DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

IOC → Delete

AI-generated

Overview

This node performs the deletion of an Indicator of Compromise (IOC) within the DFIR IRIS system. It is useful in scenarios where security analysts need to remove outdated or incorrect IOC entries from a case to maintain accurate threat intelligence data. For example, if an IOC is no longer relevant or was added by mistake, this node can be used to delete it from a specific case.

Use Case Examples

  1. Deleting an IOC from a case to clean up threat data.
  2. Removing a false positive IOC from an investigation case.

Properties

Name Meaning
Case ID The unique identifier of the case from which the IOC will be deleted. This is a required numeric input.
IOC Name or ID The identifier or name of the IOC to delete. This can be selected from a list or specified via an expression. It is required and depends on the Case ID.
Options Additional options for the delete operation, such as whether to return the raw response from the API.

Output

JSON

  • success - Indicates whether the IOC deletion was successful.
  • message - Provides additional information or status message about the deletion operation.

Dependencies

  • DFIR IRIS API access with appropriate permissions to delete IOCs.

Troubleshooting

  • Ensure the Case ID and IOC ID are correct and exist in the system; otherwise, the deletion will fail.
  • Check API authentication credentials if the node cannot connect to the DFIR IRIS service.
  • If the 'Return Raw' option is enabled, the output may be less user-friendly and require additional parsing.

Links

Discussion