DFIRe

Integration with DFIRe (Digital Forensics and Incident Response) platform for case management and IOC indicator tracking.

Forensics & Malware Analysis · DFIRe

Details

IDDFIRe
ProviderDFIRe
CategoryForensics & Malware Analysis
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658

README

DFIRe

DFIRe is a self-hosted Digital Forensics and Incident Response (DFIR) case management platform built for security professionals. It provides structured case management, evidence tracking with chain of custody, IOC indicator management, and incident response workflows aligned with the NIST Incident Response framework — all running on your own infrastructure with AES-256 encryption.

This integration connects Cortex XSIAM and Cortex XSOAR to a DFIRe instance, enabling automated case creation and updates, bi-directional IOC indicator synchronization, evidence item tracking, file attachment uploads, and timeline enrichment directly from playbooks.

Configure DFIRe in Cortex

Parameter Description Required
Server URL URL of your DFIRe instance (e.g. https://dfire.example.com). True
API Key Bearer API key (dfire_ak_...). Create under Settings > API Keys in DFIRe. True
Trust any certificate (not secure) Skip TLS verification for self-signed certs. False
Use system proxy settings Route requests through the configured proxy. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

dfire-search

Searches across all DFIRe data (cases, indicators, notes, items). Supports AND, OR, NOT operators.

Base Command

dfire-search

Input

Argument Name Description Required
query The search query (min 2 characters). Required

Context Output

Path Type Description
DFIRe.Search.id String The result ID.
DFIRe.Search.type String The result type (e.g. case, indicator, note).
DFIRe.Search.title String The result title.
DFIRe.Search.snippet String The matching text snippet.
DFIRe.Search.rank Number The search relevance rank.
DFIRe.Search.url String The URL to the result in DFIRe.
DFIRe.Search.date Date The result date.

dfire-case-type-list

Lists available case types and their IDs.

Base Command

dfire-case-type-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
DFIRe.CaseType.id Number The case type ID.
DFIRe.CaseType.name String The case type name.

dfire-case-list

Lists cases from DFIRe.

Base Command

dfire-case-list

Input

Argument Name Description Required
limit The maximum number of cases to return. Default is 50. Optional
page The page number for pagination. Optional
status The status by which to filter cases. Possible values are: OPEN, CLOSED, ARCHIVED. Optional
status_in A comma-separated list of statuses by which to filter cases, for example, “OPEN,CLOSED”. Optional
severity The severity by which to filter cases. Possible values are: critical, high, medium, low, info. Optional
case_mode The mode by which to filter cases. Possible values are: investigation, incident. Optional
lead_investigator The lead investigator user ID by which to filter cases. Optional
created_at_gte The ISO-8601 datetime on or after which to filter cases, for example, “2026-05-01T00:00:00Z”. Optional
created_at_lte The ISO-8601 datetime on or before which to filter cases. Optional
ordering The field by which to order results, for example, “created_at”, or “-created_at” for descending order. Optional

Context Output

Path Type Description
DFIRe.Case.id Number The case ID.
DFIRe.Case.title String The case title.
DFIRe.Case.case_number String The case number.
DFIRe.Case.status String The case status.
DFIRe.Case.severity String The case severity.
DFIRe.Case.case_mode String The case mode, investigation or incident.
DFIRe.Case.case_type_name String The case type name.
DFIRe.Case.lead_investigator Number The lead investigator user ID.
DFIRe.Case.created_at Date Case creation timestamp.

dfire-case-get

Retrieves details of a specific case.

Base Command

dfire-case-get

Input

Argument Name Description Required
case_id The ID of the case. Required

Context Output

Path Type Description
DFIRe.Case.id Number The case ID.
DFIRe.Case.title String The case title.
DFIRe.Case.case_number String The case number.
DFIRe.Case.description String The case description.
DFIRe.Case.notes String The high-level case notes.
DFIRe.Case.status String The case status.
DFIRe.Case.severity String The case severity.
DFIRe.Case.case_mode String The case mode, investigation or incident.
DFIRe.Case.case_type Number The case type ID.
DFIRe.Case.case_type_name String The case type name.
DFIRe.Case.external_id String The external reference ID.
DFIRe.Case.lead_investigator Number The lead investigator user ID.
DFIRe.Case.project_id Number The associated project ID.
DFIRe.Case.current_phase_name String The current case phase name.
DFIRe.Case.item_count Number The number of evidence items.
DFIRe.Case.indicator_count Number The number of indicators.
DFIRe.Case.created_at Date The case creation timestamp.
DFIRe.Case.closed_at Date The case closure timestamp.

dfire-case-create

Creates a new case in DFIRe.

