Dashboard

Your account and roles

The line under the Dashboard heading names your account and the roles it holds. Roles decide what you can see and change throughout DFIRe, so this is the quickest way to confirm your own access without opening Settings. An account with no roles reads No roles assigned, and a superuser reads System Root. See Users and roles.

The case list

Each case is a card, or a row in the case table. A card carries the case number, title and description, the severity badge and the status. An open case reads Open - New until someone acknowledges it, and Open - In progress after that. An incident in its resolving phase reads Open - Resolved. When the project of an incident sets SLA targets, the right side of the card shows each target with the time left, or the time it took. A case in a project reads its project in front of the case number, as in Acme / CASE-2026-084, and the project name opens the project page. A case with an External Reference, such as a ticket number from another system, shows it in parentheses after the case number, as in Acme / CASE-2026-084 (INC-1234). Hover over a shortened reference to read all of it. Below those sit the playbook, the lead investigator and team size, counts of evidence, files and any indicators, and the tags of the case. A closed or archived case has a grey tint across the top of the card, with its severity greyed out too.

Every open case shows a progress bar. The footer of an incident card shows its current phase, and the footer of an investigation card shows its creation date.

Three things on a card are worth knowing about.

• Chat count. How many messages the case chat holds, with a red count of the ones you have not read. A case nobody has written in shows nothing. These load and refresh with the Dashboard rather than as messages arrive. A message written while you read the list therefore appears on the next refresh. Reading the chat clears the red count here too. See Case chat.
• Compliance countdown. Time left on any active deadline.
• Retention countdown. When retention rules are configured, the footer shows how long before the case is archived or deleted automatically. See Configuration.

The line above the list counts the cases of the tab that match the filters. The cards come in pages of 20, so the line reads, for example, 20 of 57 cases.

Cases from other installations

When this installation receives Dashboard data through Dashboard Sync and your role allows it, the cases of the sending installations share the list with your own. A remote card puts the name of its installation and a [remote] tag in front of the project and case number, as in Customer A [remote] / Phishing / CASE-2026-014. A grey Remote badge sits beside the status. The project name is plain text. Selecting the card opens the case on its own installation, in a new tab. Its SLA, compliance and retention countdowns follow the settings of that installation.

My actions on a remote card counts the open actions assigned to your email address on the sending installation. If your role can read case chat, a remote card shows how many chat messages the case holds, but never an unread count. Its tags work as on a local card.

When a sending installation stops answering, its cards stay for a while. After three minutes they show Last sync with the time of the last complete pull. After five minutes they leave the list until the installation answers again. Sync now, beside Collapse all, pulls from every sending installation at once instead of waiting for the next minute. If pulls from an installation stopped after repeated failures, a warning above the list names it until a superuser resets the connection. See Dashboard Sync.

Collapsing cards

The caret at the right of a card's top bar folds the card down to that bar alone. The bar then carries the case title alongside the severity, case number and status. Collapse all and Expand all above the list do the same to every case listed, which turns a long list into one line per case. Cards open expanded.

The case table

Table, at the right above the list, shows the Open, Closed and Archived tabs as a table with one row per case. Cards switches back. Selecting a row opens the case. DFIRe remembers the view and the columns in this browser.

The table has no pages: it holds every case of the tab that matches the filters, up to the newest 1,000. When a tab holds more, the line above the table says so. Narrow the filters to reach the rest.

Select a column heading to sort the table by that column. Select it again to reverse the order. The table opens sorted by Updated, newest first. Updated is when the details of the case last changed, such as its status, phase, severity or lead investigator. Adding a note, evidence or a file does not change it. Cases from an installation that runs an older version of DFIRe have no Updated time and sort last.

The table always shows Number and Title. Columns chooses the others: Severity, Status, Mode, Type, Project, System, Lead, Phase, Tags, SLA, Category, Outcome, Actions, Evidence, Files, IOCs, Created, Updated and Closed. It offers System only when this installation receives Dashboard data, and names this installation Local. The project page has the same table. There, it offers neither Project nor System, because every case belongs to that project and to this installation. A row from an installation that stopped answering shows Last sync, as its card does. Values show in full on one line, and DFIRe shortens only a very long title and a long tag. If the table is wider than the window, it scrolls sideways, and hiding columns makes it fit. A shadow at the edge shows where columns are out of view, and the arrow button on the heading row scrolls to them.

The SLA column shows the time left on the target due first. Hover over it to see which target that is. A paused target shows a pause mark. Once every target has finished, a check means met and a cross means breached.

Your own cases show the lead in bold. A lead that is a service account shows in amber with a robot icon. An integration created that case, and no person has taken it yet.

Tags

A card shows up to five tags of its case after the counts, and the Tags column of the table shows them the same way. Select +N to show the rest, and Hide to hide them again. DFIRe shortens a long tag, and pointing to it shows all of it. The Tags column is on by default, and its heading sorts by the number of tags, the most first. See Tags.

