DFIRe

Deletes an attachment.

Gets details of a specific attachment.

Lists attachments, optionally filtered by evidence item UUID.

Uploads a file as an attachment to a case or evidence item.

Generates a new CAN report for a case.

Lists CAN (Case Activity Notice) reports for a case.

Sends a chat message to the case AI assistant.

Creates a new case in DFIRe.

Deletes a case from DFIRe.

Triggers an AI-generated executive summary for a case.

Retrieves details of a specific case.

Looks up a case by its human-readable case number.

Adds an indicator to a case. Creates the indicator if it does not exist.

Lists indicators associated with a case.

Removes an indicator association from a case.

Finalizes the investigation report for a case.

Generates AI content for a single section of a case's investigation report. Returns preview content; does not auto-save.

Retrieves the investigation report for a case.

Marks a single section of the investigation report as ready for QA review.

Lists cases from DFIRe.

Creates a note on a case.

Lists notes for a case.

Moves a case to a new response phase in the timeline.

Marks a case SLA timer as complete.

Retrieves a single SLA timer.

Lists the SLA timers for a case.

Resets a case SLA timer.

Assigns a todo to a user.

Attaches a runbook to a todo.

Detaches the runbook from a todo.

Retrieves a single todo with full details.

Lists todos for a case.

Sets or replaces the note on a todo.

Lists available case types and their IDs.

Updates an existing case in DFIRe.

Updates the text of an AI-generated report attached to a case (e.g. an executive summary).

Lists user groups.

Lists ENISA incident categories (useful for picklists).

Lists configured incident-response phases.

Merges a list of tags into the indicator's existing tag set.

Bulk-updates classification for multiple indicators.

The bulk-update confidence for multiple indicators.

Bulk-deletes indicators.

Bulk-publishes indicators.

Bulk-revokes indicators.

Bulk adds/removes/sets tags on multiple indicators.

Bulk-updates TLP designation for multiple indicators.

Batch-checks whether IOCs already exist in the global registry.

Lists indicators that appear in multiple cases.

Creates a new indicator in the global IOC registry.

Auto-decomposes an indicator (URL→domain, email→domain, etc.).

Deletes an indicator from the global IOC registry.

Triggers external enrichment for an indicator.

Retrieves cached enrichment results for an indicator.

Retrieves details of a specific indicator.

Lists indicators from the global IOC registry.

Publishes an indicator (making it visible to TAXII consumers and STIX exports).

Revokes an indicator.

Unpublishes an indicator.

Unrevokes an indicator.

Updates an existing indicator.

Extracts candidate IOCs from a block of text. Returns suggestions only — does not add them to any case.

Creates a new evidence item on a case.

Lists available item flags and their IDs.

Retrieves details of a specific evidence item.

Lists evidence items, optionally filtered by case.

Resolves an 8-character item short ID to its full UUID and parent case ID.

Lists available evidence item types and their IDs.

Lists case outcome verdicts (true positive, false positive, etc.).

Lists projects.

Lists available runbooks (used for todo runbook attachments).

Searches across all DFIRe data (cases, indicators, notes, items). Supports AND, OR, NOT operators.

Adds a manual timeline event to a case.

Lists timeline events for a case (newest first).

Lists users in the DFIRe tenant. Useful for looking up user IDs for assignments.