DFIRTrack: (Digital Forensics and Incident Response Tracking application

Admin
DFIRTrack (Digital Forensics and Incident Response Tracking application) is an open source web application mainly based on Djangousing a PostgreSQL database backend.

In contrast to other great incident response tools, which are mainly case-based and support the work of CERTs, SOCs etc. in their daily business, DFIRTrack is focused on handling one major incident with a lot of affected systems as it is often observed in APT cases. It is meant to be used as a tool for dedicated incident response teams in large cases. So, of course, CERTs and SOCs may use DFIRTrack as well, but they may feel it will be more appropriate in special cases instead of every day work.

Installation and dependencies
DFIRTrack is developed for deploying on Debian Stretch or Ubuntu 16.04. Other Debian based distributions or versions may work but were not tested yet. At the moment the project will be focussed on Ubuntu LTS and Debian releases.

For fast and uncomplicated installation on a dedicated server including all dependencies an Ansible playbook and role was written (available here).

For a minimal setup the following dependencies are needed:
  • django (2.0),
  • django_q (0.9.1),
  • djangorestframework,
  • gunicorn,
  • postgresql,
  • psycopg2-binary,
  • python3-pip,
  • PyYAML,
  • requests,
  • virtualenv,
  • xlwt.
Note that there is no settings.py in this repository. This file is submitted via Ansible or has to be copied and configured by hand. That will be changed in the future (see issues for more information).