Overview

This node operation retrieves detailed information about a specific alert from the DFIR IRIS system using the provided Alert ID. It is useful for security analysts or incident responders who need to fetch comprehensive alert data for investigation or reporting purposes. For example, a user can input an Alert ID to get fields such as alert classification, severity, status, related cases, and comments.

Use Case Examples

1. Retrieve an alert by its Alert ID to review its classification, severity, and related cases for incident analysis.
2. Fetch alert details including notes and modification history to understand the alert's investigation progress.

Properties

Output

JSON

• alert_classification_id - ID of the alert classification.
• alert_context - Context information related to the alert.
• alert_creation_time - Timestamp when the alert was created.
• alert_customer_id - Customer ID associated with the alert.
• alert_description - Description of the alert.
• alert_id - Unique identifier of the alert.
• alert_note - Notes related to the alert.
• alert_owner_id - ID of the alert owner.
• alert_resolution_status_id - ID representing the resolution status of the alert.
• alert_severity_id - ID representing the severity level of the alert.
• alert_source - Source from which the alert originated.
• alert_source_content - Content from the alert source.
• alert_source_event_time - Timestamp of the event from the alert source.
• alert_source_link - Link to the alert source.
• alert_source_ref - Reference identifier from the alert source.
• alert_status_id - ID representing the current status of the alert.
• alert_tags - Tags associated with the alert.
• alert_title - Title of the alert.
• alert_uuid - UUID of the alert.
• assets - Assets related to the alert.
• cases - Cases associated with the alert.
• classification - Classification details of the alert.
• comments - Comments added to the alert.
• customer - Customer information related to the alert.
• iocs - Indicators of Compromise related to the alert.
• modification_history - History of modifications made to the alert.
• owner - Owner details of the alert.
• related_alerts - Alerts related to this alert.
• resolution_status - Resolution status details of the alert.
• severity - Severity details of the alert.
• status - Current status details of the alert.

Dependencies

• An API key credential for authenticating with the DFIR IRIS system.

Troubleshooting

• Ensure the Alert ID is correctly provided and exists in the system to avoid 'Alert not found' errors.
• If the API returns an authentication error, verify that the API key credential is valid and has the necessary permissions.
• If the response is empty or missing expected fields, check the 'Return Fields' option to ensure the desired fields are included and that 'Exclude' is set correctly.