Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
IOC → Add
AI-generatedOverview
This node adds an Indicator of Compromise (IOC) to a case in the DFIR IRIS system. It is useful for cybersecurity professionals who want to enrich their incident response cases with specific IOC details such as type, value, description, tags, and traffic light protocol (TLP) classification. For example, a user can add a malicious IP address or file hash as an IOC to a case for tracking and analysis.
Use Case Examples
- Adding a malicious IP address IOC to a case with a description and tags.
- Adding a file hash IOC with custom attributes and TLP classification to a case.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case to which the IOC will be added. This is required to associate the IOC with the correct case. |
| IOC Type Name or ID | The type of IOC being added, selected from a predefined list or specified by ID. This helps categorize the IOC (e.g., IP address, domain, file hash). |
| IOC Value | The actual value of the IOC, such as an IP address, domain name, or hash value. This is the core data of the IOC. |
| IOC Description | A textual description providing context or details about the IOC. |
| IOC Tags | Comma-separated tags to label or categorize the IOC for easier searching and filtering. |
| IOC TLP | Traffic Light Protocol classification indicating the sensitivity and sharing restrictions of the IOC. Options include Red, Amber, Green, Clear, and AmberStrict. |
| Additional Fields | Optional custom attributes in JSON format to add extra metadata to the IOC. |
| Options | Additional options such as returning the raw response, specifying which fields to include or exclude in the output, and ignoring empty IOC values to prevent sending empty requests. |
Output
JSON
ioc_id- Unique identifier of the created IOC.ioc_type_id- Identifier of the IOC type.ioc_value- Value of the IOC.ioc_description- Description of the IOC.ioc_tags- Tags associated with the IOC.ioc_tlp_id- Traffic Light Protocol classification ID.custom_attributes- Custom attributes added to the IOC.ioc_enrichment- Enrichment data related to the IOC.ioc_misp- MISP (Malware Information Sharing Platform) related data for the IOC.ioc_uuid- UUID of the IOC.user_id- Identifier of the user who created the IOC.
Dependencies
- An API key credential for authenticating with the DFIR IRIS system.
Troubleshooting
- Ensure the Case ID is valid and exists in the system to avoid errors when adding the IOC.
- Verify that the IOC Type is correctly selected or specified by ID to prevent invalid type errors.
- Check that the IOC Value is not empty if the 'Ignore Empty' option is disabled, as empty values will cause the request to fail.
- If the node returns an error related to permissions, confirm that the API key credential has sufficient rights to add IOCs to cases.