DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Case → Filter Cases

AI-generated

Overview

This node operation filters cases based on various criteria such as case ID, customer, classification, owner, severity, state, and date ranges. It supports sorting and pagination, allowing users to retrieve a customized list of cases from a case management system. This is useful for scenarios where users need to query and analyze specific cases, for example, filtering cases by severity or owner to prioritize investigations or reporting.

Use Case Examples

  1. Filter cases assigned to a specific owner and sort them by close date in descending order.
  2. Retrieve all cases opened within a specific date range and filter by case severity.
  3. Limit the number of returned cases to 50 and sort them by case ID in ascending order.

Properties

Name Meaning
Case ID The unique identifier of the case to filter by. This is a required field for filtering cases.
Return All Determines whether to return all matching cases or limit the results to a specified number.
Limit The maximum number of cases to return when 'Return All' is false.
Sort Order The direction to sort the filtered cases, either ascending or descending.
Sort By The field by which to sort the filtered cases, such as case ID, name, close date, or initial date.
Filter Options Additional filtering criteria including case IDs, customer, name, description, classification, owner, opening user, severity, state, SOC ID, reviewer, and open date range.
Options Additional options for the query such as returning raw response, selecting specific fields to include or exclude, and pagination start page.

Output

JSON

  • alerts - Alerts associated with the case.
  • case_id - Unique identifier of the case.
  • case_uuid - UUID of the case.
  • classification - Classification details of the case.
  • classification_id - Identifier for the case classification.
  • client - Client associated with the case.
  • client_id - Identifier for the client.
  • close_date - Date when the case was closed.
  • closing_note - Notes added when closing the case.
  • custom_attributes - Custom attributes related to the case.
  • description - Description of the case.
  • initial_date - Initial date of the case.
  • modification_history - History of modifications made to the case.
  • name - Name of the case.
  • note_directories - Directories containing notes related to the case.
  • open_date - Date when the case was opened.
  • owner - Owner of the case.
  • owner_id - Identifier for the case owner.
  • protagonists - Protagonists involved in the case.
  • review_status - Review status of the case.
  • review_status_id - Identifier for the review status.
  • reviewer - Reviewer of the case.
  • reviewer_id - Identifier for the reviewer.
  • severity - Severity level of the case.
  • severity_id - Identifier for the severity level.
  • soc_id - SOC ticket reference associated with the case.
  • state - Current state of the case.
  • state_id - Identifier for the case state.
  • status_id - Identifier for the case status.
  • status_name - Name of the case status.
  • tags - Tags associated with the case.
  • user - User related to the case.
  • user_id - Identifier for the user.

Troubleshooting

  • Ensure that the required 'Case ID' field is provided when filtering cases, as it is mandatory.
  • If no results are returned, verify that the filter criteria are correct and that cases matching the criteria exist.
  • When using date filters, ensure that both start and end dates are provided and formatted correctly in UTC according to RFC standards.
  • If the node returns an error related to invalid field names, check that the fields specified in 'Return Fields' exist and are correctly spelled.
  • For large result sets, consider using the 'Return All' option carefully to avoid performance issues or timeouts.

Discussion