From the first alert to the final report.
Follow one investigation through IRIS — how an alert becomes a case, how a team lands on a decision, and how the story ends up in a report you can hand off. Eight chapters, one incident.
- 01 · Detect
It starts with a signal.
A SIEM alert, an EDR flag, an analyst gut check. IRIS collects them all in one queue — tagged with severity, source and time — so nothing waits in a mailbox for someone to notice.
- Ingestion is native: SIEM, EDR, MISP, IntelOwl, or any REST endpoint you point at it. Each alert lands with its raw payload, its enrichment context, and a link back to the tool it came from.
- Analysts filter, sort and assign from the same view. Ownership is explicit — no orphaned alerts, no duplicated effort, no silent drops.
ALERT-4127CRITICAL14:02SIEM · lateral movement · host 7A2 - 02 · Triage
Not every alert is a case.
Alert clusters group related signals — same host, same actor, same window — so analysts triage the story, not the noise. Ten alerts about one intrusion become one cluster you can reason about.
- Dedupe by rules or by hand. Merge clusters together as the picture clarifies, split them when a second incident hides inside the first.
- When a cluster earns a case, promote it in one click. Every alert follows — with its evidence, its enrichment, and the reason someone hit the button.
Cluster · 3 alerts mergedOne host, one actor, one investigation. - 03 · Case
An investigation gets a home.
Cases are the spine of IRIS. Assets, IOCs, tasks, evidence, notes — all under one authoritative record, with severity, ownership and status visible at a glance.
- Every artefact links to every other. Click an IOC to see the assets it touched, an asset to see the tasks still open on it. The graph of the incident is a click away, not a spreadsheet away.
- Every action leaves an audit trail — who added what, when, and why. Nothing gets lost between analysts, and nothing has to be reconstructed at reporting time.
#1042OpenCriticalRansomware — HQ file server - 04 · Collaborate
The team lands on the same page.
War rooms bring analysts, forensics, threat intel and management into one live stream — real-time chat with threads, per-room teams, and the case context always visible.
- Slash commands turn chat into structured decisions. Type /decision, /task, /ioc or /note and IRIS captures it into the case record with the timestamp, the author and the reasoning.
- Attachments dropped into chat route straight into evidence — hashed, tagged, linked. The conversation and the case never drift apart.
ARFRTIWR#1 · Ransomware 0600/decision Contain endpoint 7A2 — isolating. - 05 · Evidence
Findings become artifacts.
Drop a file, a memory dump, a packet capture — IRIS hashes it, tags it and links it to the case. Chain of custody is built in, not bolted on.
- Verify by SHA-256, MD5 or SHA-1. Tag by evidence type, restrict access by role, and export the manifest whenever someone needs to prove where it came from.
- Every download, view and change is logged. When the report goes out — or the court asks — you can show exactly who touched what, and when.
EV-231host_7A2 memory dumpverifiedsha256: e3b0c44298fc1c14…852b855 - 06 · Timeline
The events snap into order.
Every alert, action and artifact lands on one investigation timeline. Times are normalised, tags are consistent, and the story you'll tell is already assembled.
- Multiple timelines per case — one for the technical narrative, one for the executive brief, one for the court filing. Filter by tag, source or asset without losing the master view.
- Import events from CSV, from a SIEM query, or from a war-room /event command. Export the whole thing as a narrative document when the case wraps.
08:0012:00 - 07 · Integrate
IRIS talks to the tools you already run.
Modules extend IRIS without forking it. IrisVT enriches IOCs against VirusTotal, IrisMISP syncs with your MISP instance, IrisCheck runs your custom validations, IrisWebHooks pushes events to anything with a URL.
- Write your own module in Python. The hook system exposes 162 binding points — case created, IOC added, evidence uploaded, timeline event logged. Attach logic anywhere in the workflow.
- The REST API mirrors every UI action. Push data in, pull reports out, script your playbooks. IRIS is a platform, not a silo.
VTMIELSPSL+ 60 more - 08 · Report
One click. The whole story.
Case data, timeline, IOCs, evidence and tasks — pushed through your templates into an executive summary, a technical report, or a court-ready document. No copy-paste, no forgotten sections.
- Templates are Jinja-based and configurable by your team. The same case can produce a one-page brief for the CISO and a fifty-page dossier for regulators, in one export.
- Export to PDF or DOCX. Re-generate the report as the case evolves — the story stays synced with the record.
Case_1042_report.pdfGeneratedExecutive · Technical · IOC bundle
Every case, from signal to story. Run the next one in IRIS.
That was one incident, start to finish. Stand IRIS up with Docker and run yours — no licence to negotiate, no data leaving your network.