Fast Incident Response: FIR

2015-03-16T18:47:51
ID N0WHERE:27804
Type n0where
Reporter N0where
Modified 2015-03-16T18:47:51

Description

FIR (Fast Incident Response) is an cybersecurity incident management platform designed with agility and speed in mind. It allows for easy creation, tracking, and reporting of cybersecurity incidents.

FIR is for anyone needing to track cybersecurity incidents (CSIRTs, CERTs, SOCs, etc.). It’s was tailored to suit our needs and our team’s habits, but we put a great deal of effort into making it as generic as possible before releasing it so that other teams around the world may also use it and customize it as they see fit.

Incident Response Incident Response incident_details Incident Response Incident Response Incident Response

FIR is written in Python (but you probably already knew that), using Django 1.9. It uses Bootstrap 3 and some Ajax and d3js to make it pretty. We use it with a MySQL back-end, but feel free to use any other DB adaptor you might want – as long as it’s compatible with Django, you shouldn’t run into any major issues.

FIR is not greedy performance-wise. It will run smoothly on a Ubuntu 14.04 virtual machine with 1 core, a 40 GB disk and 1 GB RAM.

Main dependencies

  • OS: Ubuntu 14.04
  • Application layer: Python 2.7 & Django 1.7.6
  • Webserver: nginx
  • Database: MySQL

It should be pretty straightforward to change nginx or MySQL for your webserver / DBMS of choice.

Incident Response Incident Response wiki

Incident Response Incident Response download