DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Note → Add

AI-generated

Overview

This node operation allows users to add a new note to a specified case within the DFIR IRIS system. It is useful for documenting case details, observations, or updates directly linked to a case. For example, a security analyst can add investigative notes or findings to a case to keep track of progress and share information with the team.

Use Case Examples

  1. Adding a note titled 'Initial Findings' with detailed content to a case identified by its Case ID.
  2. Specifying the group or directory where the note should be stored to organize notes by teams or categories.

Properties

Name Meaning
Case ID The unique identifier of the case to which the note will be added. This is required to associate the note with the correct case.
Note Title The title or subject of the note being added. This helps in quickly identifying the note's purpose or content.
Note Content The detailed content or body of the note. This is where the main information or observations are recorded.
Group Name or ID The group or directory under which the note will be categorized. This helps in organizing notes within the system.
Options Additional optional settings for the note creation, such as whether to return the raw response, specify which fields to include in the output, or exclude certain fields.

Output

JSON

  • note_id - The unique identifier of the created note.
  • note_title - The title of the created note.
  • note_content - The content/body of the created note.
  • note_case_id - The Case ID to which the note is linked.
  • directory_id - The ID of the group or directory where the note is stored.
  • note_creationdate - The date and time when the note was created.
  • note_lastupdate - The date and time when the note was last updated.
  • note_user - The user who created or last updated the note.
  • custom_attributes - Any custom attributes associated with the note.
  • modification_history - History of modifications made to the note.
  • note_uuid - The universally unique identifier for the note.

Dependencies

  • An API key credential for authenticating with the DFIR IRIS system.

Troubleshooting

  • Ensure the Case ID provided exists and is accessible; otherwise, the note cannot be linked properly.
  • Verify that the Group Name or ID is valid and that the user has permission to add notes to that group.
  • If the node returns an error about missing required fields, check that Note Title, Note Content, and Case ID are all provided.
  • If the API returns an authentication error, confirm that the API key credential is correctly configured and has the necessary permissions.

Links

Discussion