Home

IRIS-NG Wiki — Community Edition

IRIS-NG is a community fork of DFIR-IRIS v2.5.0-beta.1 with native MISP integration, MISP nomenclature alignment, and an in-tree AI assistant layer. Upstream paused feature development in late 2024 and stranded v2.5.0-beta.1 in beta; this fork picks up where it left off.

Everything documented in this wiki is the Community Edition — free and open source under LGPL-3.0, with no feature gates, no license key, and no telemetry. See Community Edition below.

Pages

Topic	Page
Install and run (Docker Compose)	Getting Started
Three-layer architecture, APIs, module system	Architecture
AI surfaces, model routing, async queue	AI Features
Native MISP sync, IOC taxonomy	MISP Integration
Publishing a correlation cluster to MISP as a campaign event	MISP Cluster Publishing
Working timeline, Hayabusa/EZ Tools ingest	Dual Timeline
Cross-case IOC correlation, cluster narratives	IOC Correlation
Per-case graph with note/evidence layer filter	Knowledge Map
Per-case updates bell, read watermarks	Case Notifications
Evidence drive inventory, barcode lookup, retention policy	Evidence Inventory
Dashboard metrics tabs (Metrics / Correlation / Inventory)	Dashboard Analytics
Logging investigation hours, cost estimation	Analyst Time Tracking
Skill catalog, per-case team building	Analyst Skills and Teams
Encrypted .iris-case export / import	Case Export / Import
/api/v2/ endpoint catalogue	API Reference
Dev loop, rebuild rules, load-bearing gotchas	Development Guide
Scripts in scripts/	Scripts Reference
Feature changelog	Changelog

Community Edition

Everything in the iris-ng repository and everything documented in this wiki is the Community Edition:

License	LGPL-3.0 — the same license as upstream DFIR-IRIS
Feature gates	None. Nothing is disabled, trialled, or unlocked by a key
Activation	None. No license server, no registration, no phone-home
Telemetry	None. IRIS-NG does not report usage anywhere
Hosting	Self-hosted. Case data, evidence, and AI prompts stay on your infrastructure

The stack runs fully air-gapped once the images are pulled. If you point the AI layer at a local model (LM Studio, Ollama), nothing leaves your network at all — and the AI layer is entirely optional, with every other feature working normally when no backend is configured.

Contributing and support

IRIS-NG is community-maintained. Issues and pull requests are welcome.

Bugs and feature requests	GitHub Issues — please check the roadmap first
Pull requests	Target the main branch. See CONTRIBUTING.md and CODESTYLE.md
Security issues	Follow SECURITY.md rather than opening a public issue
Development setup	Development Guide
Support development	Patreon · Buy Me a Coffee — entirely optional, and unlocks nothing

Compatibility

Dimension	Status
API	Compatible with v2.5.0-beta.1 — n8n workflows and IRIS API clients work unchanged
Database	Not backwards-compatible — iris-ng adds tables and columns vanilla DFIR-IRIS does not have

Migrating from vanilla DFIR-IRIS? See Getting Started → Migrating from vanilla DFIR-IRIS.

What's new at a glance

MISP integration

• Native sync module (IrisMISPSyncModule) — case ↔ MISP event, IOC ↔ MISP attribute, TLP-driven distribution
• IocType.type_taxonomy — every IOC type maps to a MISP attribute type; LLM fallback for edge cases
• Bundled MISP catalog (169 taxonomies, 122 galaxies, 66k machine-tags) powers tag autocomplete everywhere
• Publish a cross-case correlation cluster to MISP as one campaign event — narrative as an Event Report, notes as analyst Notes on their indicator, entity names redacted automatically — see MISP Cluster Publishing

AI assistant layer

• Async AI request queue — AI calls never block web workers; poll GET /api/v2/ai/jobs/<id>
• Executive case summary (multi-pass map-reduce, 4 domain specialists)
• Case-scoped chat on six tabs with per-tab specialized prompts
• Per-event analysis right-drawer (cached per event)
• Running master-timeline narrative panel (flag-aware confidence)
• MITRE ATT&CK + Unified Kill Chain v1.3 suggestions on event create/edit
• IOC extraction from notes (type-validated, noise-flagged, deduped)
• AI-suggested evidence type (auto-fires on upload, analyst can override)
• AI-suggested case template on alert escalation
• AI tag suggester (MISP taxonomies + galaxies) on all object modals
• AI cluster narrative on the Correlation tab (cached, per-cluster)
• Manual override of the executive summary and the cluster narrative — correct AI output by hand, keep the original, revert any time; regeneration is guarded so edits are never silently discarded

Dual timeline

• Working timeline panel alongside the master timeline
• Hayabusa (JSONL) and EZ Tools/KAPE CSV ingest (11 sub-formats auto-detected)
• Master-timeline CSV → working timeline destination picker
• Promote-time: asset materialization + AI IOC extraction + cross-links
• Date sort toggle on both master and working timelines (oldest/newest first, violet pill)

Case relationships

• Jira-style task linking (blocks / depends-on, cycle-warning advisory, tree view)
• IOC ↔ Note provenance links
• Asset ↔ Evidence linking (M2M, inverse chips in both modals)
• Knowledge map on the case Graph tab — note and evidence layers plus direct link-table edges, with per-layer toggles — see Knowledge Map

Notifications

• Case-updates bell in the header, scoped to the case you are working — per-case read watermarks that survive logout, your own interactive edits filtered out while API and automation changes still notify — see Case Notifications

Dashboard

• Metrics tab: sector / case-tagging quarterly matrices, 3-state flip card (table → donut → multi-year bar); time-tracking aggregates (by customer / person / sector / incident type + CSV)
• Correlation tab: shared IOC clusters, D3 force-directed graph, campaign-tag application, AI cluster narrative
• Inventory tab: physical evidence drive tracking, barcode lookup, custody lifecycle, status donut chart + stat tiles, data retention overdue indicators, sortable column headers (numeric capacity sort)
• Operational tab: attributed open tasks now excludes tasks in closed cases

Operations

• Case export/import (AES-256-GCM encrypted .iris-case format) — see Case Export / Import
• Analyst time tracking (15-min increments, locked on case close) — see Analyst Time Tracking
• Analyst skills catalog (34 skills / 8 categories) + per-case team building (greedy set-cover suggest) — see Analyst Skills and Teams
• Mandatory sector tag enforcement (DHS CIIP + threatmatch multi-taxonomy)
• Master timeline events flag-by-default (unflag = reviewed)

Settings

• Two-slot AI backend admin UI (primary + alt, hot-swap with no restart)
• Per-feature AI backend overrides (pin individual surfaces to a specific slot)
• Tabbed /manage/settings (General / Security / AI / Analyst / Storage / System)
• Data retention policy (Storage tab) — configures a threshold in months; evidence drives in use beyond the threshold receive an overdue indicator on the Inventory tab