Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Comment → Add
AI-generatedOverview
This node adds a comment to a specified object within a case in the DFIR IRIS system. It is useful for users who want to programmatically attach comments to various objects such as alerts, assets, events, evidences, IOCs, notes, or tasks within a case. For example, a security analyst can use this node to add investigative notes or observations to a task or alert during an incident response workflow.
Use Case Examples
- Adding a comment to a task object within a case to document investigation progress.
- Attaching a note to an alert object to provide additional context or findings.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case to which the comment will be added. |
| Object Name | The type of object (e.g., alert, asset, event, evidence, IOC, note, task) to which the comment will be attached. |
| Object ID | The unique identifier of the specific object to which the comment will be added. |
| Comment Text | The text content of the comment to be added. |
| Options | Additional options for the comment creation such as returning raw response, specifying fields to include or exclude in the response. |
Output
JSON
comment_date- The date when the comment was created.comment_id- The unique identifier of the created comment.comment_text- The text content of the created comment.comment_update_date- The date when the comment was last updated.comment_uuid- The UUID of the created comment.name- The name associated with the comment.user- The user who created the comment.
Dependencies
- DFIR IRIS API authentication
Troubleshooting
- Ensure the Case ID and Object ID are valid and exist in the DFIR IRIS system to avoid errors.
- Verify that the Object Name matches one of the supported types to prevent invalid object errors.
- If the comment text is empty, the node will likely throw a validation error; ensure the comment text is provided.
- Check API authentication credentials if the node fails to connect or returns authorization errors.