Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Manage Metadata → Get Case Classifications
AI-generatedOverview
This node operation retrieves case classifications for a specified case ID within the Manage Metadata resource. It allows users to fetch detailed metadata about case classifications, which can be useful for digital forensics and incident response (DFIR) workflows where understanding case categorization is important.
Use Case Examples
- A security analyst wants to get classification details of a specific case by its ID to review its metadata fields such as creation date, description, and name.
- An automated workflow fetches case classification data to enrich incident reports with classification metadata.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case for which classifications are to be retrieved. This is a required numeric input. |
| Options | Additional options to customize the output, including whether to return the raw response, which fields to include or exclude in the output. |
Output
JSON
creation_date- The date the case classification was created.description- Description of the case classification.id- Unique identifier of the case classification.name- Name of the case classification.name_expanded- Expanded or detailed name of the case classification.
Dependencies
- An API key credential or authentication token for DFIR IRIS IRP service
Troubleshooting
- Ensure the Case ID is provided and is a valid number; missing or invalid Case ID will cause errors.
- If the API returns an error, check the authentication credentials and network connectivity.
- If the output fields are not as expected, verify the 'Return Fields' and 'Exclude' options are set correctly.