Base Command

dfire-case-create

Input

Argument Name Description Required
title The case title. Required
case_type The case type ID. Required
description The case description. Optional
notes The high-level case summary or notes. Optional
severity The case severity. Possible values are: critical, high, medium, low, info. Optional
case_mode The case mode, investigation or incident. Possible values are: investigation, incident. Optional
lead_investigator The user ID of the lead investigator. Optional
investigators A comma-separated list of investigator user IDs. Optional
viewers A comma-separated list of viewer user IDs. Optional
investigator_ids A comma-separated list of investigator IDs (alternate write field). Optional
viewer_ids A comma-separated list of viewer IDs (alternate write field). Optional
incident_category The ENISA incident category ID. Optional
outcome_verdict The outcome verdict ID (true positive, false positive, etc.). Optional
external_id The external reference ID (e.g. ticket number). Optional
project_id The project ID to associate the case with. Optional
attributes The JSON string of custom attributes to attach to the case. Optional
create_slack_channel Whether to auto-create a Slack channel for this case. Defaults to false to avoid unintended channel creation from automated workflows. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
DFIRe.Case.id Number The ID of the created case.
DFIRe.Case.title String The title of the created case.
DFIRe.Case.case_number String The assigned case number.
DFIRe.Case.status String The case status.

dfire-case-update

Updates an existing case in DFIRe.

Base Command

dfire-case-update

Input

Argument Name Description Required
case_id The ID of the case to update. Required
title The new title for the case. Optional
description The new case description. Optional
notes The high-level case summary or notes. Optional
status The new case status. Possible values are: OPEN, CLOSED, ARCHIVED. Optional
severity The new case severity. Possible values are: critical, high, medium, low, info. Optional
case_mode The new case mode, investigation or incident. Possible values are: investigation, incident. Optional
lead_investigator The new case lead investigator user ID. Optional
investigators A comma-separated list of user IDs with which to replace the investigator list.. Optional
viewers A comma-separated list of user IDs with which to replace the viewer list. Optional
investigator_ids A comma-separated list of investigator IDs (alternate write field). Optional
viewer_ids A comma-separated list of viewer IDs (alternate write field). Optional
incident_category The ENISA incident category ID. Optional
outcome_verdict The outcome verdict ID. Optional
external_id The new external reference ID. Optional
attributes The JSON string of custom attributes to attach to the case. Optional

Context Output

Path Type Description
DFIRe.Case.id Number The case ID.
DFIRe.Case.title String The updated case title.
DFIRe.Case.status String The updated case status.

dfire-case-delete

Deletes a case from DFIRe.

Base Command

dfire-case-delete

Input

Argument Name Description Required
case_id The ID of the case to delete. Required

Context Output

There is no context output for this command.

dfire-case-note-list

Lists notes for a case.

Base Command

dfire-case-note-list

Input

Argument Name Description Required
case_id The case ID to list notes for. Required

Context Output

Path Type Description
DFIRe.CaseNote.id Number The note ID.
DFIRe.CaseNote.case Number The case ID.
DFIRe.CaseNote.note String The note content.
DFIRe.CaseNote.author_name String The note author.
DFIRe.CaseNote.created_at Date The note creation timestamp.

dfire-case-note-create

Creates a note on a case.

Base Command

dfire-case-note-create

Input

Argument Name Description Required
case_id The case ID to add the note to. Required
note The note content. Required
show_on_timeline Whether to show this note on the case timeline. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
DFIRe.CaseNote.id Number The created note ID.
DFIRe.CaseNote.case Number The case ID.
DFIRe.CaseNote.note String The note content.

dfire-indicator-list

Lists indicators from the global IOC registry.

Base Command

dfire-indicator-list

Input

Argument Name Description Required
limit The maximum number of indicators to return. Default is 50. Optional
offset The offset for pagination. Default is 0. Optional
search The search term by which to filter indicators. Optional
stix_type The STIX type by which to filter indicators. Possible values are: ipv4-addr, ipv6-addr, domain-name, url, email-addr, email-message, file, process, windows-registry-key, network-traffic, user-account, mac-addr, software, artifact, autonomous-system, directory, mutex, x509-certificate. Optional
classification The classification by which to filter indicators. Possible values are: unknown, benign, suspicious, malicious. Optional
confidence The confidence level by which to filter indicators. Possible values are: low, medium, high. Optional
tlp The TLP designation by which to filter indicators. Possible values are: clear, green, amber, amber_strict, red. Optional
is_published Whether to filter indicators by published status. Possible values are: true, false. Optional
is_revoked Whether to filter indicators by revoked status. Possible values are: true, false. Optional
parent The ID of the parent indicator by which to filter results to return its child indicators. Optional
ordering The field by which to order results, for example, “created_at”, or “-confidence” for descending order. Optional

