Home

IRIS-NG Wiki

IRIS-NG is a community fork of DFIR-IRIS v2.5.0-beta.1 with native MISP integration, MISP nomenclature alignment, and an in-tree AI assistant layer. Upstream paused feature development in late 2024 and stranded v2.5.0-beta.1 in beta; this fork picks up where it left off.

Pages

Topic	Page
Install and run (Docker Compose)	Getting Started
Three-layer architecture, APIs, module system	Architecture
AI surfaces, model routing, async queue	AI Features
Native MISP sync, IOC taxonomy	MISP Integration
Working timeline, Hayabusa/EZ Tools ingest	Dual Timeline
Cross-case IOC correlation, cluster narratives	IOC Correlation
Evidence drive inventory, barcode lookup, retention policy	Evidence Inventory
Dashboard metrics tabs (Metrics / Correlation / Inventory)	Dashboard Analytics
Logging investigation hours, cost estimation	Analyst Time Tracking
Skill catalog, per-case team building	Analyst Skills and Teams
Encrypted .iris-case export / import	Case Export / Import
/api/v2/ endpoint catalogue	API Reference
Dev loop, rebuild rules, load-bearing gotchas	Development Guide
Scripts in scripts/	Scripts Reference
Feature changelog	Changelog

Compatibility

Dimension	Status
API	Compatible with v2.5.0-beta.1 — n8n workflows and IRIS API clients work unchanged
Database	Not backwards-compatible — iris-ng adds tables and columns vanilla DFIR-IRIS does not have

Migrating from vanilla DFIR-IRIS? See Getting Started → Migrating from vanilla DFIR-IRIS.

What's new at a glance

MISP integration

• Native sync module (IrisMISPSyncModule) — case ↔ MISP event, IOC ↔ MISP attribute, TLP-driven distribution
• IocType.type_taxonomy — every IOC type maps to a MISP attribute type; LLM fallback for edge cases
• Bundled MISP catalog (169 taxonomies, 122 galaxies, 66k machine-tags) powers tag autocomplete everywhere

AI assistant layer

• Async AI request queue — AI calls never block web workers; poll GET /api/v2/ai/jobs/<id>
• Executive case summary (multi-pass map-reduce, 4 domain specialists)
• Case-scoped chat on six tabs with per-tab specialized prompts
• Per-event analysis right-drawer (cached per event)
• Running master-timeline narrative panel (flag-aware confidence)
• MITRE ATT&CK + Unified Kill Chain v1.3 suggestions on event create/edit
• IOC extraction from notes (type-validated, noise-flagged, deduped)
• AI-suggested evidence type (auto-fires on upload, analyst can override)
• AI-suggested case template on alert escalation
• AI tag suggester (MISP taxonomies + galaxies) on all object modals
• AI cluster narrative on the Correlation tab (cached, per-cluster)

Dual timeline

• Working timeline panel alongside the master timeline
• Hayabusa (JSONL) and EZ Tools/KAPE CSV ingest (11 sub-formats auto-detected)
• Master-timeline CSV → working timeline destination picker
• Promote-time: asset materialization + AI IOC extraction + cross-links
• Date sort toggle on both master and working timelines (oldest/newest first, violet pill)

Case relationships

• Jira-style task linking (blocks / depends-on, cycle-warning advisory, tree view)
• IOC ↔ Note provenance links
• Asset ↔ Evidence linking (M2M, inverse chips in both modals)

Dashboard

• Metrics tab: sector / case-tagging quarterly matrices, 3-state flip card (table → donut → multi-year bar); time-tracking aggregates (by customer / person / sector / incident type + CSV)
• Correlation tab: shared IOC clusters, D3 force-directed graph, campaign-tag application, AI cluster narrative
• Inventory tab: physical evidence drive tracking, barcode lookup, custody lifecycle, status donut chart + stat tiles, data retention overdue indicators, sortable column headers (numeric capacity sort)
• Operational tab: attributed open tasks now excludes tasks in closed cases

Operations

• Case export/import (AES-256-GCM encrypted .iris-case format) — see Case Export / Import
• Analyst time tracking (15-min increments, locked on case close) — see Analyst Time Tracking
• Analyst skills catalog (34 skills / 8 categories) + per-case team building (greedy set-cover suggest) — see Analyst Skills and Teams
• Mandatory sector tag enforcement (DHS CIIP + threatmatch multi-taxonomy)
• Master timeline events flag-by-default (unflag = reviewed)

Settings

• Two-slot AI backend admin UI (primary + alt, hot-swap with no restart)
• Per-feature AI backend overrides (pin individual surfaces to a specific slot)
• Tabbed /manage/settings (General / Security / AI / Analyst / Storage / System)
• Data retention policy (Storage tab) — configures a threshold in months; evidence drives in use beyond the threshold receive an overdue indicator on the Inventory tab