Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Manage Metadata → Get IOC Types
AI-generatedOverview
This node operation retrieves IOC (Indicator of Compromise) types metadata from the DFIR IRIS system. It is useful in digital forensics and incident response scenarios where understanding the types of IOCs available is necessary for threat analysis and investigation. For example, a security analyst can use this operation to fetch detailed descriptions and validation rules of IOC types to better categorize and validate threat indicators.
Use Case Examples
- Fetching IOC types metadata to display in a security dashboard.
- Retrieving IOC type validation rules to automate IOC data validation in a security workflow.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case for which IOC types are being retrieved. This is a required numeric input. |
| Options | Additional options to customize the response, including whether to return the raw response, which fields to include or exclude in the output. |
Output
JSON
type_description- Description of the IOC type.type_id- Identifier of the IOC type.type_name- Name of the IOC type.type_taxonomy- Taxonomy classification of the IOC type.type_validation_expect- Expected validation criteria for the IOC type.type_validation_regex- Regular expression used for validating the IOC type.
Dependencies
- DFIR IRIS API or system access with appropriate credentials
Troubleshooting
- Ensure the Case ID is valid and exists in the DFIR IRIS system to avoid errors.
- If the API returns an error, check the API authentication credentials and network connectivity.
- If no IOC types are returned, verify that the case has associated IOC metadata and that the requested fields are correctly specified.