Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
IOC → Update
AI-generatedOverview
This node updates an Indicator of Compromise (IOC) within a specified case in the DFIR IRIS system. It is useful for cybersecurity professionals who need to modify IOC details such as type, description, value, tags, and classification (TLP) within an incident response case. For example, updating the IOC value or adding custom attributes to better describe the threat indicator.
Use Case Examples
- Updating the description and tags of an existing IOC in a case.
- Changing the IOC type or TLP classification for better threat categorization.
- Adding custom attributes to an IOC for enhanced metadata.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case to which the IOC belongs. This is required to specify the context for the IOC update. |
| IOC Name or ID | The identifier or name of the IOC to update. This is required to select the specific IOC within the case. |
| Additional Fields | Optional fields to update on the IOC, including IOC Type, Description, Value, TLP classification, Tags, and Custom Attributes. |
| Options | Additional options for the update operation, including whether to return the raw response, which fields to include or exclude in the response. |
Output
JSON
custom_attributes- Custom metadata attributes of the IOC.ioc_description- Description of the IOC.ioc_enrichment- Enrichment data related to the IOC.ioc_id- Unique identifier of the IOC.ioc_misp- MISP (Malware Information Sharing Platform) related data for the IOC.ioc_tags- Tags associated with the IOC.ioc_tlp_id- Traffic Light Protocol classification ID of the IOC.ioc_type- Type information of the IOC.ioc_type_id- Type ID of the IOC.ioc_uuid- UUID of the IOC.ioc_value- Value of the IOC.user_id- Identifier of the user who last modified the IOC.
Dependencies
- An API key credential for authenticating with the DFIR IRIS system.
Troubleshooting
- Ensure the Case ID and IOC ID are correctly specified; invalid IDs will cause update failures.
- Verify that the API key credential is valid and has sufficient permissions to update IOCs.
- If the node returns an error about missing fields, check that required fields like Case ID and IOC ID are provided.
- If the response is empty or incomplete, try enabling the 'Return Raw' option to debug the raw API response.