DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Timeline → Create Timeline Event

AI-generated

Overview

This node operation creates a timeline event within a specified case in the DFIR IRIS system. It is useful for incident responders and digital forensic analysts who want to document and categorize events related to a case timeline, such as security incidents or investigation milestones. For example, a user can add an event with a title, date, category, associated assets, and indicators of compromise (IOCs) to track the progression of an investigation.

Use Case Examples

  1. Adding a timeline event to document initial access by an attacker with associated assets and IOCs.
  2. Creating a remediation event with detailed content and custom attributes to track response actions.

Properties

Name Meaning
Case ID The unique identifier of the case to which the timeline event belongs. This is required to associate the event with the correct case.
Event Assets Names or IDs A list of assets related to the event. Users can select from a list or specify asset IDs using expressions. This links the event to relevant assets involved in the incident.
Event Category The category of the event, such as Legitimate, Remediation, Initial Access, Execution, etc. This helps classify the event type for better organization and analysis.
Event Date UTC The date and time of the event in UTC. This timestamp is required to place the event accurately on the timeline.
Event IOCs Names or IDs A list of indicators of compromise (IOCs) related to the event. Users can select from a list or specify IOC IDs using expressions. This links the event to known malicious indicators.
Event Title A descriptive title for the event. This is required to identify the event on the timeline.
Additional Fields Optional additional details about the event, such as color, content, inclusion in graph or summary, raw event data, source, tags, parent event ID, and custom attributes. These fields provide enhanced context and customization for the event.
Options Options to specify which fields to return or exclude in the response, allowing customization of the output data.

Output

JSON

  • custom_attributes - Custom attributes added to the event.
  • event_assets - List of assets associated with the event.
  • event_category_id - Category identifier of the event.
  • event_color - Color code of the event.
  • event_content - Detailed content or description of the event.
  • event_date - Timestamp of the event in UTC.
  • event_in_graph - Flag indicating if the event is included in graphical views.
  • event_in_summary - Flag indicating if the event is included in summary views.
  • event_iocs - List of indicators of compromise associated with the event.
  • event_raw - Raw event data string.
  • event_source - Source information of the event.
  • event_sync_iocs_assets - Flag indicating if IOCs should be linked to assets automatically.
  • event_tags - Tags associated with the event.
  • event_title - Title of the event.
  • event_tz - Timezone information of the event.

Dependencies

  • An API key credential for authenticating with the DFIR IRIS system

Troubleshooting

  • Ensure the Case ID (cid) is valid and exists in the system to avoid errors related to missing or invalid case references.
  • Verify that the Event Assets and Event IOCs specified exist and are accessible; invalid IDs or names may cause failures.
  • Check that the Event Date is provided in the correct UTC format to prevent timestamp errors.
  • If the node returns errors about missing required fields, confirm all mandatory properties (Case ID, Event Assets, Event Category, Event Date, Event IOCs, Event Title) are set.
  • For issues with field selection in the Options property, ensure the field names are correctly spelled and formatted as a comma-separated list.

Discussion