Overview

This node operation retrieves case templates from the Manage Metadata resource in the DFIR IRIS system. It is useful for users who need to access predefined case templates for digital forensic and incident response workflows. For example, a security analyst might use this operation to fetch templates that standardize case documentation and investigation procedures.

Use Case Examples

1. Fetching all case templates with default fields to review available templates.
2. Retrieving case templates with specific fields excluded to customize the output for reporting.

Properties

Output

JSON

• id - The unique identifier of the case template.
• name - The name of the case template.
• display_name - The display name of the case template.
• description - Description of the case template.
• added_by - User who added the case template.
• author - Author of the case template.
• classification - Classification level of the case template.
• created_at - Timestamp when the case template was created.
• updated_at - Timestamp when the case template was last updated.
• title_prefix - Title prefix used in the case template.

Dependencies

• An API key credential for authenticating with the DFIR IRIS system.

Troubleshooting

• Ensure the Case ID is provided and is a valid number; missing or invalid Case ID will cause errors.
• If the API returns an error, check the API key credential and network connectivity.
• If the response is empty or missing expected fields, verify the 'fields' option and whether 'Exclude' is set correctly.