DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Timeline → Update Timeline Event

AI-generated

Overview

The 'Update Timeline Event' operation in the DFIR IRIS node allows users to modify existing events within a timeline by specifying various attributes such as event ID, assets, category, date, indicators of compromise (IOCs), title, and additional fields. This functionality is essential for maintaining accurate and up-to-date records in digital forensics and incident response workflows.

Use Case Examples

  1. Updating the category and date of a specific event in a timeline to reflect new findings.
  2. Adding new IOCs to an existing event to enhance its detail and relevance.

Properties

Name Meaning
Case ID Unique identifier for the case associated with the timeline event.
Event Name or ID Identifier for the event to be updated, which can be selected from a list or specified using an expression.
Event Assets Names or IDs List of assets associated with the event, which can be selected from a list or specified using an expression.
Event Category Category of the event, chosen from predefined options such as Unspecified, Legitimate, Remediation, etc.
Event Date UTC Date and time of the event in UTC format.
Event IOCs Names or IDs List of IOCs associated with the event, which can be selected from a list or specified using an expression.
Event Title Title of the event.
Additional Fields Collection of optional fields including event color, content, inclusion in graph or summary, raw data, source, synchronization of IOCs with assets, tags, parent event ID, and custom attributes.
Options Collection of optional settings such as whether to return raw response and which fields to include or exclude in the response.

Output

JSON

  • updatedEvent - The response from the API after updating the event, including all updated event details.

Dependencies

  • An API key credential for authentication with the DFIR IRIS service.

Troubleshooting

  • Ensure that the 'Case ID' and 'Event Name or ID' are correctly specified to identify the event to be updated.
  • Verify that the 'Event Date UTC' is in the correct format (ISO 8601) to avoid parsing errors.
  • Check that the 'Event Category' is selected from the predefined options to prevent invalid category errors.

Links

Discussion