Context Output

Path Type Description
DFIRe.Indicator.id Number The indicator ID.
DFIRe.Indicator.value String The IOC value.
DFIRe.Indicator.stix_type String The STIX 2.1 SCO type.
DFIRe.Indicator.classification String The indicator classification (unknown/benign/suspicious/malicious).
DFIRe.Indicator.confidence String The indicator confidence level.
DFIRe.Indicator.tlp String The indicator TLP designation.
DFIRe.Indicator.is_published Boolean Whether the indicator is published.
DFIRe.Indicator.is_revoked Boolean Whether the indicator is revoked.
DFIRe.Indicator.case_count Number The number of associated cases for the indicator.
DFIRe.Indicator.first_seen Date The indicator first seen timestamp.
DFIRe.Indicator.created_at Date The indicator creation timestamp.

dfire-indicator-get

Retrieves details of a specific indicator.

Base Command

dfire-indicator-get

Input

Argument Name Description Required
indicator_id The indicator ID. Required

Context Output

Path Type Description
DFIRe.Indicator.id Number The DFIRe indicator ID.
DFIRe.Indicator.value String The IOC value.
DFIRe.Indicator.value_normalized String The normalized IOC value.
DFIRe.Indicator.stix_type String The STIX 2.1 SCO type.
DFIRe.Indicator.classification String The indicator classification.
DFIRe.Indicator.confidence String The indicator confidence level.
DFIRe.Indicator.tlp String The indicator TLP designation.
DFIRe.Indicator.tags Unknown The tags assigned to the indicator.
DFIRe.Indicator.public_notes String The indicator public notes.
DFIRe.Indicator.is_published Boolean Whether the indicator is published.
DFIRe.Indicator.is_revoked Boolean Whether the indicator is revoked.
DFIRe.Indicator.parent Number The parent indicator ID.
DFIRe.Indicator.case_count Number The number of associated cases for the indicator.
DFIRe.Indicator.children_count Number The number of child indicators.
DFIRe.Indicator.first_seen Date The indicator first seen timestamp.
DFIRe.Indicator.last_seen Date The indicator last seen timestamp.
DFIRe.Indicator.created_at Date The indicator creation timestamp.

dfire-indicator-create

Creates a new indicator in the global IOC registry.

Base Command

dfire-indicator-create

Input

Argument Name Description Required
value The IOC value (IP, domain, hash, URL, etc.). Required
stix_type The STIX 2.1 SCO type. Possible values are: ipv4-addr, ipv6-addr, domain-name, url, email-addr, email-message, file, process, windows-registry-key, network-traffic, user-account, mac-addr, software, artifact, autonomous-system, directory, mutex, x509-certificate. Required
classification The indicator classification. Possible values are: unknown, benign, suspicious, malicious. Optional
confidence The indicator confidence level. Possible values are: low, medium, high. Optional
tlp The incidator TLP designation. Possible values are: clear, green, amber, amber_strict, red. Optional
tags A comma-separated list of indicator tags. Optional
public_notes The public notes about the indicator. Optional
valid_until The indicator auto-revoke date (ISO 8601). Optional

Context Output

Path Type Description
DFIRe.Indicator.id Number The created indicator ID.
DFIRe.Indicator.value String The indicator value.
DFIRe.Indicator.stix_type String The indicator STIX type.
DFIRe.Indicator.is_existing Boolean Whether the indicator already exists.

dfire-indicator-update

Updates an existing indicator.

Base Command

dfire-indicator-update

Input

Argument Name Description Required
indicator_id The indicator ID to update. Required
classification The new indicator classification. Possible values are: unknown, benign, suspicious, malicious. Optional
confidence The new indicator confidence level. Possible values are: low, medium, high. Optional
tlp The new indicator TLP designation. Possible values are: clear, green, amber, amber_strict, red. Optional
tags A comma-separated list of new indicator tags (replaces the existing). Optional
public_notes The new indicator public notes. Optional
valid_until The new indicator auto-revoke date (ISO 8601). Set it to empty to clear. Optional

Context Output

Path Type Description
DFIRe.Indicator.id Number The indicator ID.
DFIRe.Indicator.value String The IOC value.
DFIRe.Indicator.classification String The updated indicator classification.

dfire-indicator-delete

Deletes an indicator from the global IOC registry.

