Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Timeline → Query Timeline
AI-generatedOverview
This node queries timeline events related to a specific case in a DFIR (Digital Forensics and Incident Response) system. It allows users to filter timeline events based on various conditions such as event assets, IOCs, tags, title, description, category, source, and date range. This is useful for forensic analysts or incident responders who want to retrieve detailed event data from a case timeline to analyze incident progression or gather evidence.
Use Case Examples
- Query timeline events for a specific case ID with filters on event assets and tags to investigate suspicious activities.
- Retrieve timeline events within a date range to understand the sequence of events during an incident.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case for which timeline events are queried. This is a required field. |
| All Query conditions work as logic AND clause | Indicates that all specified query conditions are combined using a logical AND, meaning all conditions must be met for an event to be included. |
| Query | A collection of filters to apply to the timeline events, including event assets, IOCs, tags, title, description, raw data, category, source, and date range. |
| Options | Additional options for the query, including whether to return the raw response, which fields to include or exclude in the output. |
Output
JSON
acquisition_date- Date when the event was acquired.case- Case details associated with the event.case_id- Identifier of the case.chain_of_custody- Chain of custody information for the event.custom_attributes- Custom attributes related to the event.date_added- Date when the event was added to the timeline.end_date- End date of the event.file_description- Description of any file associated with the event.file_hash- Hash of the file associated with the event.file_size- Size of the file associated with the event.file_uuid- UUID of the file associated with the event.filename- Filename of the file associated with the event.id- Unique identifier of the timeline event.start_date- Start date of the event.type- Type of the event.type_id- Identifier for the event type.user- User associated with the event.user_id- Identifier of the user associated with the event.
Dependencies
- An API key credential for authenticating with the DFIR IRIS system
Troubleshooting
- Ensure the Case ID is provided and valid, as it is required for querying timeline events.
- Verify that the API key credential is correctly configured and has the necessary permissions.
- If no events are returned, check the query filters to ensure they match existing timeline events.
- If the node returns an error related to fields, verify the field names specified in the 'Return Fields' option are valid.