Overview

This node operation retrieves multiple asset records associated with a specified case ID from the DFIR IRIS system. It is useful in digital forensics and incident response scenarios where an analyst needs to gather detailed information about assets linked to a particular case for investigation or reporting purposes. For example, an analyst can use this operation to fetch all assets related to a cybersecurity incident to understand the scope and impact.

Use Case Examples

1. Retrieve all assets linked to a specific case by providing the case ID and optionally specify which fields to include or exclude in the response.
2. Fetch raw response data for further custom processing by enabling the 'Return Raw' option.

Properties

Output

JSON

• asset_id - Unique identifier of the asset.
• asset_name - Name of the asset.
• asset_type - Type/category of the asset.
• asset_ip - IP address associated with the asset.
• case_id - Identifier of the case to which the asset is linked.
• date_added - Date when the asset was added to the case.
• date_update - Date when the asset information was last updated.
• custom_attributes - Custom attributes associated with the asset.
• asset_tags - Tags assigned to the asset for categorization.
• user_id - Identifier of the user who added or modified the asset.

Dependencies

• DFIR IRIS API authentication

Troubleshooting

• Ensure the provided Case ID is valid and exists in the DFIR IRIS system to avoid errors.
• If the node returns incomplete data, verify the 'Return Fields' option to include all necessary fields or disable 'Exclude' if fields are being excluded unintentionally.
• Authentication errors may occur if the API credentials are missing or invalid; verify the API key or token configuration.

Links

• DFIR IRIS API Documentation - Official API documentation for DFIR IRIS, detailing endpoints and data structures.