Base Command

dfire-indicator-delete

Input

Argument Name Description Required
indicator_id The indicator ID to delete. Required

Context Output

There is no context output for this command.

dfire-item-type-list

Lists available evidence item types and their IDs.

Base Command

dfire-item-type-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
DFIRe.ItemType.id Number The item type ID.
DFIRe.ItemType.name String The item type name.
DFIRe.ItemType.icon String The item type icon.

dfire-item-flag-list

Lists available item flags and their IDs.

Base Command

dfire-item-flag-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
DFIRe.ItemFlag.id Number The flag ID.
DFIRe.ItemFlag.name String The flag name.
DFIRe.ItemFlag.color String The flag color.
DFIRe.ItemFlag.description String The flag description.

dfire-item-list

Lists evidence items, optionally filtered by case.

Base Command

dfire-item-list

Input

Argument Name Description Required
case_id The case ID by which to filter evidence items. Optional

Context Output

Path Type Description
DFIRe.Item.uuid String The evidence item UUID.
DFIRe.Item.name String The evidence item name.
DFIRe.Item.display_title String The evidence item display title.
DFIRe.Item.item_type_name String The evidence item type name.
DFIRe.Item.case Number The evidence item associated case ID.
DFIRe.Item.location String The evidence item location.
DFIRe.Item.attachment_count Number The number of attachments to the evidence item.
DFIRe.Item.created_at Date The evidence item creation timestamp.

dfire-item-get

Retrieves details of a specific evidence item.

Base Command

dfire-item-get

Input

Argument Name Description Required
item_id The evidence item ID. Required

Context Output

Path Type Description
DFIRe.Item.uuid String The evidence item UUID.
DFIRe.Item.name String The evidence item name.
DFIRe.Item.display_title String The evidence item display title.
DFIRe.Item.item_type_name String The evidence item type name.
DFIRe.Item.case Number The evidence item associated case ID.
DFIRe.Item.location String The evidence item location.
DFIRe.Item.attachment_count Number The number of attachments for the evidence item.
DFIRe.Item.created_at Date The evidence item creation timestamp.

dfire-item-create

Creates a new evidence item on a case.

Base Command

dfire-item-create

Input

Argument Name Description Required
case_id The case ID to add the evidence item to. Required
item_type The evidence item type ID. Required
location The evidence item location (e.g. storage location, lab). Required
name The friendly name/label for the evidence item. Optional
owner_id The legal entity ID of the evidence item owner. Optional
primary_user_id The legal entity ID of the primary user. Optional
collected_by The user ID of the collector. Optional
parent_item The UUID of the parent evidence item. Optional

Context Output

Path Type Description
DFIRe.Item.uuid String The created evidence item UUID.
DFIRe.Item.name String The evidence item name.
DFIRe.Item.case Number The case ID.

dfire-attachment-list

Lists attachments, optionally filtered by evidence item UUID.

Base Command

dfire-attachment-list

Input

Argument Name Description Required
item_uuid The evidence item UUID by which to filter attachments. Optional

Context Output

Path Type Description
DFIRe.Attachment.id Number The attachment ID.
DFIRe.Attachment.filename String The attachment filename.
DFIRe.Attachment.mime_type String The attachment MIME type.
DFIRe.Attachment.size Number The attachment file size in bytes.
DFIRe.Attachment.category String The attachment category.
DFIRe.Attachment.case Number The attachment associated case ID.
DFIRe.Attachment.item String The attachment associated evidence item UUID.
DFIRe.Attachment.hash_sha256 String The SHA-256 hash of the plaintext file attachment.
DFIRe.Attachment.uploaded_by_name String Who uploaded the file attachment.
DFIRe.Attachment.uploaded_at Date The attachment upload timestamp.

dfire-attachment-get

Gets details of a specific attachment.

Base Command

dfire-attachment-get

Input

Argument Name Description Required
attachment_id The attachment ID. Required

Context Output

Path Type Description
DFIRe.Attachment.id Number The DFIRe attachment ID.
DFIRe.Attachment.filename String The attachment filename.
DFIRe.Attachment.mime_type String The attachment MIME type.
DFIRe.Attachment.size Number The attachment file size in bytes.
DFIRe.Attachment.category String The attachment category.
DFIRe.Attachment.description String The attachment user-provided description.
DFIRe.Attachment.hash_sha256 String The SHA-256 hash of the plaintext file attachment.
DFIRe.Attachment.status String The attachment upload/encryption status.
DFIRe.Attachment.storage_location String The attachment storage location (local, s3, smb).
DFIRe.Attachment.uploaded_at Date The attachment upload timestamp.

dfire-attachment-upload

Uploads a file as an attachment to a case or evidence item.

