Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Manage Metadata → Get Evidence Types
AI-generatedOverview
This node operation retrieves evidence types associated with a specific case in the DFIR IRIS system. It is useful for digital forensic and incident response professionals who need to access metadata about evidence types linked to a case for investigation or reporting purposes. For example, a user can specify a case ID to fetch relevant evidence types and optionally customize the output fields or receive the raw response for further processing.
Use Case Examples
- Retrieve evidence types for a given case ID to display in a forensic dashboard.
- Fetch specific fields of evidence types to generate a summary report.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case for which to retrieve evidence types, required to specify the context of the query. |
| Options | Additional options to customize the response, including whether to return the raw response, which fields to include or exclude in the output. |
Output
JSON
id- Unique identifier of the evidence type.name- Name of the evidence type.description- Description of the evidence type.creation_date- Date when the evidence type was created.
Dependencies
- DFIR IRIS API authentication
Troubleshooting
- Ensure the Case ID is valid and exists in the DFIR IRIS system to avoid errors.
- If the API returns an error, check the API authentication credentials and network connectivity.
- When using the 'Return Raw' option, be prepared to handle the raw JSON structure which may differ from the processed output.