Overview

This node performs a search operation within notes related to a specific case ID. It allows users to input a search string with wildcard support to find matching notes. The node is useful for scenarios where users need to filter and retrieve notes based on content or metadata within a case management or digital forensics investigation platform.

Use Case Examples

1. Searching for notes containing specific keywords or phrases within a case.
2. Retrieving notes with particular attributes or metadata fields for review or analysis.

Properties

Output

JSON

• note_id - Unique identifier of the note.
• note_title - Title of the note.
• note_content - Content or body of the note.
• note_case_id - Identifier of the case to which the note belongs.
• note_creationdate - Date and time when the note was created.
• note_lastupdate - Date and time when the note was last updated.
• note_user - User who created or last modified the note.
• note_uuid - Universal unique identifier for the note.
• custom_attributes - Custom attributes associated with the note.
• directory - Directory or folder where the note is stored.
• directory_id - Identifier of the directory containing the note.
• modification_history - History of modifications made to the note.

Dependencies

• An API key credential or authentication token for the DFIR IRIS platform is required to perform the search operation.

Troubleshooting

• Ensure the Case ID is correctly provided and corresponds to an existing case; otherwise, the search will return no results.
• Verify that the search input string is properly formatted, especially when using wildcards (%). Incorrect formatting may lead to no matches or errors.
• If the node returns an error related to authentication, check that the API key or authentication token is valid and has the necessary permissions.
• If the output fields are not as expected, review the 'Return Fields' and 'Exclude' options to ensure the correct fields are included or excluded.