Plugins

Besides being one of the only incident handling platform that's actually usable by humans, FIR can also be extended using plugins. Anyone can chose which plugins they want to install in their FIR instance, but two of them are mandatory:

• fir_plugins, which is used for plugin internals
• fir_artifacts, which defines the artifacts that FIR will automatically search for and correlate

Other available plugins are:

• fir_todos to be able to set task lists per incident and attribute them to business lines.
• fir_nuggets to be able to record technical findings (golden nuggets) and automatically sort them according to their timestamps, creating an investigation timeline.
• fir_alerting to be able to create templates and send email alerts directly through FIR's web-interface.

We recommend enabling them all for a better FIR experience!

Installing a plugin

In order to install plugins, follow these steps:

1. Make sure your plugin name starts with "fir_", so that it is properly loaded.
2. Make sure the plugin directory is in your python path. This is being done by default for plugins shipped with FIR.
3. Add your plugin name to the installed_apps.txt file in fir/config. If it doesn't exist, copy the fir/config/installed_apps.txt.sample file to fir/config/installed_apps.txt. This will enable fir_todos, fir_nuggets, and fir_alerting. You can individually disable plugins by removing their name from the installed_apps.txt file.
4. Follow the installation steps specified in the plugin's README file.