Select a tag to add the row Tags equals that tag, with Match case, to the filters of the list. Selecting a tag does not open the case. If the list already has that row, nothing changes. A list holds at most 20 filter rows. When it is full, a message asks you to remove one first. On a project page, the row goes to the filters of that page.

Filtering and tabs

Search cases and Filter sit above the list, before the view controls. The search looks in the title, the number, the description and the tags of each case. Filter adds a filter row: choose a field, a comparison and a value. The fields are Title, Number, Description, Tags, Severity, Status, SLA, Mode, Type, Project, Lead, System, Phase, Category, Outcome, Created, Updated and Closed. Category and Outcome list the incident categories and outcome verdicts kept in the settings, and No category and No outcome find the cases without one. Project lists the projects you can see and marks an inactive one. Lead lists the active accounts, including the service accounts that integrations use. A user who may change user accounts also sees the deactivated accounts, after the active ones and marked. Severity also offers Undetermined.

Each row shows as a chip under the toolbar. Select a chip to change its row, or its remove button to remove the row. Clear filters removes every row and keeps the search. A later row starts with AND, OR or NOT, and DFIRe reads the rows from left to right. Severity equals High OR Mode equals Incident AND Lead equals Unassigned keeps the cases without a lead that are high or are incidents. NOT leaves out the cases that match its row, so NOT Project equals Acme lists every case outside Acme. A text comparison ignores case unless you select Match case.

The order of the rows matters. Severity equals High OR Severity equals Critical AND Title contains phishing keeps the high and critical cases about phishing. With the Title row moved to the start, the same rows keep the high cases about phishing and every critical case.

To move a row, drag its chip by the grip at its start. From the keyboard, select the grip, press Space, move the chip with the left and right arrow keys, and press Space again. Escape puts the chip back. An OR row that moves to the start becomes AND, because no row comes before it.

A date row takes a day and an optional 24-hour time, in your display time zone. Is after keeps the cases from the next day, or from the next minute when you set a time. Is before keeps the cases before the chosen day or minute starts.

A Tags row compares each tag of a case on its own. Equals keeps the cases with that tag, and contains keeps the cases with a tag that holds the text. Does not equal and does not contain keep every other case, including the cases without tags.

Status equals New finds the open cases that nobody has acknowledged. SLA equals At risk finds the open incidents with a fifth or less of the time left on the SLA target due first. SLA equals Breached finds the open incidents past that deadline. The target due first is the running target with the earliest deadline. Its state is the SLA state of the incident, so an incident is either at risk or breached, never both. See Incident SLA targets. The summary statistics count the same cases as the filtered list.

The search, the filter rows and the tab are part of the page address. A filtered list therefore survives a reload and opens from a shared link, and a case opened from it links back to the same list. Older addresses still work: ?project=<ID> and ?attention=new, sla_at_risk or sla_breached open the Dashboard with the matching row.

When this installation receives Dashboard data, System narrows the list to this installation (Local) or to one sending installation. The Project and Lead values then name their system, and the same name on two systems stays two values. No project and Unassigned match cases on every system. A local lead also matches the remote cases whose lead investigator has the same email address.

In the card view, Sort by lists cases newest first, or by SLA time left. The table sorts from its column headings instead. See The case table. SLA time left puts the open incident with the least time left on its target due first, with overdue incidents before it. Cases without a running target follow, newest first. If no case matches the search and the filters, the list says No cases match these filters. If the cases do not load, the list says so instead of showing none.

The tabs

Tabs at the top of the list switch between the Dashboard's views:

• Daily Summary - An operational digest of what moved in the last 24 hours and what is outstanding. See Daily Summary below
• Open cases - Cases that are open. This is the view the Dashboard opens on
• Closed - Cases that are closed but not archived
• Archived - Cases that have been archived and are no longer actively worked on. This tab is shown only to users whose role allows viewing archived cases
• Projects - The projects, as cards or as a table. See The Projects tab below
• Evidence - The evidence items of every case you can see, with their case. This tab is shown only to users whose role allows viewing cases and evidence. See The Evidence tab below

The Projects tab

The Projects tab lists the projects as cards or as a table. Choose Cards or Table at the right above the list. Your browser remembers the choice. A card shows the organization, the lead and the open and total case counts, with the project color along the top. The cards are in name order. Select a project to open its page. See Projects.

The table shows the same facts in columns: Name, Organization, Lead, Open cases, Total cases, SLA breached and SLA at risk. Columns also offers Created and Updated, and your browser remembers which columns you show. A dot before the name shows the project color. Only users whose role may view legal entities see the Organization column. Projects you lead show the lead in bold. The table opens sorted by name. Select a column heading to sort by that column, and select it again to reverse the order.

