Overview

This node operation retrieves asset types metadata from the DFIR IRIS system based on a specified Case ID. It allows users to customize the output by selecting specific fields to include or exclude and offers an option to return the raw response from the API. This is useful for digital forensics and incident response workflows where detailed asset type information is needed for a particular case.

Use Case Examples

1. A security analyst wants to fetch asset types related to a specific case to analyze compromised assets.
2. An automated workflow retrieves asset metadata to update a dashboard with asset descriptions and status icons.

Properties

Output

JSON

• asset_description - Description of the asset type.
• asset_icon_compromised - Icon representing the asset when compromised.
• asset_icon_compromised_path - File path to the compromised asset icon.
• asset_icon_not_compromised - Icon representing the asset when not compromised.
• asset_icon_not_compromised_path - File path to the non-compromised asset icon.
• asset_id - Unique identifier of the asset type.
• asset_name - Name of the asset type.

Dependencies

• DFIR IRIS API authentication

Troubleshooting

• Ensure the Case ID is valid and exists in the DFIR IRIS system to avoid errors.
• If the API returns an error, check the API authentication credentials and network connectivity.
• If no data is returned, verify that the specified fields are correct and that the case contains asset type data.