Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Timeline → Get Timeline State
AI-generatedOverview
This node operation retrieves the state of a timeline for a specified case ID in the DFIR IRIS system. It is useful for digital forensic and incident response workflows where users need to fetch the current status or details of a timeline associated with a particular case. For example, it can be used to monitor investigation progress or to integrate timeline data into automated reporting.
Use Case Examples
- Retrieve the timeline state for a case to check investigation progress.
- Fetch timeline details to integrate with a security dashboard.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case for which the timeline state is to be retrieved. This is a required numeric input. |
| Options | Additional options for the request, including whether to return the raw response from the API. |
Output
JSON
timelineState- The state information of the timeline for the specified case.rawResponse- The raw API response if the 'Return Raw' option is enabled.
Dependencies
- DFIR IRIS API authentication
Troubleshooting
- Ensure the Case ID is valid and exists in the DFIR IRIS system to avoid errors.
- If the API returns an error, check the API credentials and network connectivity.
- If the 'Return Raw' option is enabled, the output may require additional parsing for further use.