DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

IOC → Get

AI-generated

Overview

The 'DFIR IRIS' node in n8n is designed to interact with the DFIR IRIS Incident Response Platform, specifically handling Indicators of Compromise (IOCs). The 'Get' operation retrieves details of a specified IOC associated with a particular case, facilitating the extraction and management of IOC data within incident response workflows.

Use Case Examples

  1. Retrieving a specific IOC's details for analysis in a cybersecurity incident.
  2. Accessing IOC information linked to a particular case to assess potential threats.

Properties

Name Meaning
Case ID The unique identifier for the case associated with the IOC.
IOC Name or ID The specific name or ID of the IOC to retrieve.
Options Additional parameters to customize the retrieval of the IOC, including:

Output

JSON

  • custom_attributes - Custom attributes associated with the IOC.
  • ioc_description - Description of the IOC.
  • ioc_enrichment - Enrichment data related to the IOC.
  • ioc_id - Unique identifier for the IOC.
  • ioc_misp - MISP (Malware Information Sharing Platform) related information.
  • ioc_tags - Tags associated with the IOC.
  • ioc_tlp_id - Traffic Light Protocol (TLP) identifier for the IOC.
  • ioc_type - Type of the IOC.
  • ioc_type_id - Unique identifier for the IOC type.
  • ioc_uuid - Universally Unique Identifier for the IOC.
  • ioc_value - Value of the IOC.
  • user_id - Identifier of the user associated with the IOC.

Dependencies

  • DFIR IRIS API Key
  • DFIR IRIS Base URL

Troubleshooting

  • Ensure that the 'Case ID' and 'IOC Name or ID' are correctly specified to avoid errors.
  • Verify that the DFIR IRIS API Key and Base URL are correctly configured in the node's credentials.
  • If the 'Options' parameters are used, ensure they are correctly formatted to prevent unexpected results.

Links

Discussion