IRMA OSS is an asynchronous and customizable analysis platform for suspicious files.

It is the open source version of IRMA Enterprise and is proudly brought to you by Quarkslab!

Analyze multiple files at once
Get your own intelligence about the threats you deal with
Keep control over your sensitive files

Purpose

IRMA OSS is an open-source platform designed to help identify and analyze malicious files.

However, today's defense is not only about learning about a file, but it is also getting a fine overview of the incident you dealt with: where / when a malicious file has been seen, who submitted a hash, where a hash has been noticed, which anti-virus detects it, ...

An important value with IRMA comes from you keep control over where goes / who gets your data. Once you install IRMA on your network, your data stays on your network.

Each submitted files is analyzed in various ways. For now, we focus our efforts on multiple anti-virus engines, but we are working on other "probes" (feel free to submit your own).

News

v2.4.13

The version v2.4.13 of IRMA Open-source is now available!

  • Fixes security issues found by github

v2.4.12

The version v2.4.12 of IRMA Open-source is now available!

  • Change APIv2 files upload mechanism
  • Enable custom logo
  • Update dependencies
  • Multiple fixes

v2.2.2

The version v2.2.2 of IRMA Open-source is now available!

  • Breaking change: automated install now uses a submodule tool called irma-ansible
  • Added /scans/quick API endpoint to scan one file in one call
  • ZipBomb protection
  • Analysis progress is blue while scan is underway
  • Added a timeline of scans in file detailled results page
  • Split Ansible/Vagrant configurations

v2.1.1

The version v2.1.1 of IRMA Open-source is now available!

  • Add Scan report in CSV format
  • Add LIEF probe
  • Replace Eset Nod32 by Eset File Security
  • Support PKI generation for Nginx/RabbitMQ/PostgreSQL
  • Move to systemd
  • Common module is now a real common module (previously copied in lib)