Monitoring DFIR-IRIS with Vigilmon

DFIR-IRIS is where your incident response team documents timelines, tracks indicators of compromise, and coordinates case work during live incidents. A database failure or Celery worker crash doesn't announce itself — it just means evidence stops processing, exports stop generating, and investigators start seeing cryptic errors mid-investigation. Vigilmon monitors every layer of DFIR-IRIS — web application, database, task queue, and storage — so outages surface as alerts before they derail active cases.

What You'll Set Up

• Web application health monitor (port 443 — the case management UI and REST API)
• PostgreSQL database connectivity alert
• Celery worker health check (evidence processing and report generation)
• Redis broker health monitor
• File evidence storage disk usage alert (>80%)
• TLS certificate expiry alert (<30 days)
• API availability heartbeat for SOAR integrations

Prerequisites

• DFIR-IRIS deployed via Docker Compose (the standard installation method)
• HTTPS accessible on port 443 from your monitoring vantage point
• A free Vigilmon account

Step 1: Monitor the Web Application Health Endpoint

DFIR-IRIS exposes a dedicated API health endpoint. When this returns non-200, the entire case management interface is unavailable and all active incident investigations are blocked.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the health probe URL: https://your-dfir-iris-host/iris/api/v2/ping
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Add a keyword check: "ping" (the response body contains {"data":"pong","message":"pong","status":"success"}).
7. Click Save.

Tip: DFIR-IRIS's /iris/api/v2/ping is unauthenticated by design — it's a safe health probe that doesn't expose any case data.

Step 2: Monitor the REST API with Authentication

SOAR platforms and SIEM integrations connect to DFIR-IRIS via its REST API using API key authentication. Add a second monitor that validates both connectivity and authentication:

1. Click Add Monitor and set Type to HTTP / HTTPS.
2. Enter: https://your-dfir-iris-host/iris/api/v2/cases/list
3. Set Check interval to 2 minutes.
4. Add a Request Header: Authorization: Bearer YOUR_API_KEY
5. Set Expected HTTP status to 200.
6. Add keyword check: "status":"success".
7. Click Save.

An authentication failure (401 or 403) from this monitor signals that the API key has expired or been revoked — catching integration breakage before your SOAR platform silently stops creating cases.

Step 3: Monitor PostgreSQL Database Health

DFIR-IRIS stores all case data, IOCs, investigation timelines, and task assignments in PostgreSQL. Database connectivity loss means nothing can be read or written — investigators see 500 errors and case updates fail silently.

Option A: Use a Vigilmon Agent (Recommended)

Install the Vigilmon agent on your DFIR-IRIS host for direct database port monitoring:

curl -fsSL https://vigilmon.online/agent/install.sh | sudo bash

In the Vigilmon dashboard, add a TCP Port monitor for localhost:5432 (or your PostgreSQL port).

Option B: Add a Database Health Endpoint

Add a lightweight health endpoint to your DFIR-IRIS deployment that checks database connectivity:

# Add to your DFIR-IRIS Flask app or a sidecar health service
from flask import jsonify
from app import db

@app.route('/health/db')
def db_health():
    try:
        db.session.execute('SELECT 1')
        return jsonify(status='ok')
    except Exception as e:
        return jsonify(status='error', detail=str(e)), 503

Add a Vigilmon HTTP monitor pointing to this endpoint with keyword "status":"ok".

Via Docker Compose Health Check

If you're using the standard DFIR-IRIS Docker Compose deployment, PostgreSQL health is managed by the container's built-in health check. You can expose it via a sidecar:

# docker-compose.override.yml
services:
  db_health_probe:
    image: postgres:15
    command: >
      sh -c "while true; do
        pg_isready -h db -U postgres && echo OK || echo FAIL;
        sleep 30;
      done"
    depends_on:
      - db

Step 4: Monitor Celery Workers

Celery workers handle all background processing in DFIR-IRIS: evidence file processing, report generation, case exports, and notifications. If workers stop, these operations queue silently — investigators submit exports that never arrive and evidence uploads that never complete.

Add a heartbeat that fires only when Celery is actively processing:

# Add to your DFIR-IRIS host cron or Docker Compose
# Pings Vigilmon heartbeat only when Celery workers are running
* * * * * root celery -A app.celery inspect ping -d celery@dfir-iris 2>/dev/null | grep -q "pong" && curl -fsS YOUR_CELERY_HEARTBEAT_URL > /dev/null

Create a Cron Heartbeat monitor in Vigilmon with a 2-minute expected interval. If the celery inspect ping command stops returning pong, the heartbeat stops firing and Vigilmon alerts within 2 minutes.

