DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Alert → Add

AI-generated

Overview

This node creates a new alert in the DFIR IRIS system. It is useful for security analysts and incident responders who want to automate the process of adding alerts to their incident response platform. For example, it can be used to add alerts with detailed information such as severity, status, title, associated assets, indicators of compromise (IOCs), classification, context, and other metadata.

Use Case Examples

  1. Creating a new alert with a specific severity and status for a detected security incident.
  2. Adding assets and IOCs related to an alert to enrich the investigation context.
  3. Setting alert classification and resolution status to track the alert lifecycle.

Properties

Name Meaning
Case ID The ID of the case to which the alert belongs. Required for linking the alert to a specific case.
Alert Customer Name or ID The customer associated with the alert, selectable from a list or specified by ID. Required to identify the alert's customer.
Alert Severity The severity level of the alert, such as Medium, High, or Critical. Required to indicate the alert's importance.
Alert Status The current status of the alert, such as New, Assigned, or Closed. Required to track the alert's progress.
Alert Title The title or summary of the alert. Required to provide a brief description of the alert.
Additional Fields Optional additional data for the alert, including assets, IOCs, classification, context, description, notes, resolution status, source information, and tags.
Options Optional settings for the operation, such as returning the raw response or specifying which fields to include or exclude in the output.

Output

JSON

  • alert_id - Unique identifier of the created alert
  • alert_title - Title of the alert
  • alert_severity_id - Severity level of the alert
  • alert_status_id - Current status of the alert
  • alert_customer_id - Customer associated with the alert
  • alert_classification_id - Classification of the alert
  • alert_context - Context information related to the alert
  • alert_creation_time - Timestamp when the alert was created
  • alert_description - Detailed description of the alert
  • alert_note - Additional notes about the alert
  • alert_resolution_status_id - Resolution status of the alert
  • alert_source - Source from which the alert originated
  • alert_source_content - Raw event data from the alert source in JSON format
  • alert_source_event_time - Event time of the alert source in UTC
  • alert_source_link - Link to the alert source
  • alert_source_ref - Reference ID from the alert source
  • alert_tags - Comma-separated list of tags associated with the alert
  • assets - List of assets related to the alert
  • iocs - List of indicators of compromise related to the alert
  • cases - Cases associated with the alert
  • classification - Classification details of the alert
  • comments - Comments related to the alert
  • customer - Customer details associated with the alert
  • modification_history - History of modifications made to the alert
  • owner - Owner information of the alert
  • resolution_status - Resolution status details of the alert
  • severity - Severity details of the alert
  • status - Status details of the alert

Troubleshooting

  • Ensure all required fields such as Case ID, Alert Customer ID, Alert Severity, Alert Status, and Alert Title are provided to avoid validation errors.
  • If using dynamic options (e.g., customer list, asset types, IOC types), ensure the corresponding load options methods are correctly implemented and accessible.
  • Check the format of JSON fields like asset enrichment, IOC enrichment, and alert source content to avoid JSON parsing errors.
  • If the alert creation fails, verify API credentials and network connectivity to the DFIR IRIS system.

Discussion