DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Datastore File → Upload File

AI-generated

Overview

This node uploads a file to a specified folder within a datastore, associating it with a particular case ID. It is useful in digital forensics and incident response scenarios where files need to be systematically stored and categorized for investigation purposes. For example, a user can upload evidence files to a case folder, tagging them with metadata such as description, evidence status, and tags for easier retrieval and analysis.

Use Case Examples

  1. Uploading a malware sample file to a case folder with tags indicating it is an IOC (Indicator of Compromise).
  2. Uploading a forensic image file to a case folder with a description and password protection.

Properties

Name Meaning
Case ID The unique identifier of the case to which the file belongs. This is a required numeric field.
Destination Folder Name or ID The target folder within the datastore where the file will be uploaded. Users can select from a list or specify an ID via expression.
Binary Property Name The name of the binary property in the input data that contains the file data to be uploaded. This is required and defaults to 'data'.
Additional Fields Optional metadata fields for the file such as description, evidence status, IOC status, password, and tags.
Options Additional options controlling the output such as whether to return the raw response, which fields to include or exclude in the output.

Output

JSON

  • file_id - Unique identifier of the uploaded file.
  • file_case_id - The case ID associated with the file.
  • file_date_added - Timestamp when the file was added.
  • file_description - Description of the file.
  • file_is_evidence - Boolean indicating if the file is evidence.
  • file_is_ioc - Boolean indicating if the file is an Indicator of Compromise.
  • file_original_name - Original name of the uploaded file.
  • file_parent_id - ID of the parent folder or entity.
  • file_password - Password for the file if set.
  • file_sha256 - SHA256 hash of the file content.
  • file_size - Size of the file in bytes.
  • file_tags - Tags associated with the file.
  • file_uuid - UUID of the file.
  • added_by_user_id - ID of the user who added the file.
  • modification_history - History of modifications made to the file.

Troubleshooting

  • Ensure the Case ID is valid and exists in the datastore before uploading.
  • Verify that the binary property name matches the input data containing the file.
  • Check that the destination folder ID or name is correct and accessible.
  • If the upload fails, verify network connectivity and API authentication credentials.
  • If the raw response is enabled but the output is unexpected, check the fields and exclude options for correct configuration.

Discussion