Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Module → Call
AI-generatedOverview
This node interacts with the DFIR IRIS platform to call a specific module on a given case object. It is useful for automating workflows that require invoking modules on various case-related objects such as assets, events, evidence, tasks, and notes within the DFIR IRIS incident response platform. For example, it can be used to trigger analysis modules on evidence or update tasks related to a case.
Use Case Examples
- Calling a module to analyze evidence associated with a case.
- Triggering a global task module for a specific case ID.
- Invoking a note module to add or retrieve notes related to a case.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case on which the module will be called. This is a required numeric input. |
| Case Object Type | Specifies the type of case object to target with the module call, such as asset, case, event, evidence, global task, IOC, note, or task. |
| Select Module Name or ID | Choose the module to call by selecting from a dynamically loaded list of modules or specifying an ID using an expression. |
| Module Targets | A comma-separated string listing the IDs of the specific objects (e.g., task IDs, IOC IDs) within the case to which the module call should apply. |
Output
JSON
result- The output result from calling the specified module on the case object.
Dependencies
- Requires connection to the DFIR IRIS platform with appropriate API credentials to authenticate and authorize module calls.
Troubleshooting
- Ensure the Case ID is valid and exists in the DFIR IRIS system to avoid errors.
- Verify that the selected module name or ID is correct and accessible with the current credentials.
- Check that the Module Targets string is correctly formatted as a comma-separated list of valid object IDs.
- Common error messages may include authentication failures, invalid case or module IDs, or permission issues. Resolving these typically involves verifying credentials, input values, and user permissions.