Base Command

dfire-attachment-upload

Input

Argument Name Description Required
entry_id The War Room entry ID of the file to upload. Required
case_id The case ID to associate the attachment with. Optional
item_uuid The evidence item UUID to associate the attachment with. Optional
filename The name with which to override the filename. (default is the uploaded file name). Optional
category The attachment category. general routes to the encrypted file store and is relevant for most playbooks. evidence is reserved for evidence photos and routes to the image gallery, not the file store. Possible values are: general, evidence. Default is general. Optional

Context Output

Path Type Description
DFIRe.Attachment.id Number The created attachment ID.
DFIRe.Attachment.filename String The attachment filename.
DFIRe.Attachment.size Number The attachment file size in bytes.

dfire-attachment-delete

Deletes an attachment.

Base Command

dfire-attachment-delete

Input

Argument Name Description Required
attachment_id The attachment ID to delete. Required

Context Output

There is no context output for this command.

dfire-timeline-list

Lists timeline events for a case (newest first).

Base Command

dfire-timeline-list

Input

Argument Name Description Required
case_id The case ID. Required

Context Output

Path Type Description
DFIRe.TimelineEvent.id Number The timeline event ID.
DFIRe.TimelineEvent.event_type String The timeline event type.
DFIRe.TimelineEvent.subject String The timeline event subject.
DFIRe.TimelineEvent.details String The timeline event details.
DFIRe.TimelineEvent.event_datetime Date When the timeline event occurred.
DFIRe.TimelineEvent.created_by_name String Who created the timeline event.

dfire-timeline-create

Adds a manual timeline event to a case.

Base Command

dfire-timeline-create

Input

Argument Name Description Required
case_id The case ID. Required
subject The timeline event subject line. Required
details The timeline event description. Optional
event_datetime When the timeline event occurred (ISO 8601). Default is now. Optional

Context Output

Path Type Description
DFIRe.TimelineEvent.id Number The created timeline event ID.
DFIRe.TimelineEvent.subject String The timeline event subject.
DFIRe.TimelineEvent.event_datetime Date The timeline event timestamp.

dfire-user-list

Lists users in the DFIRe tenant. Useful for looking up user IDs for assignments.

Base Command

dfire-user-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
DFIRe.User.id Number The DFIRe user ID.
DFIRe.User.username String The DFIRe username.
DFIRe.User.full_name String The DFIRe user’s full name.
DFIRe.User.email String The DFIRe user’s email.
DFIRe.User.is_active Boolean Whether the DFIRe user is active.
DFIRe.User.groups Unknown Groups the DFIRe user belongs to.

dfire-case-indicator-list

Lists indicators associated with a case.

Base Command

dfire-case-indicator-list

Input

Argument Name Description Required
case_id The case ID. Required

Context Output

Path Type Description
DFIRe.CaseIndicator.id Number The association ID.
DFIRe.CaseIndicator.case Number The case ID.
DFIRe.CaseIndicator.indicator.id Number The indicator ID.
DFIRe.CaseIndicator.indicator.value String The indicator value.
DFIRe.CaseIndicator.indicator.stix_type String The indicator STIX type.
DFIRe.CaseIndicator.context String The case private notes about the associated indicator.
DFIRe.CaseIndicator.source String How the associated indicator was added.
DFIRe.CaseIndicator.created_at Date The association timestamp.
DFIRe.CaseIndicator.case_count Number The number of cases this indicator appears in.

dfire-case-indicator-add

Adds an indicator to a case. Creates the indicator if it does not exist.

Base Command

dfire-case-indicator-add

Input

Argument Name Description Required
case_id The case ID. Required
value The indicator value. Required
stix_type The indicator STIX 2.1 SCO type. Possible values are: ipv4-addr, ipv6-addr, domain-name, url, email-addr, email-message, file, process, windows-registry-key, network-traffic, user-account, mac-addr, software, artifact, autonomous-system, directory, mutex, x509-certificate. Required
classification The indicator classification. Possible values are: unknown, benign, suspicious, malicious. Default is unknown. Optional
confidence The indicator confidence level. Possible values are: low, medium, high. Default is low. Optional
tlp The indicator TLP designation. Possible values are: clear, green, amber, amber_strict, red. Default is amber. Optional
context The case private notes about the indicator. Optional
tags A comma-separated list of indicator tags. Optional
source The source from which the indicator was obtained. Possible values are: manual, automated, threat_intel, sandbox, enrichment, import. Optional
source_reference The free-form reference identifying the source (URL, ticket, report name, etc.). Optional
valid_until The ISO-8601 datetime after which to automatically invalidate the indicator, for example, “2026-12-31T00:00:00Z”. Optional
decompose Whether to auto-decompose the indicator (URL→domain, email→domain). Possible values are: true, false. Default is true. Optional
publish Whether to publish the indicator immediately after creation. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
DFIRe.CaseIndicator.id Number The association ID.
DFIRe.CaseIndicator.indicator.id Number The indicator ID.
DFIRe.CaseIndicator.indicator.value String The indicator value.

dfire-case-indicator-remove

Removes an indicator association from a case.

