--- title: IRIS slug: connectors/iris createdAt: 2026-10-06T11:57:57.495Z --- IRIS is an incident response and case management platform that centralizes investigation, evidence, and workflow management for security teams. IRIS is an open-source incident response and case management platform designed for digital forensics and security operations. This connector enables seamless integration between IRIS and Swimlane Turbine, allowing users to automate the creation, management, and enrichment of cases, assets, events, IOCs, evidences, and notes directly within their security workflows. By leveraging this integration, security teams can streamline incident response processes, ensure consistent case documentation, and accelerate investigations without manual intervention. The IRIS connector empowers Swimlane Turbine users to orchestrate end-to-end incident response, improve data accuracy, and reduce response times through low-code automation. ### Limitations None to date. ## Prerequisites Before you can use the IRIS connector, ensure you have the following prerequisites: - Bearer token authentication configured for IRIS API access, requiring: - URL: The base endpoint for your IRIS instance's API. - Token: A valid bearer token for authenticating API requests. ## Capabilities This Connector provides the following capabilities: - Add a new Asset - Delete an Asset - Fetch an Asset - Get List of Assets - Update an Asset - Add a new Case - Update a Case - Add a new IOC - Delete an IOC - Fetch an IOC - Get List of IOCs - Update an IOC - Fetch a Note - Get list of directories and notes - Get User List *... and so on* ### Add a new Asset Create an asset and link it to the case. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-assets/operation/post-case-asset-add). ### Delete an Asset Delete an asset based on its ID. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-assets/operation/post-case-assets-delete). ### Fetch an Asset Fetch an asset. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-assets/operation/get-case-asset). ### Get List of Assets Get a list of the assets linked to the case. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-assets/operation/get-case-get-assets-list). ### Update an Asset Update an asset. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-assets/operation/post-case-asset-update). ### Add a new Case Create a new immediate case. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Manage-Cases/operation/post-manage-cases-add). ### Update a Case Update informations of a case. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Manage-Cases/operation/get-manage-cases-update). ### Add a new IOC Add a new IOC. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-IOC/operation/post-case-ioc-add). ### Delete an IOC Delete an IOC from the case. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-IOC/operation/delete-case-ioc). ### Fetch an IOC Fetch an IOC. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-IOC/operation/get-case-ioc-fetch). ### Get List of IOCs Returns a list of IOCs as well as any existing links with other cases. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-IOC/operation/get-case-ioc-list). ### Update an IOC Update an IOC. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-IOC/operation/post-case-ioc-update). ### Fetch a Note Fetch the content and metadata of a note. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-notes/operation/get-case-notes-fetch). ### Get list of directories and notes List the directories and notes associated to it. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Case-notes/operation/get-case-notes-directories). ### Get User List Return a list of available users. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/Manage-users/operation/get-manage-users-list). ### Ping Server This action is used to test authentication. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/latest/_static/iris_api_reference_v2.0.4.html#tag/API/operation/get-api-ping). ### Add an Evidence Add a new evidence to the case. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Case-evidences/operation/post-case-add-evidence). ### Delete a case Evidence Remove an evidence from the case. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Case-evidences/operation/post-case-evidences-delete). ### Get an Evidence Returns an evidence metadata. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Case-evidences/operation/get-case-evidence). ### Get Case Evidences Returns a list of all evidences linked to the case. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Case-evidences/operation/get-case-evidences-list). ### Update an evidence Update an evidence. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Case-evidences/operation/post-case-evidences-update). ### Fetch the Timeline Fetch the state of the timeline. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Case-timeline/operation/get-case-timeline-state). ### Fetch the Timeline by Query Filter the timeline through a query. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Case-timeline/operation/get-case-timeline-filter). ### Add a new Event Create a new event in the timeline. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Case-timeline/operation/post-case-timeline-add-delete-event_id---copy). ### Fetch an Event Return information of an event of the timeline. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Case-timeline/operation/get-case-timeline-get-event). ### Update an Event Update an event in the timeline IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Case-timeline/operation/post-case-timeline-update-delete-event_id---copy). ### Delete an Event Delete an event from the timeline. IRIS documentation for this action can be found [here](https://docs.dfir-iris.org/2.4.27/_static/iris_api_reference_v2.0.4.html#tag/Case-timeline/operation/post-case-timeline-delete). # Configurations ## HTTP Bearer Authentication IRIS Authenticates using bearer token ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ------------------------------------ | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | A bearer token to authenticate with. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add a new asset Create a new asset and associate it with a specific case in IRIS by providing the asset type, asset name, and case identifier. ### Endpoint - **URL:** `/case/assets/add` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------ | | `parameters.cid` | number | Required | The Case ID to filter assets by. | | `asset_type_id` | string | Optional | The type of the asset to add. | | `asset_domain` | string | Optional | The domain of the asset to add. | | `asset_ip` | string | Optional | The IP of the asset to add. | | `asset_info` | string | Optional | The info of the asset to add. | | `asset_compromise_status_id` | string | Optional | The compromise status of the asset to add. | | `analysis_status_id` | string | Optional | The analysis status of the asset to add. | | `ioc_links` | array | Optional | The IOC links of the asset to add. | | `asset_name` | string | Optional | The name of the asset to add. | | `asset_tags` | string | Optional | The tags of the asset to add. | | `asset_description` | string | Optional | The description of the asset to add. | | `custom_attributes` | object | Optional | Custom attributes to add to the asset. | ### Input Example `{"parameters":{"cid":1},"json_body":{"asset_type_id":"9","asset_domain":"iris.local","asset_ip":"127.0.0.1","asset_info":"test","asset_compromise_status_id":"1","analysis_status_id":"3","ioc_links":["https://www.example.com"],"asset_name":"admin_laptop","asset_tags":"anewtag","asset_description":"A host description","custom_attributes":{}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `message` | string | Response message | | `data` | object | Response data | | `data.asset_enrichment` | object | Response data | | `data.asset_type` | object | Response data | | `data.asset_type.asset_icon_not_compromised` | string | Response data | | `data.asset_type.asset_icon_compromised` | string | Response data | | `data.asset_type.asset_description` | string | Response data | | `data.asset_type.asset_id` | number | Response data | | `data.asset_type.asset_name` | string | Response data | | `data.asset_type_id` | number | Response data | | `data.case_id` | number | Response data | | `data.asset_description` | string | Response data | | `data.asset_id` | number | Response data | | `data.analysis_status_id` | number | Response data | | `data.custom_attributes` | object | Response data | | `data.asset_info` | string | Response data | | `data.user_id` | number | Response data | | `data.date_added` | string | Response data | | `data.date_update` | string | Response data | | `data.asset_name` | string | Response data | | `data.asset_ip` | string | Response data | | `data.asset_tags` | string | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"status":"success","message":"Asset added","data":{"asset_enrichment":null,"asset_type":{},"asset_type_id":9,"case_id":1,"asset_description":"A host