Configuration

Workflows

Customize incident phases, evidence handling workflows, and report templates to match your organization's processes.

Incident Phases (Lifecycle)

DFIRe comes with default incident phases based on NIST guidelines. You can customize these at Settings → Incident Lifecycle:

  • Add phases: Create additional phases for your process
  • Rename phases: Use terminology your team prefers
  • Reorder phases: Adjust the workflow sequence
  • Remove phases: Delete phases you don't use

Important: Incident phases are dynamic: changes affect all incidents, including existing ones. Removing a phase leaves the incidents that were in it without a phase. Its playbook actions move to the Unassigned group, where you can put them on another phase. Configure your incident lifecycle before taking the system into production use.

Case Type Actions

Actions (task checklists) are defined per case type, not globally. Each case type can have its own set of actions assigned to specific phases. Actions come in two flavors:

  • Simple Actions: Stateful checklist items that move through Pending, Started, Blocked, Done, and Skipped states. Use these for straightforward tasks like “Isolate affected endpoints” or “Notify Legal”.
  • Workflows (Decision Trees): Guided decision trees that walk the responder through a series of true/false questions to determine the correct course of action. Use these for complex decisions that depend on multiple conditions, such as determining notification obligations or escalation paths.

Both types can be configured within Case Type templates:

  1. Configure phases first

    Ensure your incident phases are set up before defining actions, as each action is assigned to a phase.

  2. Go to Settings → Playbooks

    Select or create the case type you want to configure.

  3. Define actions for each phase

    Add simple actions or decision tree workflows that should appear when an incident of this type is created.

See Playbooks for details on configuring playbooks and their actions.

Tip: You can also export your settings to JSON via Settings → Global Settings → Data Portability → Export, edit the case type definitions in a text editor, and import the modified JSON back into DFIRe.

Report Templates

An administrator configures report sections once for the whole installation, under Settings → Reporting. For each section you can:

  • Define section headings and order
  • Include boilerplate content for each section
  • Add a writing guide for each section (helps analysts know what to include and serves as a reference for quality assurance)
  • Choose whether it appears in incident reports, investigation reports or both

See Reports for more on report generation.

Evidence Handling Workflow

The evidence handling workflow defines the states evidence items can move through (e.g., Collected, In Analysis, Returned). Like incident phases, this workflow is configured at Settings → Evidence Workflow.

Configure before production: Changes to the evidence handling workflow affect all evidence items. Set up your workflow states before the system is in production use.

Notifications

DFIRe sends automatic in-app notifications to case team members for the following events:

  • Case status changes
  • Evidence added or updated
  • Notes added (case notes and evidence notes)
  • Files and photos uploaded
  • Team membership changes (investigators or viewers added or removed)
  • An indicator added to the case that already appears in other cases
  • Being mentioned with @
  • Compliance timer warnings, at a half, a quarter and a tenth of the time remaining
  • Compliance timer breaches

Everyone assigned to the case is notified, whether as lead investigator, investigator or viewer. A case with nobody assigned notifies nobody.

Notification rules are built into the system and are not user-configurable. For external integrations, see Webhooks.

← Knowledge base Playbooks →