Dashboard

Your account and roles

The line under the Dashboard heading names your account and the roles it holds. Roles decide what you can see and change throughout DFIRe, so this is the quickest way to confirm your own access without opening Settings. An account with no roles reads No roles assigned, and a superuser reads System Root. See Users and roles.

The case list

Each case is a card. It carries the case number, title and description, the severity badge and the status. An open case reads Open - New until someone acknowledges it, and Open - In progress after that. An incident in its resolving phase reads Open - Resolved. When the project of an incident sets SLA targets, the right side of the card shows each target with the time left, or the time it took. A case in a project reads its project in front of the case number, as in Acme/CASE-2026-084, and the project name opens the project page. Below those sit the playbook, the lead investigator and team size, and counts of evidence and files. A closed or archived case has a grey tint across the top of the card, with its severity greyed out too.

Every open case shows a progress bar. The footer of an incident card shows its current phase, and the footer of an investigation card shows its creation date.

Three things on a card are worth knowing about.

• Chat count. How many messages the case chat holds, with a red count of the ones you have not read. A case nobody has written in shows nothing. These load and refresh with the Dashboard rather than as messages arrive. A message written while you read the list therefore appears on the next refresh. Reading the chat clears the red count here too. See Case chat.
• Compliance countdown. Time left on any active deadline.
• Retention countdown. When retention rules are configured, the footer shows how long before the case is archived or deleted automatically. See Configuration.

Collapsing cards

The caret at the right of a card's top bar folds the card down to that bar alone. The bar then carries the case title alongside the severity, case number and status. Collapse all and Expand all above the list do the same to every case listed, which turns a long list into one line per case. Cards open expanded.

Filtering and tabs

Dropdowns above the list filter by project, investigator, severity and attention. The project filter lists active projects, and an inactive project as long as it still has open cases. The severity filter also finds investigations with an undetermined priority. A toggle beside them narrows to investigations or incidents, or leaves both showing.

The Attention filter finds the cases to act on first:

• New - Open cases that nobody has acknowledged
• SLA at risk - Open incidents with a fifth or less of the time left on the SLA target due first
• SLA breached - Open incidents past the deadline of the SLA target due first

The target due first is the running target with the earliest deadline. Its state is the SLA state of the incident, so an incident is either at risk or breached, never both. See Incident SLA targets. The summary statistics count the same cases as the filtered list. To open the Dashboard with this filter set, add ?attention=new, ?attention=sla_at_risk or ?attention=sla_breached to its address.

The Sort dropdown lists cases newest first, or by SLA time left. SLA time left puts the open incident with the least time left on its target due first, with overdue incidents before it. Cases without a running target follow, newest first. Clear resets the filters and keeps the sort.

The tabs

Tabs at the top of the list switch between the Dashboard's views:

• Daily Summary - An operational digest of what moved in the last 24 hours and what is outstanding. See Daily Summary below
• Open cases - Cases that are open. This is the view the Dashboard opens on
• Closed - Cases that are closed but not archived
• Archived - Cases that have been archived and are no longer actively worked on. This tab is shown only to users whose role allows viewing archived cases
• Projects - The projects in name order, with the organization, the lead and the open and total case counts of each. Choose Cards or List; your browser remembers the choice. A project with a color shows it along the top of its card or the left edge of its row. Select a project to open its page. A project with open incidents in SLA trouble shows how many are breached or at risk. Turn on Show inactive projects to list inactive projects too. See Projects

Summary statistics

A statistics bar is displayed above the case list, providing a high-level overview of your caseload. The statistics shown include:

• Total cases - The total number of cases matching the current filters
• Open count - Number of cases with Open status
• Closed count - Number of cases with Closed status
• Archived count - Number of archived cases
• Investigation / Incident split - Breakdown of cases by mode
• Severity donut chart - A visual chart showing the distribution of cases across severity levels, with undetermined priorities as their own slice
• MTTR (Mean Time To Resolve) - The average time from declaration to resolution across resolved incidents

Daily Summary

The Daily Summary tab answers one question: what happened since yesterday, and what still needs doing. It is built for a shift handover or a morning standup, where you need the shape of the whole caseload before you open any single case. Everything on it is derived from the cases you have access to. Relevant case activity refreshes the Daily Summary in real time, including changes to active blockers.

The severity cutoff

The digest starts at High severity and above. Use the cutoff control to widen or narrow it: each stop admits that severity and everything more serious. Every stop carries the number of open cases it would bring in, so you can see whether widening would gain you anything before you click. The lowest stop is Undetermined, and only that stop lists investigations whose priority is not yet set.

On the Daily Summary tab, this control replaces the filter and sort dropdowns, because the digest always reports on current work. Opening the tab resets the project, investigator, severity and attention filters. The All / Investigations / Incidents mode toggle still applies.

Active cases

The cases at or above the cutoff are in four lists, ordered by severity:

• Active cases - New: the open cases that nobody has acknowledged, the most severe first, then the one that has waited longest. The heading also counts the new cases without a lead.
• Active cases - In progress: the acknowledged open cases.
• Active cases - Resolved: the open incidents in or past the resolving phase.
• Closed today: the cases closed in the last 24 hours. A case that closed yesterday is still part of the day's story.

