DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Timeline → Fetch Timeline Event

AI-generated

Overview

This node fetches a specific timeline event from the DFIR IRIS system based on a given Case ID and Event Name or ID. It is useful for retrieving detailed information about a particular event within a case timeline, such as event content, date, user, and other metadata. Practical applications include incident investigation workflows where detailed event data is needed for analysis or reporting.

Use Case Examples

  1. Fetch a timeline event by specifying the Case ID and selecting the event from a dynamically loaded list of events.
  2. Retrieve specific fields of a timeline event, such as event title, date, and user, while excluding other fields to optimize data handling.

Properties

Name Meaning
Case ID The unique identifier of the case to which the timeline event belongs. This is required to specify the context of the event.
Event Name or ID The identifier or name of the timeline event to fetch. This can be selected from a list or specified using an expression. It is required to identify the exact event to retrieve.
Options Additional options to customize the fetch operation, including whether to return the raw response, which fields to include or exclude in the output.

Output

JSON

  • case - The case associated with the timeline event.
  • case_id - The unique identifier of the case.
  • category - The category of the timeline event.
  • children - Any child events related to this timeline event.
  • custom_attributes - Custom attributes associated with the event.
  • event_added - Timestamp when the event was added.
  • event_color - Color coding for the event.
  • event_content - Content or description of the event.
  • event_date - Date of the event.
  • event_date_wtz - Event date with timezone information.
  • event_id - Unique identifier of the event.
  • event_in_graph - Indicates if the event is included in the graph view.
  • event_in_summary - Indicates if the event is included in the summary view.
  • event_is_flagged - Indicates if the event is flagged for attention.
  • event_raw - Raw data of the event.
  • event_source - Source of the event data.
  • event_tags - Tags associated with the event.
  • event_title - Title of the event.
  • event_tz - Timezone of the event.
  • event_uuid - UUID of the event.
  • modification_history - History of modifications made to the event.
  • parent - Parent event if this event is a child.
  • parent_event_id - Identifier of the parent event.
  • registry - Registry information related to the event.
  • user - User associated with the event.
  • user_id - Identifier of the user.

Dependencies

  • An API key credential for authenticating with the DFIR IRIS system.

Troubleshooting

  • Ensure the Case ID and Event Name or ID are correctly specified; incorrect values will result in no data or errors.
  • If the node returns an error about authentication, verify that the API key credential is correctly configured and has the necessary permissions.
  • If the event list does not load, check network connectivity and that the Case ID is valid and accessible.

Discussion