Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Alert → Unmerge
AI-generatedOverview
This node operation 'Unmerge' under the 'Alert' resource is designed to unmerge an alert from a case in a DFIR IRIS Incident Response Platform. It is useful in scenarios where an alert has been incorrectly merged into a case and needs to be separated back into its original state or associated with a different case. For example, if an alert was mistakenly linked to the wrong case, this operation allows the user to specify the alert ID and the target case ID to unmerge the alert accordingly.
Use Case Examples
- Unmerging an alert from a case to correct case associations in an incident response workflow.
- Separating alerts that were merged by mistake to maintain accurate case records.
Properties
| Name | Meaning |
|---|---|
| Alert ID | The unique identifier of the alert to be unmerged from a case. |
| Target Case ID | The ID of the case to which the alert should be unmerged or reassigned. |
| Options | Additional options to customize the unmerge operation, including whether to return the raw response, which fields to include in the response, and whether to exclude the selected fields instead. |
Output
JSON
case_id- The ID of the case after unmerging the alert.alert_id- The ID of the alert that was unmerged.status- The status of the unmerge operation, indicating success or failure.message- Additional message or details about the unmerge operation result.
Dependencies
- DFIR IRIS Incident Response Platform API or service
Troubleshooting
- Ensure that the Alert ID and Target Case ID are valid and exist in the system to avoid errors.
- If the operation fails, check API authentication credentials and network connectivity.
- Verify that the user has sufficient permissions to unmerge alerts from cases.