Skip to content

Home

Jump to bottom
zach115th edited this page Jul 17, 2026 · 14 revisions

IRIS-NG Wiki

IRIS-NG is a community fork of DFIR-IRIS v2.5.0-beta.1 with native MISP integration, MISP nomenclature alignment, and an in-tree AI assistant layer. Upstream paused feature development in late 2024 and stranded v2.5.0-beta.1 in beta; this fork picks up where it left off.

Pages

Topic Page
Install and run (Docker Compose) Getting Started
Three-layer architecture, APIs, module system Architecture
AI surfaces, model routing, async queue AI Features
Native MISP sync, IOC taxonomy MISP Integration
Working timeline, Hayabusa/EZ Tools ingest Dual Timeline
Cross-case IOC correlation, cluster narratives IOC Correlation
Evidence drive inventory, barcode lookup, retention policy Evidence Inventory
Dashboard metrics, time tracking, analyst skills + teams Dashboard Analytics
/api/v2/ endpoint catalogue API Reference
Dev loop, rebuild rules, load-bearing gotchas Development Guide
Scripts in scripts/ Scripts Reference
Feature changelog Changelog

Compatibility

Dimension Status
API Compatible with v2.5.0-beta.1 — n8n workflows and IRIS API clients work unchanged
Database Not backwards-compatible — iris-ng adds tables and columns vanilla DFIR-IRIS does not have

Migrating from vanilla DFIR-IRIS? See Getting Started → Migrating from vanilla DFIR-IRIS.

What's new at a glance

MISP integration

  • Native sync module (IrisMISPSyncModule) — case ↔ MISP event, IOC ↔ MISP attribute, TLP-driven distribution
  • IocType.type_taxonomy — every IOC type maps to a MISP attribute type; LLM fallback for edge cases
  • Bundled MISP catalog (169 taxonomies, 122 galaxies, 66k machine-tags) powers tag autocomplete everywhere

AI assistant layer

  • Async AI request queue — AI calls never block web workers; poll GET /api/v2/ai/jobs/<id>
  • Executive case summary (multi-pass map-reduce, 4 domain specialists)
  • Case-scoped chat on six tabs with per-tab specialized prompts
  • Per-event analysis right-drawer (cached per event)
  • Running master-timeline narrative panel (flag-aware confidence)
  • MITRE ATT&CK + Unified Kill Chain v1.3 suggestions on event create/edit
  • IOC extraction from notes (type-validated, noise-flagged, deduped)
  • AI-suggested evidence type (auto-fires on upload, analyst can override)
  • AI-suggested case template on alert escalation
  • AI tag suggester (MISP taxonomies + galaxies) on all object modals
  • AI cluster narrative on the Correlation tab (cached, per-cluster)

Dual timeline

  • Working timeline panel alongside the master timeline
  • Hayabusa (JSONL) and EZ Tools/KAPE CSV ingest (11 sub-formats auto-detected)
  • Master-timeline CSV → working timeline destination picker
  • Promote-time: asset materialization + AI IOC extraction + cross-links
  • Date sort toggle on both master and working timelines (oldest/newest first, violet pill)

Case relationships

  • Jira-style task linking (blocks / depends-on, cycle-warning advisory, tree view)
  • IOC ↔ Note provenance links
  • Asset ↔ Evidence linking (M2M, inverse chips in both modals)

Dashboard

  • Metrics tab: sector / case-tagging quarterly matrices, 3-state flip card (table → donut → multi-year bar); time-tracking aggregates (by customer / person / sector / incident type + CSV)
  • Correlation tab: shared IOC clusters, D3 force-directed graph, campaign-tag application, AI cluster narrative
  • Inventory tab: physical evidence drive tracking, barcode lookup, custody lifecycle, status donut chart + stat tiles, data retention overdue indicators, sortable column headers (numeric capacity sort)
  • Operational tab: attributed open tasks now excludes tasks in closed cases

Operations

  • Case export/import (AES-256-GCM encrypted .iris-case format)
  • Analyst time tracking (15-min increments, locked on case close) — see Dashboard Analytics
  • Analyst skills catalog (34 skills / 8 categories) + per-case team building (greedy set-cover suggest) — see Dashboard Analytics
  • Mandatory sector tag enforcement (DHS CIIP + threatmatch multi-taxonomy)
  • Master timeline events flag-by-default (unflag = reviewed)

Settings

  • Two-slot AI backend admin UI (primary + alt, hot-swap with no restart)
  • Per-feature AI backend overrides (pin individual surfaces to a specific slot)
  • Tabbed /manage/settings (General / Security / AI / Analyst / Storage / System)
  • Data retention policy (Storage tab) — configures a threshold in months; evidence drives in use beyond the threshold receive an overdue indicator on the Inventory tab

patreon.com/zach115th
buymeacoffee.com/zach115th

Clone this wiki locally