Quick start

Before you start

DFIRe runs as a set of Docker containers on a Linux host. You need Docker 24.0 or later with the Compose plugin 2.24.4 or later. Allow 4 GB of RAM and 20 GB of free disk.

The installer can run PostgreSQL in a container for evaluation. For production, point DFIRe at a PostgreSQL 16 server you manage, so backups and availability stay under your control.

A new installation runs for 90 days without a license. You need nothing else to start.

Install

Run the installer in an empty directory. It refuses to overwrite existing Compose files, so a second attempt cannot damage a working installation.

1. Download the installer
   curl -fsSL https://dfire.fi/install.sh -o install.shCopy
2. Run it
   chmod +x install.sh && ./install.shCopy
3. Answer the prompts

   The installer asks for five things, in this order.

   • Database. An external PostgreSQL server, or the bundled container for evaluation. If your database sits behind a connection pooler such as PgBouncer or RDS Proxy, say so. DFIRe then also asks for a direct URL, because migrations and backups cannot run through a pooler.
   • Web access. An external reverse proxy with HTTPS, or direct HTTP for evaluation.
   • Hostname. The name people type in their browser. It goes into the allowed hosts, CORS and CSRF settings, so it must match how DFIRe is actually reached.
   • Administrator account. Optional at this point. Leave the password empty and the installer generates one and prints it once, at the end.
   • Encryption keys. Generate a new pair for a new installation. Supply an existing pair only when you rebuild an installation from its backup.
4. Wait for the stack to start

   The installer downloads the release bundle for the current version, verifies its checksums, and writes your answers to .env with mode 0600. It then pulls the pinned images, starts the containers, and waits until the frontend and the API both answer their health checks.

The installer prints the address to open. Behind an external reverse proxy, DFIRe becomes reachable once you have configured that proxy.

First sign-in

Open the address the installer printed and sign in as the administrator. If you skipped the administrator prompt, create the account first:

docker compose exec backend python manage.py createsuperuser

Two setup screens run before the dashboard appears.

1. Accept the licence agreement

   Read the end-user licence agreement and accept it.

2. Enter your organization details

   DFIRe asks for an organization name and a contact email, which it uses for license registration and support. Only an administrator can complete this step, and DFIRe stays blocked until someone does. The same screen lets you opt out of sending usage statistics. License validation works either way.

Open your first case

Choose New Case on the dashboard.

Case Mode decides how the case behaves. An investigation is for triage and analysis. An incident records a declaration time and moves through phases. You can escalate an investigation to an incident later. The escalation sets the declaration time, moves the case onto the first phase, and adds the incident-only report sections. It removes nothing.

Playbook is required. It gives the new case a ready-made to-do checklist, where each item can be pinned to a phase and can carry a runbook. A playbook can also define extra fields, which DFIRe then collects on a second step before creating the case.

The remaining fields are optional. Project groups cases that belong together, such as several cases from one intrusion. Create projects with New Project on the dashboard. External Reference holds your ticket number from another system, and ENISA Category classifies the case for reporting.

Where to go next