description","asset_id":3912,"analysis_status_id":3,"custom_attributes":{},"asset_info":"","user_id":1,"date_added":"2024-01-09T13:25:51.328503","date_update":"2024-01-09T13:25:51.328506","asset_name":"admin_laptop","asset_ip":"127.0.0.1","asset_tags":"anewtag"}}}` ## Add a new case Create a new immediate case in IRIS by specifying the SOC ID, customer, case name, and description. ### Endpoint - **URL:** `/manage/cases/add` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------- | | `case_soc_id` | string | Optional | Unique identifier | | `case_customer` | number | Optional | The customer ID linked to the case. | | `case_name` | string | Optional | A short name for the case. | | `case_description` | string | Optional | A short description of the case. | | `custom_attributes` | object | Optional | Custom attributes to add to the case. Keys should be the attribute name and values should be the attribute value. | | `custom_attributes.attr1` | string | Optional | Parameter for Add a new case | | `custom_attributes.attr2` | string | Optional | Parameter for Add a new case | | `case_template_id` | string | Optional | The case template ID to use for the case. | | `classification_id` | number | Optional | The classification ID to use for the case. | ### Input Example `{"json_body":{"case_soc_id":"SOC_154","case_customer":1,"case_name":"My Case API","case_description":"A super nice description","custom_attributes":{"attr1":"value1","attr2":"value2"},"case_template_id":"1","classification_id":1}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `message` | string | Response message | | `data` | object | Response data | | `data.case_name` | string | Response data | | `data.case_customer` | number | Response data | | `data.case_uuid` | string | Response data | | `data.case_description` | string | Response data | | `data.case_id` | number | Response data | | `data.open_date` | string | Response data | | `data.status_id` | number | Response data | | `data.modification_history` | object | Response data | | `data.modification_history.1704888196.578914` | object | Response data | | `data.modification_history.1704888196.578914.user` | string | Response data | | `data.modification_history.1704888196.578914.user_id` | number | Response data | | `data.modification_history.1704888196.578914.action` | string | Response data | | `data.case_soc_id` | string | Response data | | `data.state_id` | number | Response data | | `data.close_date` | object | Response data | | `data.classification_id` | object | Response data | | `data.closing_note` | object | Response data | | `data.owner_id` | number | Response data | | `data.user_id` | number | Response data | | `data.custom_attributes` | object | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"status":"success","message":"Case created","data":{"case_name":"#1065 - My Case API","case_customer":1,"case_uuid":"435e3f47-479e-4a3c-98df-8e28b01fd2bc","case_description":"A super nice description","case_id":1065,"open_date":"2024-01-10","status_id":0,"modification_history":{},"case_soc_id":"SOC_154","state_id":11,"close_date":null,"classification_id":null,"closing_note":null,"owner_id":1,"user_id":1}}}` ## Add a new event Create a new event in the IRIS timeline by specifying the event title, date, time zone, and customer ID. ### Endpoint - **URL:** `/case/timeline/events/add` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ---------------------------------------------------- | | `parameters.cid` | number | Required | The Case ID to add an event to. | | `event_title` | string | Optional | The title of the event to add. | | `event_raw` | string | Optional | The raw data of the event to add. | | `event_source` | string | Optional | The source of the event to add. | | `event_assets` | array | Optional | The assets of the event to add. | | `event_iocs` | array | Optional | The IOCs of the event to add. | | `event_category_id` | string | Optional | The category ID of the event to add. | | `event_in_summary` | boolean | Optional | Whether the event should be included in the summary. | | `event_in_graph` | boolean | Optional | Whether the event should be included in the graph. | | `event_color` | string | Optional | The color of the event to add. | | `event_date` | string | Optional | The date of the event to add. | | `event_sync_iocs_assets` | boolean | Optional | Whether the event should sync IOCs and assets. | | `event_tags` | string | Optional | The tags of the event to add. | | `event_tz` | string | Optional | The timezone of the event to add. | | `event_content` | string | Optional | The content of the event to add. | | `parent_event_id` | number | Optional | The parent event ID of the event