Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Alert → Get Relations
AI-generatedOverview
The 'DFIR IRIS' n8n node facilitates interaction with the DFIR IRIS Incident Response Platform, enabling users to manage alerts and cases within their workflows.
Use Case Examples
- Automatically retrieve related alerts and cases for a specific alert to assess its context and potential impact.
- Merge an alert into an existing case to centralize incident management and streamline response efforts.
- Unmerge an alert from a case to reassign it or handle it separately, maintaining flexibility in incident management.
Properties
| Name | Meaning |
|---|---|
| cid | The unique identifier for the case associated with the alert, used to fetch related cases. |
| alert_id | The unique identifier for the alert, used to fetch related alerts. |
| closedAlerts | Determines whether to include closed alerts in the search for related alerts. |
| closedCases | Determines whether to include closed cases in the search for related cases. |
| openAlerts | Determines whether to include open alerts in the search for related alerts. |
| openCases | Determines whether to include open cases in the search for related cases. |
| daysBack | Specifies the number of days back to search for related alerts and cases. |
| nodesAmount | Sets the maximum number of related alerts and cases to retrieve. |
| options | Additional options for the operation, such as returning raw responses. |
Output
JSON
status- Indicates the success or failure of the operation.message- Provides additional information about the operation's result.data- Contains the related alerts and cases, including their details.
Dependencies
- DFIR IRIS API access
- API authentication token
Troubleshooting
- Ensure that the 'cid' and 'alert_id' parameters are correctly specified to retrieve the intended data.
- Verify that the 'daysBack' parameter is set appropriately to include the desired time frame for related alerts and cases.
- Check the 'nodesAmount' parameter to ensure it allows retrieval of the required number of related items.
- If the 'options' parameter is used, confirm that the 'isRaw' option is set correctly to receive raw responses when needed.
Links
- DFIR IRIS API Reference - Official documentation for the DFIR IRIS API, detailing available endpoints and usage.