DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Timeline → Flag or Unflag Timeline Event

AI-generated

Overview

This node operation allows users to flag or unflag a specific timeline event within a case. It is useful for marking important events or removing such marks for better case management and tracking. For example, a user can flag a suspicious event in a digital forensic investigation timeline to highlight it for further analysis.

Use Case Examples

  1. Flagging a timeline event to indicate it requires further investigation.
  2. Unflagging a timeline event once it has been reviewed and no longer needs special attention.

Properties

Name Meaning
Case ID The unique identifier of the case to which the timeline event belongs. This is required to specify the context of the event.
Event Name or ID The identifier or name of the timeline event to be flagged or unflagged. This can be selected from a list or specified using an expression.
Options Additional options to customize the operation, including whether to return the raw response, which fields to include or exclude in the response.

Output

JSON

  • case - The case associated with the timeline event.
  • case_id - The ID of the case.
  • category - The category of the timeline event.
  • children - Any child events related to the timeline event.
  • custom_attributes - Custom attributes associated with the event.
  • event_added - Timestamp when the event was added.
  • event_color - Color coding of the event.
  • event_content - Content or description of the event.
  • event_date - Date of the event.
  • event_date_wtz - Event date with timezone information.
  • event_id - Unique identifier of the event.
  • event_in_graph - Indicates if the event is included in a graph representation.
  • event_in_summary - Indicates if the event is included in a summary.
  • event_is_flagged - Indicates if the event is currently flagged.
  • event_raw - Raw data of the event.
  • event_source - Source of the event data.
  • event_tags - Tags associated with the event.
  • event_title - Title of the event.
  • event_tz - Timezone of the event.
  • event_uuid - UUID of the event.
  • modification_history - History of modifications made to the event.
  • parent - Parent event if this event is a child.
  • parent_event_id - ID of the parent event.
  • registry - Registry information related to the event.
  • user - User who created or modified the event.
  • user_id - ID of the user.

Dependencies

  • An API key credential for authenticating with the DFIR IRIS service.

Troubleshooting

  • Ensure the Case ID and Event ID are correct and exist in the system to avoid errors.
  • If the operation fails, check the API key credential and network connectivity.
  • If the response is empty or missing fields, verify the 'Return Fields' option is correctly set.

Discussion