DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Note → Get

AI-generated

Overview

This node retrieves a specific note from a case in the DFIR IRIS system based on the provided Case ID and Note Name or ID. It is useful for scenarios where detailed information about a particular note is needed, such as reviewing investigation notes or audit trails within a digital forensics and incident response platform.

Use Case Examples

  1. Fetching a note by its ID to review its content and metadata.
  2. Retrieving specific fields of a note to display in a custom dashboard or report.

Properties

Name Meaning
Case ID The unique identifier of the case to which the note belongs. This is required to specify the context of the note.
Note Name or ID The identifier or name of the note to retrieve. This can be selected from a list or specified using an expression. It is required to identify the exact note to fetch.
Options Additional options to customize the note retrieval, including whether to return the raw response, which fields to include or exclude in the output.

Output

JSON

  • note_id - The unique identifier of the note.
  • note_title - The title of the note.
  • note_content - The content or body of the note.
  • note_creationdate - The date and time when the note was created.
  • note_lastupdate - The date and time when the note was last updated.
  • note_user - The user who created or last updated the note.
  • custom_attributes - Custom attributes associated with the note.
  • directory - Directory information related to the note.
  • directory_id - Identifier for the directory associated with the note.
  • modification_history - History of modifications made to the note.
  • note_case_id - The case ID to which the note belongs.
  • note_uuid - The universally unique identifier of the note.

Dependencies

  • An API key credential for authenticating with the DFIR IRIS system.

Troubleshooting

  • Ensure the Case ID and Note Name or ID are correctly specified; incorrect values will result in errors or no data returned.
  • If the node returns an error about missing fields, verify that the fields specified in the options exist and are correctly spelled.
  • If the API returns raw data that is difficult to interpret, try disabling the 'Return Raw' option to get processed output.

Discussion