Overview

The 'DFIR IRIS' node in n8n is designed to interact with the DFIR IRIS Incident Response Platform, specifically facilitating the updating of comments associated with various objects such as alerts, assets, events, evidences, IOCs, notes, and tasks. This node is particularly useful for incident response teams needing to programmatically add or modify comments within the IRIS platform, thereby enhancing collaboration and documentation during investigations.

Use Case Examples

1. Updating a comment on an alert to provide additional context or information.
2. Modifying a note associated with an asset to reflect new findings.
3. Adding a comment to an event to document analysis results.

Properties

Output

JSON

• comment_case_id - The unique identifier for the case associated with the comment.
• comment_date - The date and time when the comment was created.
• comment_id - The unique identifier for the comment.
• comment_text - The content of the comment.
• comment_update_date - The date and time when the comment was last updated.
• comment_user_id - The identifier of the user who created or last updated the comment.
• comment_uuid - A universally unique identifier for the comment.

Troubleshooting

• Ensure that the 'cid', 'obj_name', 'obj_id', and 'comment_id' parameters are correctly specified to avoid errors during execution.
• Verify that the 'obj_name' corresponds to a valid object type within the DFIR IRIS platform to prevent invalid object errors.
• Check that the 'comment_text' is properly formatted and does not contain unsupported characters to avoid submission errors.