Base Command

dfire-case-indicator-remove

Input

Argument Name Description Required
case_id The case ID. Required
association_id The case indicator association ID. Required

Context Output

There is no context output for this command.

dfire-ioc-extract

Extracts candidate IOCs from a block of text. Returns suggestions only — does not add them to any case.

Base Command

dfire-ioc-extract

Input

Argument Name Description Required
text The text to scan to extract indicators from. Required

Context Output

Path Type Description
DFIRe.IOCExtraction.candidates Unknown The list of extracted indicator candidates.

dfire-indicator-check

Batch-checks whether IOCs already exist in the global registry.

Base Command

dfire-indicator-check

Input

Argument Name Description Required
indicators The JSON array of {value, stix_type} objects (mutually exclusive with values+stix_type). Optional
values A comma-separated indicator values to check (used with stix_type). Optional
stix_type The STIX type to use when checking the values argument. Possible values are: ipv4-addr, ipv6-addr, domain-name, url, email-addr, email-message, file, process, windows-registry-key, network-traffic, user-account, mac-addr, software, artifact, autonomous-system, directory, mutex, x509-certificate. Optional

Context Output

Path Type Description
DFIRe.IndicatorCheck.results Unknown The status and details of each submitted indicator.

dfire-indicator-enrich

Triggers external enrichment for an indicator.

Base Command

dfire-indicator-enrich

Input

Argument Name Description Required
indicator_id The indicator ID. Required
providers A comma-separated list of provider names (omit this to run all providers). Optional
force Whether to re-enrich even if cached results exist. Possible values are: true, false. Optional

Context Output

Path Type Description
DFIRe.Indicator.id Number The indicator ID.

dfire-indicator-enrichment-list

Retrieves cached enrichment results for an indicator.

Base Command

dfire-indicator-enrichment-list

Input

Argument Name Description Required
indicator_id The indicator ID. Required

Context Output

Path Type Description
DFIRe.Enrichment.enrichments Unknown The enrichment records.

dfire-indicator-publish

Publishes an indicator (making it visible to TAXII consumers and STIX exports).

Base Command

dfire-indicator-publish

Input

Argument Name Description Required
indicator_id The indicator ID. Required

Context Output

Path Type Description
DFIRe.Indicator.id Number The DFIRe indicator ID.
DFIRe.Indicator.is_published Boolean Whether the indicator is published.

dfire-indicator-unpublish

Unpublishes an indicator.

Base Command

dfire-indicator-unpublish

Input

Argument Name Description Required
indicator_id The indicator ID. Required

Context Output

Path Type Description
DFIRe.Indicator.id Number The DFIRe indicator ID.
DFIRe.Indicator.is_published Boolean Whether the indicator is published.

dfire-indicator-revoke

Revokes an indicator.

Base Command

dfire-indicator-revoke

Input

Argument Name Description Required
indicator_id The indicator ID. Required

Context Output

Path Type Description
DFIRe.Indicator.id Number The DFIRe indicator ID.
DFIRe.Indicator.is_revoked Boolean Whether the indicator is revoked.

dfire-indicator-unrevoke

Unrevokes an indicator.

Base Command

dfire-indicator-unrevoke

Input

Argument Name Description Required
indicator_id The indicator ID. Required

Context Output

Path Type Description
DFIRe.Indicator.id Number The DFIRe indicator ID.
DFIRe.Indicator.is_revoked Boolean Whether the indicator is revoked.

dfire-indicator-decompose

Auto-decomposes an indicator (URL→domain, email→domain, etc.).

Base Command

dfire-indicator-decompose

Input

Argument Name Description Required
indicator_id The indicator ID. Required

Context Output

Path Type Description
DFIRe.Indicator.id Number The DFIRe indicator ID.

dfire-indicator-add-tags

Merges a list of tags into the indicator’s existing tag set.

