Overview

This node operation adds an activity log entry to a specified case in the DFIR IRIS system. It is useful for tracking actions, updates, or notes related to a case during digital forensic and incident response investigations. For example, a user can log investigative steps or findings directly into the case record.

Use Case Examples

1. Adding a note about a new evidence found to a case.
2. Logging a status update or action taken on a case for audit purposes.

Properties

Output

JSON

• activity_date - The date and time when the activity was logged.
• activity_desc - Description of the activity logged.
• case - Reference to the case object.
• case_id - Identifier of the case.
• display_in_ui - Flag indicating if the log should be displayed in the user interface.
• id - Unique identifier of the activity log entry.
• is_from_api - Indicates if the log entry was created via the API.
• registry - Registry information related to the activity log.
• user - User who created the activity log entry.
• user_id - Identifier of the user who created the log.
• user_input - Original input provided by the user for the log entry.

Dependencies

• An API key credential for authenticating with the DFIR IRIS system.

Troubleshooting

• Ensure the Case ID is valid and exists in the system to avoid errors when adding the log.
• Verify that the Activity Log Content is not empty as it is required.
• If the API returns an error, check the API key credentials and network connectivity.
• If the response fields are customized, ensure the field names are valid to prevent incomplete or missing data in the output.