Cybersecurity definition
What is DFIR?
DFIR stands for Digital Forensics and Incident Response.
By Cyber Tool Stack Editorial TeamUpdated
Definition
The specialized work of investigating a suspected or confirmed security breach: reconstructing what happened, how far it spread, and preserving evidence that will hold up later.
Where DFIR fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
EDREndpoint Detection and ResponseSoftware that continuously records what happens on endpoints (processes, files, network connections) and detects, investigates, and responds to malicious behavior.SOCSecurity Operations CenterThe team (in-house or vendor-run) responsible for monitoring security alerts around the clock and responding when something looks like a real incident.MDRManaged Detection and ResponseA subscription service where a vendor's own analysts monitor an organization's security alerts and respond to routine detections, instead of the customer's team doing it alone.