A project with open incidents in SLA trouble shows how many are breached or at risk. The line above the list counts the projects. When the search or the filters hide projects, it says how many of them the list shows, for example 3 of 4 projects. If the projects do not load, the tab says so instead of showing none.

The tab opens with the filter Status equals Active, so it lists only active projects. Remove that filter to list inactive projects too. The table marks them Inactive. Search projects finds a project by its name or description. Filter narrows the list by Name, Status, Lead, Created or Updated, and by Organization if you can see that column. A reload keeps the search and the filters, and so does Back to Projects on a project you opened from the tab.

The Evidence tab

The Evidence tab lists the evidence items of every case you can see in one table. Use it to check all evidence without opening each case. It includes the items of closed cases, and of archived cases if your role allows viewing them.

Each row shows the item and its case. The columns are Name, Case, Case title, Case status, Case lead, Case tags, Type, Status, Flags, Custodian, Location, Files and Added. Columns also offers Owner, User and Updated, and your browser remembers which columns you show. Child items sit indented under their parent, as in the Evidence tab of a case. Cases you lead show the lead in bold.

The table opens with the newest item first. Select a column heading to sort by that column, and select it again to reverse the order. Case status sorts in the order Open, Closed, Archived, and Case tags sorts by the number of tags.

Search evidence finds an item by its name, type, owner or flags, or by the number, title or tags of its case. Filter narrows the list by Name, Case, Case title, Case status, Case lead, Case tags, Type, Status, Flags, Owner, User, Custodian, Location, Added or Updated. For example, Case status equals Archived lists the evidence of archived cases. Select a tag in the Case tags column to list the evidence of every case that carries that tag. The line above the list counts the items. With a search or a filter, it counts the items that match, for example 3 of 40 items.

Select an item to open it, or a case title to open the case. On the case, Back to Dashboard returns to this tab with the same search and filters. This also works when you reach the case through Return to Case on an item.

Summary statistics

A statistics bar is displayed above the case list, providing a high-level overview of your caseload. The statistics shown include:

• Total cases - The total number of cases matching the current filters
• Open count - Number of cases with Open status
• Closed count - Number of cases with Closed status
• Archived count - Number of archived cases
• Investigation / Incident split - Breakdown of cases by mode
• Severity donut chart - A visual chart showing the distribution of cases across severity levels, with undetermined priorities as their own slice

The counts include the remote cases that match the filters. For the time to resolve, see Analytics.

Daily Summary

The Daily Summary tab answers one question: what happened since yesterday, and what still needs doing. It is built for a shift handover or a morning standup, where you need the shape of the whole caseload before you open any single case. Everything on it is derived from the cases you have access to. Relevant case activity refreshes the Daily Summary in real time, including changes to active blockers.

The severity cutoff

The digest starts at High severity and above. Use the cutoff control to widen or narrow it: each stop admits that severity and everything more serious. Every stop carries the number of open cases it would bring in, so you can see whether widening would gain you anything before you click. The lowest stop is Undetermined, and only that stop lists investigations whose priority is not yet set.

The Daily Summary does not use the search or the filter rows of the case lists, because the digest always reports on current work. Its own All / Investigations / Incidents toggle narrows it to one mode.

Active cases

The cases at or above the cutoff are in four lists, ordered by severity:

• Active cases - New: the open cases that nobody has acknowledged, the most severe first, then the one that has waited longest. The heading also counts the new cases without a lead.
• Active cases - In progress: the acknowledged open cases.
• Active cases - Resolved: the open incidents in or past the resolving phase.
• Closed today: the cases closed in the last 24 hours. A case that closed yesterday is still part of the day's story.

The page leaves out the Resolved and Closed today lists when they are empty. The cutoff never hides an open incident whose SLA target is at risk or breached.

Markers on a case: Age < 24h for a case opened in the last 24 hours, Reopened for a case reopened in the last 24 hours, and Closed for a case closed in the last 24 hours.

Each case shows a summary you can read without opening anything:

• The first line carries the project and the case number, as on the case card, then the severity, any timer or SLA badge, and any movement marker.
• The second line carries the title.
• The third line carries the current phase and the lead investigator. A sentence after them says how much activity the case saw in the last 24 hours, how many actions remain open in its current phase, and how many are blocked.

Select a case to expand it. Activity in the last 24 hours lists everything that happened, in full: a busy day is itself worth seeing, so nothing is hidden behind a count. Open actions lists the unresolved work in the case's current phase, each with its own state, and a blocked action names what it is waiting on. Pointing at an action highlights the matching activity entry and the other way round, tying what happened to what is outstanding. Use Expand all and Collapse all to open or close every case at once, and the icon at the end of a case to open the case in a new browser tab. The summary keeps its state in the original tab.

