Home

IRIS-NG Wiki — Community Edition

IRIS-NG is a community fork of DFIR-IRIS v2.5.0-beta.1 with native MISP integration, MISP nomenclature alignment, and an in-tree AI assistant layer. Upstream paused feature development in late 2024 and stranded v2.5.0-beta.1 in beta; this fork picks up where it left off.

Everything documented in this wiki is the Community Edition — free and open source under LGPL-3.0, with no feature gates, no license key, and no telemetry. See Community Edition below.

Pages

Topic	Page
Install and run (Docker Compose)	Getting Started
Helm chart, DOKS, cloud hosting	Kubernetes
Three-layer architecture, APIs, module system	Architecture
AI surfaces, model routing, async queue	AI Features
Native MISP sync, IOC taxonomy	MISP Integration
Publishing a correlation cluster to MISP as a campaign event	MISP Cluster Publishing
Working timeline, Hayabusa/EZ Tools ingest	Dual Timeline
Cross-case IOC correlation, cluster narratives	IOC Correlation
Per-case graph with note/evidence layer filter	Knowledge Map
Per-case updates bell, read watermarks	Case Notifications
Evidence drive inventory, barcode lookup, retention policy	Evidence Inventory
Dashboard metrics tabs (Metrics / Correlation / Inventory)	Dashboard Analytics
Logging investigation hours, cost estimation	Analyst Time Tracking
Skill catalog, per-case team building	Analyst Skills and Teams
Encrypted .iris-case export / import	Case Export / Import
/api/v2/ endpoint catalogue	API Reference
Dev loop, rebuild rules, load-bearing gotchas	Development Guide
Why some dependencies are pinned, and how to verify a bump	Dependency Policy
Scripts in scripts/	Scripts Reference
Feature changelog	Changelog

Community Edition

Everything in the iris-ng repository and everything documented in this wiki is the Community Edition:

License	LGPL-3.0 — the same license as upstream DFIR-IRIS
Feature gates	None. Nothing is disabled, trialled, or unlocked by a key
Activation	None. No license server, no registration, no phone-home
Telemetry	None. IRIS-NG does not report usage anywhere
Hosting	Self-hosted. Case data, evidence, and AI prompts stay on your infrastructure

If you point the AI layer at a local model (LM Studio, Ollama), nothing leaves your network — and the AI layer is entirely optional, with every other feature working normally when no backend is configured. The one component that reaches the public internet on its own is the Sponsor tab in Server Settings, which reads the project's FUNDING.yml from GitHub; it degrades to an empty panel when that is unreachable.

Contributing and support

IRIS-NG is community-maintained. Issues and pull requests are welcome.

Bugs and feature requests	GitHub Issues — please check the roadmap first
Pull requests	Target the main branch. See CONTRIBUTING.md and CODESTYLE.md
Security issues	Follow SECURITY.md rather than opening a public issue
Development setup	Development Guide
Support development	Patreon · Buy Me a Coffee — entirely optional, and unlocks nothing

Compatibility

Dimension	Status
API	Compatible with v2.5.0-beta.1 — n8n workflows and IRIS API clients work unchanged
Database	Not backwards-compatible — iris-ng adds tables and columns vanilla DFIR-IRIS does not have

Migrating from vanilla DFIR-IRIS? See Getting Started → Migrating from vanilla DFIR-IRIS.

What's new at a glance

MISP integration

• Native sync module (IrisMISPSyncModule) — case ↔ MISP event, IOC ↔ MISP attribute, TLP-driven distribution
• IocType.type_taxonomy — every IOC type maps to a MISP attribute type; LLM fallback for edge cases
• Bundled MISP catalog (169 taxonomies, 122 galaxies, 66k machine-tags) powers tag autocomplete everywhere
• Publish a cross-case correlation cluster to MISP as one campaign event — narrative as an Event Report, notes as analyst Notes on their indicator, entity names redacted automatically — see MISP Cluster Publishing

AI assistant layer

• Async AI request queue — AI calls never block web workers; poll GET /api/v2/ai/jobs/<id>
• Executive case summary (multi-pass map-reduce, 4 domain specialists)
• Case-scoped chat on six tabs with per-tab specialized prompts
• Per-event analysis right-drawer (cached per event)
• Running master-timeline narrative panel (flag-aware confidence)
• MITRE ATT&CK + Unified Kill Chain v1.3 suggestions on event create/edit
• IOC extraction from notes (type-validated, noise-flagged, deduped)
• AI-suggested evidence type (auto-fires on upload, analyst can override)
• AI-suggested case template on alert escalation
• AI tag suggester (MISP taxonomies + galaxies) on all object modals
• AI cluster narrative on the Correlation tab (cached, per-cluster)
• Manual override of the executive summary and the cluster narrative — correct AI output by hand, keep the original, revert any time; regeneration is guarded so edits are never silently discarded

Dual timeline

• Working timeline panel alongside the master timeline
• Hayabusa (JSONL) and EZ Tools/KAPE CSV ingest (11 sub-formats auto-detected)
• Master-timeline CSV → working timeline destination picker
• Promote-time: asset materialization + AI IOC extraction + cross-links
• Date sort toggle on both master and working timelines (oldest/newest first, violet pill)

Case relationships

• Jira-style task linking (blocks / depends-on, cycle-warning advisory, tree view)
• IOC ↔ Note provenance links
• IOC history — IOC create and update record modification_history, surfaced as a History panel on the IOC modal (entries exist from IRIS-NG-v1.0.0 onward; nothing is backfilled)
• Asset ↔ Evidence linking (M2M, inverse chips in both modals)
• Knowledge map on the case Graph tab — note and evidence layers plus direct link-table edges, with per-layer toggles — see Knowledge Map

Notifications

• Case-updates bell in the header, scoped to the case you are working — per-case read watermarks that survive logout, your own interactive edits filtered out while API and automation changes still notify — see Case Notifications

Dashboard

• Metrics tab: sector / case-tagging quarterly matrices, 3-state flip card (table → donut → multi-year bar); time-tracking aggregates (by customer / person / sector / incident type + CSV)
• Correlation tab: shared IOC clusters, D3 force-directed graph, campaign-tag application, AI cluster narrative
• Inventory tab: physical evidence drive tracking, barcode lookup, custody lifecycle, status donut chart + stat tiles, data retention overdue indicators, sortable column headers (numeric capacity sort)
• Operational tab: attributed open tasks now excludes tasks in closed cases

Operations

• Case export/import (AES-256-GCM encrypted .iris-case format) — see Case Export / Import
• Analyst time tracking (15-min increments, locked on case close) — see Analyst Time Tracking
• Analyst skills catalog (34 skills / 8 categories) + per-case team building (greedy set-cover suggest) — see Analyst Skills and Teams
• Mandatory sector tag enforcement (DHS CIIP + threatmatch multi-taxonomy)
• Master timeline events flag-by-default (unflag = reviewed)

Settings

• Two-slot AI backend admin UI (primary + alt, hot-swap with no restart)
• Per-feature AI backend overrides (pin individual surfaces to a specific slot)
• Tabbed /manage/settings (General / Security / AI / Analyst / Storage / System)
• Sponsor tab — funding links read from the project's GitHub FUNDING.yml at runtime; the one component that reaches the public internet, and it degrades to an empty panel when unreachable
• Data retention policy (Storage tab) — configures a threshold in months; evidence drives in use beyond the threshold receive an overdue indicator on the Inventory tab