DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Asset → Get

AI-generated

Overview

This node retrieves detailed information about a specific asset within a given case in the DFIR IRIS system. It is useful for scenarios where users need to fetch asset data such as analysis status, compromise status, descriptions, IP addresses, tags, and other metadata related to an asset involved in a digital forensic investigation. For example, a security analyst might use this node to get comprehensive details about an asset linked to a particular case to assess its security posture or to enrich an investigation report.

Use Case Examples

  1. Fetching asset details by selecting an asset from a list filtered by a case ID.
  2. Retrieving specific fields of an asset's information to integrate with other security tools or dashboards.

Properties

Name Meaning
Case ID The unique identifier of the case to which the asset belongs. This is required to scope the asset retrieval within the correct case context.
Asset Name or ID The identifier or name of the asset to retrieve. This can be selected from a dynamically loaded list based on the Case ID or specified directly using an expression.
Options Additional options to customize the asset retrieval, including whether to return the raw response, which fields to include or exclude in the output.

Output

JSON

  • analysis_status_id - The analysis status identifier of the asset.
  • asset_compromise_status_id - The compromise status identifier of the asset.
  • asset_description - Description of the asset.
  • asset_domain - Domain associated with the asset.
  • asset_enrichment - Enrichment data related to the asset.
  • asset_id - Unique identifier of the asset.
  • asset_info - Additional information about the asset.
  • asset_ip - IP address of the asset.
  • asset_name - Name of the asset.
  • asset_tags - Tags associated with the asset.
  • asset_type - Type of the asset.
  • asset_type_id - Identifier for the asset type.
  • asset_uuid - UUID of the asset.
  • case_id - Identifier of the case the asset belongs to.
  • custom_attributes - Custom attributes defined for the asset.
  • date_added - Date when the asset was added.
  • date_update - Date when the asset was last updated.
  • linked_ioc - Indicators of compromise linked to the asset.
  • user_id - Identifier of the user associated with the asset.

Dependencies

  • An API key credential for authenticating with the DFIR IRIS system.

Troubleshooting

  • Ensure the Case ID and Asset ID are correctly specified; incorrect IDs will result in errors or empty responses.
  • If the node returns incomplete data, check the 'Return Fields' option to ensure the desired fields are included or not excluded by mistake.
  • Authentication errors may occur if the API key credential is missing or invalid; verify the credential configuration.

Discussion