Base Command

dfire-indicator-add-tags

Input

Argument Name Description Required
indicator_id The indicator ID. Required
tags A comma-separated list of tags to add. Required

Context Output

Path Type Description
DFIRe.Indicator.id Number The DFIRe indicator ID.
DFIRe.Indicator.tags Unknown The updated tag list.

dfire-indicator-correlated-list

Lists indicators that appear in multiple cases.

Base Command

dfire-indicator-correlated-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
DFIRe.IndicatorCorrelated.results Unknown The indicators correlated across cases.

dfire-indicator-bulk-classify

Bulk-updates classification for multiple indicators.

Base Command

dfire-indicator-bulk-classify

Input

Argument Name Description Required
indicator_ids A comma-separated list of indicator IDs. Required
classification The new indicator classification. Possible values are: unknown, benign, suspicious, malicious. Required

Context Output

Path Type Description
DFIRe.BulkResult Unknown The bulk operation result.

dfire-indicator-bulk-confidence

The bulk-update confidence for multiple indicators.

Base Command

dfire-indicator-bulk-confidence

Input

Argument Name Description Required
indicator_ids A comma-separated list of indicator IDs. Required
confidence The new indicator confidence level. Possible values are: low, medium, high. Required

Context Output

Path Type Description
DFIRe.BulkResult Unknown The bulk operation result.

dfire-indicator-bulk-tag

Bulk adds/removes/sets tags on multiple indicators.

Base Command

dfire-indicator-bulk-tag

Input

Argument Name Description Required
indicator_ids A comma-separated list of indicator IDs. Required
tags A comma-separated list of indicator tags. Required
mode The action to perform on the tags (add, remove, set). Possible values are: add, remove, set. Default is add. Optional

Context Output

Path Type Description
DFIRe.BulkResult Unknown The bulk operation result.

dfire-indicator-bulk-tlp

Bulk-updates TLP designation for multiple indicators.

Base Command

dfire-indicator-bulk-tlp

Input

Argument Name Description Required
indicator_ids A comma-separated list of indicator IDs. Required
tlp The new indicator TLP designation. Possible values are: clear, green, amber, amber_strict, red. Required

Context Output

Path Type Description
DFIRe.BulkResult Unknown The bulk operation result.

dfire-indicator-bulk-publish

Bulk-publishes indicators.

Base Command

dfire-indicator-bulk-publish

Input

Argument Name Description Required
indicator_ids A comma-separated list of indicator IDs. Required

Context Output

Path Type Description
DFIRe.BulkPublishResponse.published_count Number The number of indicators published.
DFIRe.BulkPublishResponse.skipped_revoked Number The number of indicators skipped because they were revoked.
DFIRe.BulkPublishResponse.skipped_red Number The number of indicators skipped because of TLP status RED.

dfire-indicator-bulk-revoke

Bulk-revokes indicators.

Base Command

dfire-indicator-bulk-revoke

Input

Argument Name Description Required
indicator_ids A comma-separated list of indicator IDs. Required

Context Output

Path Type Description
DFIRe.BulkResult Unknown The bulk operation result.

dfire-indicator-bulk-delete

Bulk-deletes indicators.

Base Command

dfire-indicator-bulk-delete

Input

Argument Name Description Required
indicator_ids A comma-separated list of indicator IDs. Required

Context Output

Path Type Description
DFIRe.BulkResult Unknown The bulk operation result.

dfire-case-generate-summary

Triggers an AI-generated executive summary for a case.

Base Command

dfire-case-generate-summary

Input

Argument Name Description Required
case_id The case ID. Required

Context Output

Path Type Description
DFIRe.CaseSummary Unknown The summary result.

dfire-case-chat

Sends a chat message to the case AI assistant.

Base Command

dfire-case-chat

Input

Argument Name Description Required
case_id The case ID. Required
message The user message to send. Required

Context Output

Path Type Description
DFIRe.CaseChat Unknown The chat response.

dfire-case-update-report

Updates the text of an AI-generated report attached to a case (e.g. an executive summary).

Base Command

dfire-case-update-report

Input

Argument Name Description Required
case_id The case ID the report belongs to. Required
report_id The ID of the generated report to update. Required
report_text The new report text content. Required

Context Output

Path Type Description
DFIRe.CaseReport Unknown The updated report.

dfire-case-can-report-list

Lists CAN (Case Activity Notice) reports for a case.

Base Command

dfire-case-can-report-list

Input

Argument Name Description Required
case_id The case ID. Required

Context Output

Path Type Description
DFIRe.CANReport.id Number The CAN report ID.

dfire-case-can-report-generate

Generates a new CAN report for a case.

