DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Alert → Update

AI-generated

Overview

The `DfirIris` node in n8n is designed to interact with the DFIR IRIS Incident Response Platform, enabling users to manage alerts within their workflows. Specifically, the 'Update' operation allows for the modification of existing alerts, facilitating tasks such as adding or updating associated assets and indicators of compromise (IOCs). This functionality is particularly beneficial in scenarios where alert details need to be dynamically adjusted based on evolving incident data.

Use Case Examples

  1. Updating an alert to include new assets discovered during an ongoing investigation.
  2. Modifying an alert's severity or status in response to new information or analysis findings.

Properties

Name Meaning
cid The unique identifier for the case associated with the alert. This field is required to specify which case the alert belongs to.
alert_id The unique identifier for the alert that is to be updated. This field is required to specify which alert to modify.
additionalFields A collection of optional fields that can be used to provide additional information or modify specific aspects of the alert. This includes options for adding assets, IOCs, alert classifications, context, customer information, descriptions, resolution statuses, notes, severities, sources, source content, event times, links, references, statuses, tags, and titles.
options A collection of optional settings that control the behavior of the update operation. This includes options to replace existing IOCs and assets, return raw responses, specify which fields to include or exclude in the response, and more.

Output

JSON

  • alert_classification_id - The classification identifier assigned to the alert.
  • alert_context - The context information associated with the alert.
  • alert_creation_time - The timestamp when the alert was created.
  • alert_customer_id - The identifier for the customer associated with the alert.
  • alert_description - A description providing details about the alert.
  • alert_id - The unique identifier for the alert.
  • alert_note - Any notes associated with the alert.
  • alert_owner_id - The identifier for the owner of the alert.
  • alert_resolution_status_id - The resolution status identifier for the alert.
  • alert_severity_id - The severity level identifier for the alert.
  • alert_source - The source from which the alert originated.
  • alert_source_content - The raw content from the source that triggered the alert.
  • alert_source_event_time - The timestamp of the event that triggered the alert.
  • alert_source_link - A link to the source of the alert.
  • alert_source_ref - A reference identifier for the source of the alert.
  • alert_status_id - The current status identifier of the alert.
  • alert_tags - A list of tags associated with the alert.
  • alert_title - The title of the alert.
  • alert_uuid - The universally unique identifier for the alert.
  • assets - A list of assets associated with the alert.
  • cases - A list of cases associated with the alert.
  • classification - The classification details of the alert.
  • comments - Any comments associated with the alert.
  • customer - Customer information related to the alert.
  • iocs - Indicators of compromise associated with the alert.
  • modification_history - A history of modifications made to the alert.
  • owner - Information about the owner of the alert.
  • resolution_status - The resolution status details of the alert.
  • severity - The severity details of the alert.
  • status - The current status details of the alert.

Links

Discussion