Overview

This node interacts with the DFIR IRIS platform to retrieve multiple Indicators of Compromise (IOCs) associated with a specific case ID. It is useful in digital forensics and incident response scenarios where analysts need to gather detailed IOC data for investigation and threat analysis. For example, a security analyst can use this node to fetch all IOCs related to a particular case to understand the scope and nature of a security incident.

Use Case Examples

1. Retrieve all IOCs for a given case ID to analyze potential threats.
2. Fetch specific fields of IOC data to integrate with other security tools or dashboards.

Properties

Output

JSON

• ioc_id - Unique identifier of the IOC.
• ioc_value - The value or content of the IOC.
• ioc_type - Type/category of the IOC.
• ioc_description - Description of the IOC.
• ioc_enrichment - Additional enrichment data related to the IOC.
• ioc_misp - MISP (Malware Information Sharing Platform) related data for the IOC.
• ioc_tags - Tags associated with the IOC for categorization.
• ioc_tlp_id - Traffic Light Protocol (TLP) level identifier for the IOC.
• ioc_type_id - Identifier for the IOC type.
• ioc_uuid - UUID of the IOC.
• custom_attributes - Custom attributes associated with the IOC.
• user_id - Identifier of the user who created or modified the IOC.

Dependencies

• DFIR IRIS API authentication

Troubleshooting

• Ensure the Case ID is valid and exists in the DFIR IRIS system to avoid empty or error responses.
• If the API returns an authentication error, verify that the API key or credentials are correctly configured.
• If the response is empty or missing expected fields, check the 'Return Fields' option to ensure the correct fields are requested.

Links

• DFIR IRIS API Documentation - Official API documentation for DFIR IRIS platform.