Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Alert → Batch Delete
AI-generatedOverview
This node operation allows users to batch delete alerts by specifying a case ID and a comma-separated list of alert IDs. It is useful in scenarios where multiple alerts need to be removed from a case in a single action, streamlining alert management and cleanup processes.
Use Case Examples
- Deleting multiple alerts associated with a specific case in a digital forensics and incident response (DFIR) system.
- Cleaning up resolved or irrelevant alerts in bulk to maintain an organized alert database.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case from which alerts will be deleted. |
| Alert IDs | A comma-separated list of alert IDs to be deleted in batch. |
| Return Raw | Option to return the raw response from the API instead of processed data. |
Output
JSON
success- Indicates whether the batch delete operation was successful.deletedAlertIds- List of alert IDs that were successfully deleted.rawResponse- The raw API response if the 'Return Raw' option is enabled.
Dependencies
- Requires API authentication credentials to interact with the DFIR IRIS system's alert management API.
Troubleshooting
- Ensure the Case ID and Alert IDs are correctly specified and valid; invalid IDs will cause the operation to fail.
- If the API returns an error, check the authentication credentials and network connectivity.
- If the 'Return Raw' option is enabled, the output will be unprocessed and may require additional parsing.