Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Timeline → Delete Timeline Event
AI-generatedOverview
This node operation deletes a specific event from a timeline in the DFIR IRIS system. It is useful for managing and cleaning up timeline data by removing events that are no longer relevant or were added by mistake. For example, a user can delete an erroneous or duplicate event from a case timeline to maintain accurate incident records.
Use Case Examples
- Deleting a timeline event by specifying the case ID and event ID to remove outdated or incorrect event data from an investigation timeline.
- Cleaning up a timeline by removing events that are no longer needed for analysis.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case from which the timeline event will be deleted. This is a required numeric input. |
| Event Name or ID | The identifier or name of the timeline event to delete. This can be selected from a list or specified using an expression. It is required and depends on the Case ID to load relevant events. |
Output
JSON
success- Indicates whether the timeline event was successfully deleted (true or false).message- Provides additional information or error messages related to the deletion operation.
Dependencies
- Requires API authentication to the DFIR IRIS system to perform timeline event deletions.
Troubleshooting
- Ensure the Case ID is valid and corresponds to an existing case in the system.
- Verify that the Event ID or name exists within the specified case timeline before attempting deletion.
- Check API credentials and permissions to confirm the node has rights to delete timeline events.
- Common errors include 'Event not found' if the event ID is incorrect, or 'Unauthorized' if API credentials lack deletion permissions.