Base
Hardened build
minimal ports, security patches applied at build time
DFIR-IRIS on Ubuntu 24.04 LTS
Azure
Security
DFIR-IRIS, the open source collaborative platform where incident response and digital forensics teams run an investigation together, with cases, indicators, evidence and a full REST API in one shared workspace.
Overview
DFIR-IRIS is a collaborative case management platform for digital forensics and incident response. It gives a team one shared workspace per incident: a case with a structured investigation timeline, the assets that were touched, the indicators of compromise observed, the evidence collected with its hashes, and the tasks and notes that record who did what. Instead of an investigation living across spreadsheets, chat threads and one analyst's notebook, every artifact is recorded against the case with an audit trail, so a second responder can pick it up and a report can be generated from what was actually done. A complete REST API exposes the same objects the web interface uses, so cases can be opened, enriched and closed from existing tooling, and a pluggable module system connects it to sources such as MISP, VirusTotal, IntelOwl and EVTX processing, or to a webhook of your own. It is designed for the working pattern of a SOC or an IR practice: many concurrent analysts on one case, and many cases open at once.
Why the cloudimg image
DFIR-IRIS holds evidence, so how it is secured on first boot is the whole story, and this is where a community deployment is weakest. Upstream ships a development secret key, a default password salt and a self signed certificate that many deployments never replace. The cloudimg image replaces all of them per instance: every VM generates its own administrator password, REST API key, PostgreSQL and RabbitMQ passwords, Flask secret key, password salt and TLS certificate on first boot, written to a root only file, so no two deployments share a secret and there is no known default login to find. The stack is assembled and hardened for you rather than left as an exercise: gunicorn runs the application on loopback behind an nginx reverse proxy that terminates TLS and redirects plain HTTP, PostgreSQL 16 holds durable state and RabbitMQ drives a Celery worker for module pipelines and report generation, with PostgreSQL, RabbitMQ and gunicorn all bound to loopback and never exposed. Only SSH, HTTP and HTTPS are open, an unauthenticated health endpoint is provided for load balancer probes, and the image ships fully patched with 24/7 cloudimg support behind it.
Common uses
- Run a security incident as a shared case with timeline, IOCs, evidence and tasks
- Give a SOC or IR practice one self hosted case management system inside its own cloud account
- Drive case creation and enrichment from existing tooling through the REST API and modules
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.