Overview

This node updates an existing case in the DFIR IRIS system. It is useful for modifying case details such as the case name, SOC ID, classification, owner, reviewer, state, resolution status, severity, tags, and custom attributes. For example, it can be used to assign a case to a new owner, update the case status, or add tags for better categorization.

Use Case Examples

1. Updating the owner and status of a case after new information is received.
2. Adding tags and custom attributes to a case for enhanced tracking and reporting.

Properties

Output

JSON

• case_id - The unique identifier of the updated case.
• case_name - The name of the updated case.
• case_soc_id - The SOC ticket reference of the updated case.
• classification_id - The classification ID of the updated case.
• owner_id - The user ID of the case owner.
• reviewer_id - The user ID of the case reviewer.
• state_id - The current state ID of the case.
• status_id - The resolution status ID of the case.
• severity_id - The severity ID of the case.
• case_tags - Tags associated with the case.
• custom_attributes - Custom attributes added to the case.
• modification_history - History of modifications made to the case.
• open_date - The date the case was opened.
• close_date - The date the case was closed.
• closing_note - Notes added when closing the case.
• user_id - The ID of the user who last modified the case.
• case_customer - Customer associated with the case.
• case_description - Description of the case.
• case_uuid - UUID of the case.
• protagonists - Key individuals involved in the case.

Troubleshooting

• Ensure the case_id is provided and valid; missing or incorrect IDs will cause the update to fail.
• Verify that any referenced IDs for classification, owner, reviewer, state, and severity exist in the system to avoid errors.
• If the API returns an error, check the raw response by enabling the 'Return Raw' option to diagnose issues.
• Ensure that custom attributes are valid JSON to prevent parsing errors.