Check Queue Depth

A growing Celery queue (tasks not being consumed) is a leading indicator of worker overload before workers actually crash. Add queue depth monitoring via a custom endpoint:

from celery import Celery
from flask import jsonify

@app.route('/health/celery')
def celery_health():
    try:
        inspect = celery_app.control.inspect()
        active = inspect.active()
        if active is None:
            return jsonify(status='no_workers'), 503
        worker_count = len(active)
        return jsonify(status='ok', workers=worker_count)
    except Exception as e:
        return jsonify(status='error'), 503

Step 5: Monitor Redis

Redis brokers all Celery task queues. If Redis goes down, Celery workers lose their task source and all background processing halts — even if the workers themselves are still running.

1. Click Add Monitor and set Type to TCP Port.
2. Enter your Redis host and port (default 6379).
3. Set Check interval to 1 minute.
4. Click Save.

For a deeper check, add a Redis PING health endpoint via a sidecar:

# Simple Redis health check script
redis-cli -h localhost -p 6379 PING | grep -q PONG && echo '{"status":"ok"}' || echo '{"status":"error"}'

Serve this via a minimal HTTP wrapper and add a Vigilmon HTTP monitor with keyword "status":"ok".

Step 6: Monitor File Evidence Storage

DFIR-IRIS stores uploaded evidence files in MinIO (for distributed deployments) or the local filesystem. At >80% disk utilization, evidence file uploads fail — investigators lose the ability to attach artifacts to cases during active incidents.

Local Filesystem Storage

Install the Vigilmon agent on your DFIR-IRIS host and configure a Disk Usage alert at 80% for the storage mount point (typically /opt/dfir-iris/uploads/ or the Docker volume mount).

MinIO Storage

If using MinIO, add a MinIO health monitor:

1. Click Add Monitor and set Type to HTTP / HTTPS.
2. Enter: http://your-minio-host:9000/minio/health/live
3. Set Check interval to 2 minutes.
4. Set Expected HTTP status to 200.
5. Click Save.

For bucket capacity, query MinIO's Prometheus metrics endpoint and alert when used bytes exceed 80% of total capacity.

Step 7: Monitor TLS Certificate Expiry

DFIR-IRIS is served over HTTPS. An expired certificate locks investigators out of the platform and breaks all API integrations.

1. Click Add Monitor and set Type to SSL Certificate.
2. Enter your DFIR-IRIS hostname and port 443.
3. Set Alert when certificate expires in less than 30 days.
4. Click Save.

Step 8: Configure Alerting

Alert Channels

In Vigilmon, go to Alert Channels and connect:

• Email — immediate notifications to the IR team lead
• Slack / Microsoft Teams — visibility in the IR team channel
• PagerDuty — on-call escalation during active incidents
• Webhook — push alerts into your SOAR platform (which may be Shuffle — see the Shuffle SOAR monitoring tutorial)

Recommended Alert Rules

| Monitor | Condition | Severity | |---|---|---| | Web App /ping | Down > 1 min | Critical | | REST API (authenticated) | Auth failure | High | | PostgreSQL | Down > 1 min | Critical | | Celery Workers | Heartbeat missing > 2 min | High | | Redis | Down > 1 min | High | | Evidence Storage | > 80% disk | High | | TLS Certificate | < 30 days | Medium |

Status Page

Create a Vigilmon status page for your incident response team:

1. Go to Status Pages → Create Status Page.
2. Add all DFIR-IRIS monitors.
3. Share the URL with IR team members as a first-look health dashboard.

During a major incident, your team will already be under stress — a green status page at a glance tells them DFIR-IRIS itself is healthy and the problem is the incident they're investigating, not the platform.

Operational Considerations

IOC search performance — As case counts grow, PostgreSQL index degradation causes IOC searches to slow down. Set a Vigilmon HTTP monitor with a response time alert (P95 > 5 seconds) on the IOC search API endpoint to catch index degradation early.

Case inactivity during active incidents — A case with no updates in >48 hours during a declared incident may indicate investigator tool failure. Implement a periodic API query that checks for stale active cases and sends an alert via Vigilmon's webhook.

Celery task queue depth — A queue growing beyond 100 tasks typically indicates worker starvation. Track queue depth from Redis (LLEN celery) and alert before it becomes a backlog that delays evidence processing.

Conclusion

DFIR-IRIS is the source of truth for your incident investigations. An unmonitored DFIR-IRIS is a liability — database failures silently corrupt your investigation workflow, Celery crashes delay evidence processing when speed matters most, and disk full errors block evidence uploads at the worst possible time.

With Vigilmon, you get:

• Instant alerts when the case management UI or REST API goes down
• Background job monitoring via Celery heartbeats before investigators notice failed exports
• Database and broker health checks that catch infrastructure failures before they surface as application errors
• Storage alerts preventing evidence upload failures during active incidents

Get started free at vigilmon.online.