The page leaves out the Resolved and Closed today lists when they are empty. The cutoff never hides an open incident whose SLA target is at risk or breached.

Markers on a case: Age < 24h for a case opened in the last 24 hours, Reopened for a case reopened in the last 24 hours, and Closed for a case closed in the last 24 hours.

Each case shows a summary you can read without opening anything:

• The first line carries the project and the case number, as on the case card, then the severity, any timer or SLA badge, and any movement marker.
• The second line carries the title.
• The third line carries the current phase and the lead investigator. A sentence after them says how much activity the case saw in the last 24 hours, how many actions remain open in its current phase, and how many are blocked.

Select a case to expand it. Activity in the last 24 hours lists everything that happened, in full: a busy day is itself worth seeing, so nothing is hidden behind a count. Open actions lists the unresolved work in the case's current phase, each with its own state, and a blocked action names what it is waiting on. Pointing at an action highlights the matching activity entry and the other way round, tying what happened to what is outstanding. Use Expand all and Collapse all to open or close every case at once, and the icon at the end of a case to open the case in a new browser tab. The summary keeps its state in the original tab.

Compliance deadlines and SLA targets

A case whose compliance timer or SLA target needs attention is outlined and carries a badge beside its severity:

• Timer breached, in red. A compliance deadline has been missed.
• Timer warning, in amber. A compliance deadline is approaching.
• SLA breached, in red, with the time overdue. The SLA target due first has passed its deadline.
• SLA warning, in amber, with the time left. The SLA target due first is at risk.
• SLA paused, in grey. The resolution SLA timer is paused. An SLA badge on a paused clock carries a pause icon.

A breach of a timer or a target gives a red outline. A warning alone gives an amber one. A timer marking clears when someone completes the timer, and an SLA marking when the target is met. Closed cases carry no marking. A warning or breach stays marked when it began more than 24 hours ago. Only the activity list keeps to the rolling 24-hour window. See Incidents for compliance timers and Incident SLA targets for the SLA.

All active blockers

Below the cases, a single table lists every blocked action across the open cases you can see, most severe case first. Each row names the action, what it is waiting on, and who owns it, and the case number takes you straight to that case's Actions tab. This is the standup list: the work that cannot move until someone clears the way.

Blocked actions in closed cases are not listed. Closing a case settles its outstanding work, so those blockers remain on the case as a record rather than appearing here as live.

The AI brief

When an AI provider is configured, AI summary writes the whole digest up as a short prose brief you could read aloud in two minutes. It covers the shape of the day, every case in the current focus list, anything blocked, the new cases and the incidents with an SLA target at risk or breached. The brief is written only from the digest, so it cannot mention a case you would not otherwise see.

Once written, the brief offers Copy for pasting into an email or a chat, Print for a shareable one-page sheet, Regenerate to write it again over current data, and Dismiss to clear it.

Configuring a provider is covered in AI Integration. Without one, the Daily Summary works exactly as described above, without the brief.

Creating and importing

Three buttons sit at the top of the page. New Case opens the case creation dialog, and New Project creates a grouping for related cases. New Project shows only for a role that may create projects. Both are covered in Cases.

Importing a case

Import Case reads a case file exported from this or another DFIRe installation. The dialog lets you map users, and re-attributes any author it cannot map to you.

Exporting a case needs the export permission, and importing one needs the import permission. Every built-in role can export cases. Standard user, Team Lead and DFIRe Admin can also import them. An administrator decides which roles keep these permissions. A role without them keeps its cases and loses the buttons. See User Management.

An import brings across the case details, the evidence items with their runbook progress, notes, timeline events, indicators, compliance timers, reports and the chat transcript. It sends no outbound webhooks, so ingesting a case cannot flood connected systems with notifications about work that happened elsewhere.

Each part of an import asks for the permission for what it writes. Importing a case does not grant you what your role withholds. A role that cannot add notes, evidence, custody records, timeline entries, indicators, reports or compliance timers does not acquire them this way. The rest of the case still arrives, and the summary names what it left out. Every shipped role that can import holds all of these, so a standard installation sees no difference.

The chat transcript follows the same rule, and adds one of its own. An export carries it only when the person exporting may read chat. An import writes it only when they may write chat, and reports it as skipped otherwise. An unmapped chat author stays unattributed rather than re-attributed, because a chat message is a quotation rather than a record someone filed. See Case chat.

Getting around

The header bar carries the same links from every page, in this order: Dashboard, Entities directory, IOC Registry, Knowledge Base and Global Search. The Knowledge Base link appears only for roles that may read it.

To the right sit a live server clock, which switches between UTC and your local time when you select it, and the user avatar menu holding your profile, Settings for administrators, and sign-out.

Personal preferences

The user avatar menu holds two display settings that affect only your own view of DFIRe:

• Theme - Choose System, Light or Dark. This setting is stored with your account, so it follows you to any browser you sign in from.
• Background - Choose Off or Aurora. Aurora draws a slow, soft colour wash behind the application. It is off until you turn it on. The choice sticks to the browser you set it in rather than to your account, so you can enable it on your own machine without it following you onto a shared or remote one. If your operating system is set to reduce motion, the wash is drawn as a still image.