Compliance deadlines and SLA targets

A case whose compliance timer or SLA target needs attention is outlined and carries a badge beside its severity:

• Timer breached, in red. A compliance deadline has been missed.
• Timer warning, in amber. A compliance deadline is approaching.
• SLA breached, in red, with the time overdue. The SLA target due first has passed its deadline.
• SLA warning, in amber, with the time left. The SLA target due first is at risk.
• SLA paused, in grey. The resolution SLA timer is paused. An SLA badge on a paused clock carries a pause icon.

A breach of a timer or a target gives a red outline. A warning alone gives an amber one. A timer marking clears when someone completes the timer, and an SLA marking when the target is met. Closed cases carry no marking. A warning or breach stays marked when it began more than 24 hours ago. Only the activity list keeps to the rolling 24-hour window. See Incidents for compliance timers and Incident SLA targets for the SLA.

All active blockers

Below the cases, a single table lists every blocked action across the open cases you can see, most severe case first. Each row names the action, what it is waiting on, and who owns it, and the case number takes you straight to that case's Actions tab. This is the standup list: the work that cannot move until someone clears the way.

Blocked actions in closed cases are not listed. Closing a case settles its outstanding work, so those blockers remain on the case as a record rather than appearing here as live.

The AI brief

When an AI provider is configured, AI summary writes the whole digest up as a short prose brief you could read aloud in two minutes. It covers the shape of the day, every case in the current focus list, anything blocked, the new cases and the incidents with an SLA target at risk or breached. The brief is written only from the digest, so it cannot mention a case you would not otherwise see.

Once written, the brief offers Copy for pasting into an email or a chat, Print for a shareable one-page sheet, Regenerate to write it again over current data, and Dismiss to clear it.

The printed sheet shows the organization name and logo, and names the model that wrote the brief. If an administrator has set a report disclaimer, the printed sheet and the copied text both end with it. See Report customization.

Configuring a provider is covered in AI Integration. Without one, the Daily Summary works exactly as described above, without the brief.

Creating and importing

Three buttons sit at the top of the page. New Case opens the case creation dialog, and New Project creates a grouping for related cases. New Project shows only for a role that may create projects. Both are covered in Cases.

Importing a case

Import Case reads a case file exported from this or another DFIRe installation. The import matches each person in the file to the account with the same username on this installation. It re-attributes any author it cannot match to you.

Exporting a case needs the export permission, and importing one needs the import permission. Every built-in role can export cases. Standard user, Team Lead and DFIRe Admin can also import them. An administrator decides which roles keep these permissions. A role without them keeps its cases and loses the buttons. See User Management.

An import brings across the case details, the evidence items with their runbook progress, notes, timeline events, indicators, compliance timers, reports and the chat transcript. The import leaves out an indicator whose value is not valid for its type, and the summary names it with the reason. It sends no outbound webhooks, so ingesting a case cannot flood connected systems with notifications about work that happened elsewhere.

Each part of an import asks for the permission for what it writes. Importing a case does not grant you what your role withholds. A role that cannot add notes, evidence, custody records, timeline entries, indicators, reports or compliance timers does not acquire them this way. The rest of the case still arrives, and the summary names what it left out. Every shipped role that can import holds all of these, so a standard installation sees no difference.

The chat transcript follows the same rule, and adds one of its own. An export carries it only when the person exporting may read chat. An import writes it only when they may write chat, and reports it as skipped otherwise. An unmatched chat author stays unattributed rather than re-attributed, because a chat message is a quotation rather than a record someone filed. See Case chat.

Getting around

The header bar carries the same links from every page, in this order: Dashboard, Entities directory, IOC Registry, Knowledge Base and Global Search. The Knowledge Base link appears only for roles that may read it.

To the right sit a live server clock, which switches between UTC and your local time when you select it, and the user avatar menu holding your profile, Settings for administrators, and sign-out.

Personal preferences

The user avatar menu holds three display settings that affect only your own view of DFIRe:

Checkboxes match the selected theme. Selected boxes show a dark green check in Light and a bright green check in Dark and Graphite.

• Theme - Choose System, Light, Dark or Graphite. System follows the light or dark setting of your operating system. Graphite is a dark theme in neutral grays with softer colours. This setting is stored with your account, so it follows you to any browser you sign in from.
• Layout - Choose Column or Wide. Column keeps pages in a centred column. Wide uses the full width of the browser window with a narrow margin at the edges. Tables such as the Evidence table then get more room. Knowledge Base pages, the report editor and case chat keep their reading width in both layouts. Like the background, DFIRe saves the choice in the browser you set it in, because the width that works depends on your screen.
• Background - Choose Off or Aurora. Aurora draws a slow, soft colour wash behind the application. It is off until you turn it on. The choice sticks to the browser you set it in rather than to your account, so you can enable it on your own machine without it following you onto a shared or remote one. If your operating system is set to reduce motion, the wash is drawn as a still image.