DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Case → Add

AI-generated

Overview

This node operation allows users to add a new case in the DFIR IRIS system. It is useful for incident response teams or security analysts who need to create and manage cases related to digital forensics and incident response. For example, a user can create a case with details such as case ID, SOC ticket reference, customer information, case name, description, and additional classification or template information.

Use Case Examples

  1. Creating a new case with a SOC ticket reference and customer details to track a security incident.
  2. Adding a case with custom attributes and classification to organize incident response efforts.

Properties

Name Meaning
Case ID Unique identifier for the case, required for the operation.
Case SOC ID A SOC ticket reference associated with the case, required for creating a case.
Case Customer Name or ID Select or specify the customer related to the case, required for creating a case.
Case Name Name of the case, required for creating a case.
Case Description Description of the case, minimum 2 characters, required for creating a case.
Additional Fields Optional additional fields such as classification ID, case template ID, and custom attributes to provide more context to the case.
Options Additional options for the operation such as returning raw response, specifying fields to include or exclude in the response.

Output

JSON

  • case_id - Unique identifier of the created case.
  • case_soc_id - SOC ticket reference of the case.
  • case_customer - Customer associated with the case.
  • case_name - Name of the case.
  • case_description - Description of the case.
  • classification_id - Classification ID of the case.
  • case_template_id - Template ID used for the case.
  • custom_attributes - Custom attributes added to the case.
  • open_date - Date when the case was opened.
  • close_date - Date when the case was closed.
  • closing_note - Note added when closing the case.
  • modification_history - History of modifications made to the case.
  • owner_id - ID of the owner of the case.
  • review_status_id - Review status ID of the case.
  • reviewer_id - ID of the reviewer of the case.
  • severity_id - Severity level ID of the case.
  • state_id - State ID of the case.
  • status_id - Status ID of the case.
  • user_id - ID of the user who created or modified the case.

Dependencies

  • Requires API authentication credentials to connect to the DFIR IRIS system.

Troubleshooting

  • Ensure all required fields such as Case ID, SOC ID, Customer, Name, and Description are provided to avoid validation errors.
  • If the API returns an error, check the authentication credentials and network connectivity.
  • When using custom attributes, ensure the JSON format is valid to prevent parsing errors.

Discussion