DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Alert → Escalate

AI-generated

Overview

This node operation escalates an alert by creating or updating a case with the alert details in a DFIR IRIS Incident Response Platform. It is useful for security analysts who want to manage alerts by associating them with cases, adding relevant tags, notes, and importing related assets or indicators of compromise (IOCs). For example, when an alert requires further investigation, this operation can escalate it into a case with detailed context and timeline events.

Use Case Examples

  1. Escalate an alert to a case with a specific title and tags for tracking.
  2. Add an alert to a case timeline as an event and import related assets and IOCs for comprehensive case management.

Properties

Name Meaning
Alert ID The unique identifier of the alert to escalate.
Case Title The title of the case to create or update with the alert information.
Additional Fields Optional fields to customize the case such as adding the alert as an event, case tags, selecting a case template, importing assets and IOCs, and adding notes.
Options Additional options for the operation such as returning the raw response, specifying which fields to include or exclude in the response.

Output

JSON

  • case_id - Unique identifier of the case created or updated.
  • case_name - Name or title of the case.
  • case_customer - Customer associated with the case.
  • case_description - Description of the case.
  • case_soc_id - SOC (Security Operations Center) identifier related to the case.
  • case_uuid - UUID of the case.
  • classification_id - Classification identifier of the case.
  • close_date - Date when the case was closed.
  • closing_note - Note added when closing the case.
  • custom_attributes - Custom attributes associated with the case.
  • modification_history - History of modifications made to the case.
  • open_date - Date when the case was opened.
  • owner_id - Identifier of the case owner.
  • review_status_id - Review status identifier of the case.
  • reviewer_id - Identifier of the reviewer of the case.
  • severity_id - Severity level identifier of the case.
  • state_id - State identifier of the case.
  • status_id - Status identifier of the case.
  • user_id - Identifier of the user who created or modified the case.

Dependencies

  • An API key credential for authenticating with the DFIR IRIS platform.

Troubleshooting

  • Ensure that the Alert ID and Case Title are provided as they are required fields; missing these will cause errors.
  • If the API returns an error, check the validity of the API key credential and network connectivity.
  • When specifying fields in the options, ensure the field names are correct and formatted properly to avoid response errors.

Discussion