Overview

This node operation retrieves user information related to a specific case in the DFIR IRIS system. It is useful for scenarios where you need to manage or audit user metadata associated with a case, such as fetching active users, service accounts, or user details for investigation or reporting purposes. For example, you can use it to get a list of users involved in a case by specifying the case ID and selecting which user fields to include or exclude in the response.

Use Case Examples

1. Retrieve all active users for a given case by specifying the case ID and default fields.
2. Fetch user details excluding certain fields by enabling the 'Exclude' option and listing the fields to exclude.

Properties

Output

JSON

• user_active - Indicates if the user is active.
• user_email - The email address of the user.
• user_id - The unique identifier of the user.
• user_is_service_account - Indicates if the user is a service account.
• user_login - The login name of the user.
• user_name - The full name of the user.
• user_uuid - The universally unique identifier of the user.

Dependencies

• DFIR IRIS API or system access

Troubleshooting

• Ensure the Case ID is valid and exists in the system to avoid errors related to missing or invalid case references.
• If the node returns an empty or incomplete user list, verify the fields specified in the 'Return Fields' option and whether the 'Exclude' option is set correctly.
• Check API authentication credentials and permissions to ensure the node can access user data for the specified case.