Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Alert → Count Alerts
AI-generatedOverview
The 'Count Alerts' operation of the 'Alert' resource in the DFIR IRIS n8n node is designed to retrieve the total number of alerts associated with a specific case, identified by its Case ID (cid). This operation is particularly useful for monitoring and reporting purposes, allowing users to quickly assess the volume of alerts linked to a particular case.
Use Case Examples
- A cybersecurity analyst wants to determine how many alerts are associated with a specific incident case to prioritize response efforts.
- A compliance officer needs to generate a report detailing the number of alerts per case for audit purposes.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier for the case whose associated alerts are to be counted. This field is required and must be a number. |
| Additional Fields | An optional collection of additional parameters to refine the alert count. These fields include alert assets, classification ID, customer ID, description, end date, alert IDs, IOCs, owner ID, severity ID, source, start date, status ID, tags, and title. Each field has specific requirements and descriptions as detailed in the node's configuration. |
| Options | Additional settings to customize the operation's behavior. This includes 'Return Raw' to get the raw response and 'Return Fields' to specify which fields to include in the response. The 'Exclude' option allows for excluding selected fields instead. |
Output
JSON
total_alerts- The total number of alerts associated with the specified case, as determined by the operation.
Links
- Alerty and Iris Dfir Integration - An article detailing how to integrate Alerty and Iris Dfir with n8n.