Overview

This node operation merges an alert into a target case within the DFIR IRIS system. It is useful for incident response workflows where alerts need to be consolidated into existing cases for better management and investigation. For example, security analysts can use this node to merge a newly detected alert into an ongoing case to maintain a unified view of related incidents.

Use Case Examples

1. Merging an alert identified by its Alert ID into a specific case by Case ID to consolidate investigation data.
2. Adding additional information such as notes or importing related assets and IOCs (Indicators of Compromise) into the case during the merge process.

Properties

Output

JSON

• case_id - Identifier of the case after merging the alert.
• case_name - Name of the case after merging.
• case_description - Description of the case.
• case_customer - Customer associated with the case.
• case_soc_id - SOC (Security Operations Center) identifier for the case.
• case_uuid - UUID of the case.
• classification_id - Classification identifier of the case.
• close_date - Date when the case was closed.
• closing_note - Note added when closing the case.
• custom_attributes - Custom attributes associated with the case.
• modification_history - History of modifications made to the case.
• open_date - Date when the case was opened.
• owner_id - Identifier of the case owner.
• status_id - Status identifier of the case.
• user_id - User identifier associated with the case.

Dependencies

• An API key credential for authenticating with the DFIR IRIS system.

Troubleshooting

• Ensure that the Alert ID and Target Case ID are valid and exist in the system to avoid errors.
• If the API returns an error, check the API key credentials and permissions.
• Verify that the UUIDs provided in the asset and IOC lists are correctly formatted and correspond to existing entities.
• If the response is empty or missing expected fields, adjust the 'Return Fields' option or disable 'Exclude' to include necessary data.