Skip to content
Fast Incident Response
Python HTML JavaScript CSS Dockerfile
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
docker Bump Alpine Linux from 3.4 to 3.7 to fix OpenSSL SSL_ERROR_SYSCALL, e… Mar 27, 2018
fir Fixes import error when two_factor is not installed Jan 19, 2018
fir_abuse fixes #165 Feb 13, 2017
fir_alerting Improvement in fir_alerting Jan 3, 2018
fir_api Work on profile view Nov 24, 2016
fir_artifacts fir_artifacts: Check user permission to show and detach artifacts Jan 12, 2017
fir_artifacts_enrichment README for fir_abuse and fir_artifacts_enrichment plugin Jan 23, 2017
fir_celery README for fir_abuse and fir_artifacts_enrichment plugin Jan 23, 2017
fir_email Email: Add French translation Jan 26, 2017
fir_notifications Fix invalid document path Nov 18, 2017
fir_nuggets Code cleanup Dec 7, 2016
fir_plugins Markdown : allow fenced code blocks Oct 2, 2017
fir_relations fir_relations: Add French translation Jan 12, 2017
fir_threatintel update fir_threatintel urls to more recent Django practices Mar 21, 2017
fir_todos Avoid duplicates and limit results Nov 25, 2016
incidents * Change default behavior when using "Enter" key to submit and not go… Jan 23, 2019
logs initial commit Mar 11, 2015
uploads initial commit Mar 11, 2015
.env Added files to make deploy to heroku possible Aug 30, 2016
.gitignore Begun structuring of API. Added artifact whitelist Jan 20, 2016
.travis.yml Add simple travis file. Feb 16, 2016
LICENSE Update LICENSE Mar 11, 2015
Procfile Added files to make deploy to heroku possible Aug 30, 2016 Wording Jun 25, 2018 initial commit Mar 11, 2015
requirements.txt * Update models and forms to be compatible with Django 1.11 Jan 5, 2018
runtime.txt Added files to make deploy to heroku possible Aug 30, 2016

Build Status

What is FIR? Who is it for?

FIR (Fast Incident Response) is an cybersecurity incident management platform designed with agility and speed in mind. It allows for easy creation, tracking, and reporting of cybersecurity incidents.

FIR is for anyone needing to track cybersecurity incidents (CSIRTs, CERTs, SOCs, etc.). It was tailored to suit our needs and our team's habits, but we put a great deal of effort into making it as generic as possible before releasing it so that other teams around the world may also use it and customize it as they see fit.

dashboard incident details

See the wiki for the user manual and more screenshots !


There are two ways to install FIR. If you want to take it for a test-drive, just follow the instructions for setting up a development environment in the Wiki.

If you like it and want to set it up for production, here's how to do it.

A dockerfile for running a dev-quality FIR setup is also available in docker/Dockerfile.

Deploy to Heroku via fir/


A dedicated users mailing list is available

Technical specs

FIR is written in Python (but you probably already knew that), using Django 1.9. It uses Bootstrap 3 and some Ajax and d3js to make it pretty. We use it with a MySQL back-end, but feel free to use any other DB adaptor you might want - as long as it's compatible with Django, you shouldn't run into any major issues.

FIR is not greedy performance-wise. It will run smoothly on a Ubuntu 14.04 virtual machine with 1 core, a 40 GB disk and 1 GB RAM.


  • Nested Todos
  • Mailman
  • You name it :)
You can’t perform that action at this time.