DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Alert → Filter Alerts

AI-generated

Overview

This node operation filters alerts related to a specific case in the DFIR IRIS system. It allows users to retrieve alerts based on various criteria such as case ID, alert assets, classification, customer, description, date range, severity, status, and more. Users can control the number of results returned, sorting order, and which fields to include or exclude in the output. This operation is useful for security analysts or incident responders who need to narrow down alerts for investigation or reporting within a digital forensics and incident response platform.

Use Case Examples

  1. Filtering alerts for a specific case by case ID and retrieving only high severity alerts sorted by creation time.
  2. Retrieving all alerts related to certain assets within a date range for detailed analysis.
  3. Getting a limited number of alerts with specific tags and status for quick review.

Properties

Name Meaning
Case ID The unique identifier of the case to which the alerts belong. This is a required field to filter alerts for a specific case.
Return All Determines whether to return all matching alerts or limit the number of results.
Limit The maximum number of alert results to return when 'Return All' is false.
Sort Order The direction to sort the alert results, either ascending or descending.
Sort By The field by which to sort the alert results.
Filter Options Additional filtering criteria for alerts, including assets, classification, customer, description, date range, IDs, IOCs, owner, severity, source, status, tags, and title.
Options Additional options for the query such as returning raw response, selecting specific fields to include or exclude, and pagination start page.

Output

JSON

  • alerts - Array of alert objects matching the filter criteria, each containing details such as classification, customer, description, severity, status, tags, title, and related metadata.

Dependencies

  • Requires connection to DFIR IRIS API with appropriate credentials for authentication.

Troubleshooting

  • Ensure the Case ID is provided and valid, as it is required to filter alerts.
  • Check API credentials and network connectivity if the node fails to retrieve data.
  • Verify date fields are in correct RFC UTC format when filtering by start and end dates.
  • If no alerts are returned, try broadening filter criteria or increasing the limit.
  • Use the 'Return Raw' option to debug the raw API response for troubleshooting.

Links

Discussion