DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Alert → Batch Update

AI-generated

Overview

The 'DFIR IRIS' n8n node facilitates batch updates to alerts within the DFIR IRIS Incident Response Platform. This operation enables users to modify multiple alerts simultaneously by specifying their IDs and the fields to be updated, streamlining the management of alerts in large-scale incident response scenarios.

Use Case Examples

  1. Updating the status and severity of multiple alerts to reflect new findings.
  2. Modifying the description and tags of several alerts to provide additional context.

Properties

Name Meaning
cid The unique identifier for the case associated with the alerts to be updated.
alert_ids A comma-separated list of alert IDs that are to be updated.
additionalFields A collection of additional fields to be updated in the specified alerts, including assets, IOCs, classifications, context, customer information, descriptions, statuses, tags, and titles.
options Additional options for the operation, such as whether to return the raw response from the API.

Output

JSON

  • status - Indicates the success or failure of the batch update operation.
  • message - Provides a message detailing the result of the batch update.
  • data - Contains any additional data returned by the API, if applicable.

Dependencies

  • An API key credential for authenticating with the DFIR IRIS platform.

Troubleshooting

  • Ensure that the 'cid' and 'alert_ids' are correctly specified and correspond to existing cases and alerts.
  • Verify that the fields in 'additionalFields' are valid and match the expected field names in the DFIR IRIS platform.
  • Check for network connectivity issues that might prevent communication with the DFIR IRIS API.
  • Confirm that the API key has the necessary permissions to perform batch updates on alerts.

Links

Discussion