FIR (Fast Incident Response) is an cybersecurity incident management platform designed with agility and speed in mind. It allows for easy creation, tracking, and reporting of cybersecurity incidents.
FIR is for anyone needing to track cybersecurity incidents (CSIRTs, CERTs, SOCs, etc.). It’s was tailored to suit our needs and our team’s habits, but we put a great deal of effort into making it as generic as possible before releasing it so that other teams around the world may also use it and customize it as they see fit.
Fir Console runserver
Technical specs
FIR is written in Python (but you probably already knew that), using Django 1.9. It uses Bootstrap 3 and some Ajax and d3js to make it pretty. We use it with a MySQL back-end, but feel free to use any other DB adaptor you might want – as long as it’s compatible with Django, you shouldn’t run into any major issues.
FIR is not greedy performance-wise. It will run smoothly on a Fedora 10, Debian 8, Ubuntu 14.04 or Newer virtual machine with 1 core, a 40 GB disk and 1 GB RAM.
FIR WEBGUI
Latest Change 23/11/2016:
+ Incident: Bugfix in search
+ Plugin: Include IncidentTemplates description in migration
+ Alerting: Bugfix
+ Adjust comments in .po files
Dowanload and Build from Source:
$ sudo apt-get update $ sudo apt-get install python-dev python-pip python-lxml git libxml2-dev libxslt1-dev libz-dev $ sudo pip install virtualenv $ virtualenv env-FIR $ source env-FIR/bin/activate git clone https://github.com/certsocietegenerale/FIR && cd FIR pip install -r requirements.txt If you want to enable the Plugins, copy the fir/config/installed_apps.txt.sample file to fir/config/installed_apps.txt: cp fir/config/installed_apps.txt.sample fir/config/installed_apps.txt Create the tables in the database: ./manage.py migrate Import initial data and test users (admin:admin and dev:dev): $ ./manage.py loaddata incidents/fixtures/seed_data.json $ ./manage.py loaddata incidents/fixtures/dev_users.json ./manage.py runserver Go to http://localhost:8000