to add. | | `custom_attributes` | object | Optional | Custom attributes to add to the event. | ### Input Example `{"parameters":{"cid":2},"json_body":{"event_title":"An event","event_raw":"My event raw data","event_source":"My source","event_assets":[45],"event_iocs":[33],"event_category_id":"5","event_in_summary":true,"event_in_graph":true,"event_color":"#1572E899","event_date":"2023-03-08T03:02:00.000","event_sync_iocs_assets":true,"event_tags":"tag","event_tz":"+00:00","event_content":"My description","parent_event_id":null,"custom_attributes":{}}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `message` | string | Response message | | `data` | object | Response data | | `data.event_tags` | string | Response data | | `data.case_id` | number | Response data | | `data.event_in_summary` | boolean | Response data | | `data.modification_history` | object | Response data | | `data.event_date` | string | Response data | | `data.event_title` | string | Response data | | `data.custom_attributes` | object | Response data | | `data.user_id` | number | Response data | | `data.event_color` | string | Response data | | `data.event_added` | string | Response data | | `data.event_in_graph` | boolean | Response data | | `data.event_tz` | string | Response data | | `data.event_content` | string | Response data | | `data.event_source` | string | Response data | | `data.event_category_id` | number | Response data | | `data.event_uuid` | string | Response data | | `data.event_is_flagged` | boolean | Response data | | `data.event_raw` | string | Response data | | `data.event_date_wtz` | string | Response data | | `data.event_id` | number | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"status":"success","message":"Event added","data":{"event_tags":"tag","case_id":1,"event_in_summary":true,"modification_history":{},"event_date":"2023-03-08T03:02:00.000000","event_title":"An event","custom_attributes":{},"user_id":1,"event_color":"#1572E899","event_added":"2024-01-09T15:45:12.677273","event_in_graph":true,"event_tz":"+00:00","event_content":"My description","event_source":"My source","event_category_id":5}}}` ## Add a new ioc Create and add a new Indicator of Compromise (IOC) in IRIS by specifying type, TLP, value, description, tags, and collection ID. ### Endpoint - **URL:** `/case/ioc/add` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.cid` | number | Required | The Case ID to filter assets by. | | `ioc_type_id` | number | Optional | The ID of the IOC type to add. | | `ioc_tlp_id` | number | Optional | The ID of the TLP to assign to the IOC. | | `ioc_value` | string | Optional | The value of the IOC to add. | | `ioc_description` | string | Optional | A description for the IOC to add. | | `ioc_tags` | string | Optional | Tags to assign to the IOC, separated by commas. | | `custom_attributes` | object | Optional | Custom attributes to assign to the IOC. | ### Input Example `{"parameters":{"cid":1},"json_body":{"ioc_type_id":1,"ioc_tlp_id":2,"ioc_value":"8.8.8.8","ioc_description":"rewrw","ioc_tags":"","custom_attributes":{}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `message` | string | Response message | | `data` | object | Response data | | `data.ioc_description` | string | Response data | | `data.ioc_value` | string | Response data | | `data.ioc_type` | object | Response data | | `data.ioc_type.type_taxonomy` | object | Response data | | `data.ioc_type.type_name` | string | Response data | | `data.ioc_type.type_validation_regex` | object | Response data | | `data.ioc_type.type_description` | string | Response data | | `data.ioc_type.type_id` | number | Response data | | `data.ioc_type.type_validation_expect` | object | Response data | | `data.ioc_tags` | string | Response data | | `data.ioc_uuid` | string | Response data | | `data.ioc_enrichment` | object | Response data | | `data.ioc_id` | number | Response data | | `data.ioc_tlp_id` | number | Response data | | `data.user_id` | number | Response data | | `data.custom_attributes` | object | Response data | | `data.ioc_type_id` | number | Response data | | `data.ioc_misp` | object | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"status":"success","message":"IOC added","data":{"ioc_description":"rewrw","ioc_value":"8.8.8.8","ioc_type":{},"ioc_tags":"","ioc_uuid":"9c10461b-e5e3-4b39-9d00-c8aff798d4f9","ioc_enrichment":null,"ioc_id":3956,"ioc_tlp_id":2,"user_id":1,"custom_attributes":{},"ioc_type_id":1,"ioc_misp":null}}}` ## Add an evidence Add a new evidence file to an IRIS case by specifying the case ID and filename. ### Endpoint - **URL:** `/case/evidences/add` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------- | | `parameters.cid` | number | Required | The Case ID to add an evidence to. | | `filename` | string | Optional | The name of the file to add. | | `file_size` | string | Optional | The size of the file to add. | | `file_hash` | string | Optional | The hash of the file to add. | | `type_id` | string | Optional | The type ID of the file to add. | | `start_date` | string | Optional | The start date of the file to add. | | `end_date` | string | Optional | The end date of the file to add. | | `custom_attributes` | object | Optional | Custom attributes to add to the file. | | `file_description` | string | Optional | The description of the file to add. | ### Input Example `{"parameters":{"cid":1},"json_body":{"filename":"dummy file","file_size":"77108","file_hash":"88BC9EF6F07F0FAE922AB25EB226906542F8BA0DC1A221F3EA7273CBCB5DB0D4","type_id":"2","start_date":"2024-04-13T03:02:00.000","end_date":"2024-04-04T00:00:00.000","custom_attributes":{},"file_description":"Dummy description"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `message` | string | Response message | | `data` | object | Response data | | `data.chain_of_custody` | object | Response data | | `data.case_id` | number | Response data | | `data.type_id` | object | Response data | | `data.id` | number | Response data | | `data.file_hash` | string | Response data | | `data.filename` | string | Response data | | `data.start_date` | object | Response data | | `data.type` | object | Response data | | `data.acquisition_date` | object | Response data | | `data.case` | number | Response data | | `data.file_uuid` | string | Response data | | `data.user_id` | number | Response data | | `data.custom_attributes` | object | Response data | | `data.date_added` | string | Response data | | `data.user` | object | Response data | | `data.user.id` | number | Response data | | `data.user.user_name` | string | Response data | | `data.user.user_login` | string | Response data | | `data.user.user_email` | string | Response data | | `data.file_size` | number | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"status":"success","message":"Evidence added","data":{"chain_of_custody":null,"case_id":1,"type_id":null,"id":119,"file_hash":"string","filename":"string","start_date":null,"type":null,"acquisition_date":null,"case":1,"file_uuid":"2c322eb0-53be-45c7-b71c-ae5bc4c3bd0a","user_id":1,"custom_attributes":{},"date_added":"2024-01-11T07:39:11.211407","user":{}}}}` ## Delete a case evidence Remove a specific evidence item from an IRIS case using the evidence ID and case ID. ### Endpoint - **URL:** `/case/evidences/delete/{{evidence_id}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | --------------------------------------- | | `parameters.cid` | number | Required | The Case ID to delete an evidence from. | | `path_parameters.evidence_id` | number | Required | The ID of the evidence to delete. | ### Input Example `{"parameters":{"cid":1},"path_parameters":{"evidence_id":1}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `message` | string | Response message | | `status` | string | Status value | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"data":[{}],"message":"string","status":"string"}}` ## Delete an asset Remove an asset from IRIS using its asset ID and customer ID (cid) to ensure targeted deletion. ### Endpoint - **URL:** `/case/assets/delete/{{asset_id}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | -------------------------------- | | `parameters.cid` | number | Required | The Case ID to filter assets by. | | `path_parameters.asset_id` | string | Required | The ID of the asset to delete. | ### Input Example `{"parameters":{"cid":1},"path_parameters":{"asset_id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | object | Value for the parameter | | `value.data` | array | Response data | | `value.data.file_name` | string | Response data | | `value.data.file` | string | Response data | | `value.message` | string | Value for the parameter | | `value.status` | string | Status value | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"value":{"data":[],"message":"Deleted","status":"success"}}}` ## Delete an event Remove a specified event from the IRIS timeline using the event ID and customer ID. ### Endpoint - **URL:** `/case/timeline/events/delete/{{event_id}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------ | | `parameters.cid` | string | Required | The Case ID to delete an event from. | | `path_parameters.event_id` | number | Required | The ID of the event to delete. | ### Input Example `{"parameters":{"cid":"1"},"path_parameters":{"event_id":1}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.file_name` | string | Response data | | `data.file` | string | Response data | | `message` | string | Response message | | `status` | string | Status value | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"data":[],"message":"Event ID 14984 deleted","status":"success"}}` ## Delete an IOC Remove an indicator of compromise (IOC) from a specified case in IRIS using the IOC ID and case identifier. ### Endpoint - **URL:** `/case/ioc/delete/{{ioc_id}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------ | | `parameters.cid` | string | Required | The Case ID to filter IOCs by. | | `path_parameters.ioc_id` | number | Required | The ID of the IOC to delete. | ### Input Example `{"parameters":{"cid":"1"},"path_parameters":{"ioc_id":1}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `message` | string | Response message | | `data` | array | Response data | | `data.file_name` | string | Response data | | `data.file` | string | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"status":"success","message":"IOC 3956 deleted","data":[]}}` ## Fetch a note Fetch the content and metadata of a specific note in IRIS using the note ID and customer ID. ### Endpoint - **URL:** `/case/notes/{{note_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------- | | `parameters.cid` | number | Required | The Case ID to filter notes by. | | `path_parameters.note_id` | number | Required | The ID of the note to fetch. | ### Input Example `{"parameters":{"cid":1},"path_parameters":{"note_id":1}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `message` | string | Response message | | `data` | object | Response data | | `data.directory` | object | Response data | | `data.directory.id` | number | Response data | | `data.directory.name` | string | Response data | | `data.directory.parent_id` | object | Response data | | `data.directory.case_id` | number | Response data | | `data.note_id` | number | Response data | | `data.note_uuid` | string | Response data | | `data.note_title` | string | Response data | | `data.note_content` | string | Response data | | `data.note_user` | number | Response data | | `data.note_creationdate` | string | Response data | | `data.note_lastupdate` | string | Response data | | `data.note_case_id` | number | Response data | | `data.custom_attributes` | object | Response data | | `data.directory_id` | number | Response data | | `data.modification_history` | object | Response data | | `data.comments` | array | Response data | | `data.comments.file_name` | string | Response data | | `data.comments.file` | string | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"status":"success","message":"","data":{"directory":{},"note_id":1,"note_uuid":"b8391125-f446-40ec-b4cf-f610fefd0029","note_title":"New note","note_content":"Super note\n\n# hey hey","note_user":1,"note_creationdate":"2024-03-18T08:35:22.999299","note_lastupdate":"2024-03-18T08:35:22.999313","note_case_id":1,"custom_attributes":null,"directory_id":5,"modification_history":{},"comments":[]}}}` ## Fetch an asset Fetch detailed information for a specific asset in IRIS using the asset ID and customer ID. ### Endpoint - **URL:** `/case/assets/{{asset_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | -------------------------------- | | `parameters.cid` | string | Required | The Case ID to filter assets by. | | `path_parameters.asset_id` | number | Required | The ID of the asset to retrieve. | ### Input Example `{"parameters":{"cid":"1"},"path_parameters":{"asset_id":1}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `message` | string | Response message | | `data` | object | Response data | | `data.asset_enrichment` | object | Response data | | `data.asset_enrichment.Another enrichment provider` | object | Response data | | `data.asset_enrichment.Another enrichment provider.Another key` | string | Response data | | `data.asset_type` | object | Response data | | `data.asset_type.asset_icon_not_compromised` | string | Response data | | `data.asset_type.asset_icon_compromised` | string | Response data | | `data.asset_type.asset_description` | string | Response data | | `data.asset_type.asset_id` | number | Response data | | `data.asset_type.asset_name` | string | Response data | | `data.asset_type_id` | number | Response data | | `data.case_id` | number | Response data | | `data.asset_description` | string | Response data | | `data.asset_id` | number | Response data | | `data.analysis_status_id` | number | Response data | | `data.custom_attributes` | object | Response data | | `data.custom_attributes.Analysis` | object | Response data | | `data.custom_attributes.Analysis.Has been analyzed` | object | Response data | | `data.custom_attributes.Analysis.Has been analyzed.type` | string | Response data | | `data.custom_attributes.Analysis.Has been analyzed.mandatory` | boolean | Response data | | `data.custom_attributes.Analysis.Has been analyzed.value` | boolean | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"status":"success","message":"","data":{"asset_enrichment":{},"asset_type":{},"asset_type_id":15,"case_id":1,"asset_description":"Asset description","asset_id":2548,"analysis_status_id":1,"custom_attributes":{},"asset_info":"","user_id":4,"date_added":"2024-01-04T13:20:43.522581","date_update":"2024-01-04T13:20:43.522598","asset_name":"WAF-301","asset_ip":"1.1.1.1","asset_tags":"tag1,tag2"}}}` ## Fetch an event Retrieve detailed information for a specific event in the timeline using the event ID and customer ID. ### Endpoint - **URL:** `/case/timeline/events/{{event_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.cid` | number | Required | The Case ID to filter events by. | | `path_parameters.event_id` | number | Required | Parameters for the Fetch an event action | ### Input Example `{"parameters":{"cid":1},"path_parameters":{"event_id":1}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `message` | string | Response message | | `data` | object | Response data | | `data.event_tags` | string | Response data | | `data.case_id` | number | Response data | | `data.event_in_summary` | boolean | Response data | | `data.modification_history` | object | Response data | | `data.event_date` | string | Response data | | `data.event_title` | string | Response data | | `data.custom_attributes` | object | Response data | | `data.user_id` | number | Response data | | `data.event_color` | string | Response data | | `data.event_added` | string | Response data | | `data.event_in_graph` | boolean | Response data | | `data.event_tz` | string | Response data | | `data.event_content` | string | Response data | | `data.event_source` | string | Response data | | `data.event_uuid` | string | Response data | | `data.event_is_flagged` | boolean | Response data | | `data.event_raw` | string | Response data | | `data.event_date_wtz` | string | Response data | | `data.event_id` | number | Response data | | `data.event_assets` | array | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"status":"success","message":"","data":{"event_tags":"tag","case_id":1,"event_in_summary":true,"modification_history":{},"event_date":"2023-03-08T03:02:00.000000","event_title":"An event","custom_attributes":{},"user_id":1,"event_color":"#1572E899","event_added":"2024-01-09T15:47:18.257680","event_in_graph":true,"event_tz":"+00:00","event_content":"My description","event_source":"My source","event_uuid":"eedceb90-def7-4707-a478-5c5a218f0116"}}}` ## Fetch an ioc Fetch detailed information for a specific Indicator of Compromise (IOC) in IRIS using the provided IOC ID and customer ID. ### Endpoint - **URL:** `/case/ioc/{{ioc_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------ | | `parameters.cid` | string | Required | The Case ID to filter IOCs by. | | `path_parameters.ioc_id` | number | Required | The ID of the IOC to fetch. | ### Input Example `{"parameters":{"cid":"1"},"path_parameters":{"ioc_id":1}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | string | Status value | | `message` | string | Response message | | `data` | object | Response data | | `data.ioc_description` | string | Response data | | `data.ioc_value` | string | Response data | | `data.ioc_type` | object | Response data | | `data.ioc_type.type_taxonomy` | object | Response data | | `data.ioc_type.type_name` | string | Response data | | `data.ioc_type.type_validation_regex` | object | Response data | | `data.ioc_type.type_description` | string | Response data | | `data.ioc_type.type_id` | number | Response data | | `data.ioc_type.type_validation_expect` | object | Response data | | `data.ioc_tags` | string | Response data | | `data.ioc_uuid` | string | Response data | | `data.ioc_enrichment` | object | Response data | | `data.ioc_id` | number | Response data | | `data.ioc_tlp_id` | number | Response data | | `data.user_id` | number | Response data | | `data.custom_attributes` | object | Response data | | `data.ioc_type_id` | number | Response data | | `data.ioc_misp` | object | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"status":"success","message":"","data":{"ioc_description":"None","ioc_value":"s