recommendation
CPU	2 vCPU	8 vCPU
RAM	4 GB	16 GB
Storage	20 GB free SSD space	100 GB SSD system disk, plus evidence and backup storage
Docker	24.0	Latest stable
Docker Compose	2.24.4	Latest stable

These are planning recommendations, not measured capacity limits. Size evidence and backup storage to your caseload and retention requirements. Use a separately managed PostgreSQL 16 or later server for production, with its own resource allocation.

Getting help

The support page covers diagnostics and the support bundle. For anything else, write to [email protected]. Security reports go to the address in our security policy.

All documentation

Getting started

Quick start: Install DFIRe with Docker Compose, complete first sign-in, and open your first case.

Deployment: Deploy DFIRe manually from a release-pinned Docker Compose bundle, behind HTTPS or in an air-gapped network.

Configuration: A map of DFIRe's System Settings: who can open each tab, where each one is documented, and the settings this page covers in full.

Updating DFIRe: Update DFIRe with the installer or by replacing the release bundle by hand, and recover an update that failed.

Using DFIRe

Dashboard: Overview of the DFIRe Dashboard, your central hub for managing cases, filtering views, and monitoring investigations.

Cases: How a case is structured, what changes between investigation and incident mode, and how work moves through it.

Case chat: Case Chat is DFIRe's case-scoped conversation: a persistent transcript kept with the case, with the AI assistant answering when it is addressed.

Evidence: Track physical and digital evidence with metadata, ownership, encrypted files and a verifiable chain of custody.

Incident response: Phases, the action checklist, and how DFIRe tracks an incident from declaration to resolution.

Timeline: Use DFIRe's timeline feature to track and visualize the chronological sequence of events in your investigations.

Indicators of compromise: Manage Indicators of Compromise (IOC) with STIX 2.1 types, enrichment, cross-case correlation, and threat intelligence sharing in DFIRe.

Reports: Generate professional investigation reports with DFIRe's rich text editor, configurable sections, and QA workflow.

Search: Full-text search across cases, evidence, files, notes, chat and more, scoped to what you may see.

Knowledge base: Write and organize internal documentation, control who sees it, and encrypt what must stay private.

Configuration

Workflows: Configure incident response workflows, phase definitions, and evidence handling workflows in DFIRe.

Playbooks: Configure playbooks with custom fields, action templates, and workflows for different investigation and incident response scenarios.

Runbooks: Create and manage procedural runbooks for evidence handling and incident response actions in DFIRe.

Evidence types: Configure evidence types and their fields for organizing digital forensic evidence.

Compliance timers: Track regulatory notification deadlines with compliance timers for GDPR, NIS2, DORA, HIPAA, SEC, and other frameworks.

Entities: Manage legal entities including people, organizations, and government bodies in DFIRe for evidence custody tracking.

Timestamp formats: The log timestamp formats DFIRe recognises when you paste a value into a date or date-and-time field, with examples.

Administration

Users and roles: Create accounts, assign roles, control what each role can do, and manage sign-in, sessions and multi-factor authentication.

Single sign-on: Connect an OIDC identity provider, restrict who may sign in through it, and understand how DFIRe provisions SSO accounts.

Storage: Configure storage targets, bind them to roles, and understand the Secure and Direct attachment tiers.

Email delivery: Configure how DFIRe sends mail: SMTP, Amazon SES, Mailgun, Microsoft 365 or Google Workspace, sender addresses, delivery limits and the test message.

Backup and recovery: Create encrypted database snapshots, restore them, and understand what DFIRe backs up and what you own.

Audit log: What DFIRe records, who can read it, why it cannot be edited, and how to forward it to an external system.

Analytics: Workload and response metrics across cases, and how the numbers are scoped to what you can see.

Support and diagnostics: Generate a support package, watch the application logs live, collect host diagnostics when DFIRe is down, and check container versions.

Integrations

Slack and Jira: Configure DFIRe integrations including Slack for team collaboration, Jira for task tracking, and log forwarding to external SIEM systems.

Automation: Automatically invite people, assign the case team, and notify external systems when a case opens or changes, using DFIRe automation rules.

Webhooks and Email: Configure notifiers that deliver by HTTP request or by email: trigger events, templates, recipients, secrets and delivery history.

API access: Manage API keys, service accounts, and programmatic access to DFIRe for SIEM, SOAR, and custom integrations.

MCP server: Connect AI agents to DFIRe using the built-in Model Context Protocol (MCP) server. Configure tool groups, authentication, and client setup.

AI integration: DFIRe's LLM integration for AI-powered report generation, including architecture, configuration, prompt management, and data handling.

Security

Application security: Technical overview of DFIRe's security architecture including authentication, encryption, and access controls.

Supply chain: How DFIRe's build and release pipeline defends against software supply chain attacks: pinning, integrity verification, adoption cooldowns, and release gating.

Secure development: How DFIRe is designed, built, verified and released: the code quality and security gates at each stage of the development lifecycle.

Third-party licences: Open source licenses and attributions for third-party software used in DFIRe.

Releases

Changelog: All notable changes to DFIRe, organized by version. The project follows Semantic Versioning.