Base Command

dfire-case-can-report-generate

Input

Argument Name Description Required
case_id The case ID. Required
body The optional JSON body describing the report parameters. Optional

Context Output

Path Type Description
DFIRe.CANReport.id Number The generated report ID.

dfire-case-investigation-report-get

Retrieves the investigation report for a case.

Base Command

dfire-case-investigation-report-get

Input

Argument Name Description Required
case_id The case ID. Required

Context Output

Path Type Description
DFIRe.InvestigationReport Unknown The investigation report.

dfire-case-investigation-report-generate

Generates AI content for a single section of a case’s investigation report. Returns preview content; does not auto-save.

Base Command

dfire-case-investigation-report-generate

Input

Argument Name Description Required
case_id The case ID. Required
section_id The ID of the report section to generate content for. Required

Context Output

Path Type Description
DFIRe.InvestigationReport.content String The generated section content.
DFIRe.InvestigationReport.model String The model used to generate the content.

dfire-case-investigation-report-finalize

Finalizes the investigation report for a case.

Base Command

dfire-case-investigation-report-finalize

Input

Argument Name Description Required
case_id The case ID. Required

Context Output

Path Type Description
DFIRe.InvestigationReport Unknown The finalized investigation report.

dfire-case-investigation-report-ready-for-qa

Marks a single section of the investigation report as ready for QA review.

Base Command

dfire-case-investigation-report-ready-for-qa

Input

Argument Name Description Required
case_id The case ID. Required
section_id The ID of the report section to mark ready for QA. Required

Context Output

Path Type Description
DFIRe.InvestigationReport Unknown The investigation report section after the state change.

dfire-case-timeline-change-phase

Moves a case to a new response phase in the timeline.

Base Command

dfire-case-timeline-change-phase

Input

Argument Name Description Required
case_id The case ID. Required
phase_id The target phase ID. Optional
phase_name The target phase name (used if phase_id is omitted). Optional
note The optional note explaining the phase change. Optional

Context Output

Path Type Description
DFIRe.TimelineEvent.id Number The created phase change timeline event ID.

dfire-case-todo-list

Lists todos for a case.

Base Command

dfire-case-todo-list

Input

Argument Name Description Required
case_id The case ID. Required

Context Output

Path Type Description
DFIRe.CaseTodo.id Number The todo ID.
DFIRe.CaseTodo.title String The todo title.
DFIRe.CaseTodo.status String The todo status.

dfire-case-todo-get

Retrieves a single todo with full details.

Base Command

dfire-case-todo-get

Input

Argument Name Description Required
case_id The case ID. Required
todo_id The todo ID. Required

Context Output

Path Type Description
DFIRe.CaseTodo.id Number The todo ID.

dfire-case-todo-assign

Assigns a todo to a user.

Base Command

dfire-case-todo-assign

Input

Argument Name Description Required
case_id The case ID. Required
todo_id The todo ID. Required
user_id The user ID of the assignee. Optional

Context Output

Path Type Description
DFIRe.CaseTodo.id Number The todo ID.
DFIRe.CaseTodo.assignee_name String The assignee display name.

dfire-case-todo-note-set

Sets or replaces the note on a todo.

Base Command

dfire-case-todo-note-set

Input

Argument Name Description Required
case_id The case ID. Required
todo_id The todo ID. Required
note The new note content. Required

Context Output

Path Type Description
DFIRe.CaseTodo.id Number The todo ID.

dfire-case-todo-attach-runbook

Attaches a runbook to a todo.

Base Command

dfire-case-todo-attach-runbook

Input

Argument Name Description Required
case_id The case ID. Required
todo_id The todo ID. Required
runbook_slug The runbook slug to attach. Required

Context Output

Path Type Description
DFIRe.CaseTodo.id Number The todo ID.
DFIRe.CaseTodo.runbook_slug String The attached runbook slug.

dfire-case-todo-detach-runbook

Detaches the runbook from a todo.

Base Command

dfire-case-todo-detach-runbook

Input

Argument Name Description Required
case_id The case ID. Required
todo_id The todo ID. Required

Context Output

Path Type Description
DFIRe.CaseTodo.id Number The todo ID.

dfire-case-timer-list

Lists the SLA timers for a case.

Base Command

dfire-case-timer-list

Input

Argument Name Description Required
case_id The case ID. Required

Context Output

Path Type Description
DFIRe.CaseTimer.id Number The timer ID.
DFIRe.CaseTimer.name String The timer name.
DFIRe.CaseTimer.framework String The compliance framework.

dfire-case-timer-get

Retrieves a single SLA timer.

Base Command

dfire-case-timer-get

Input

Argument Name Description Required
case_id The case ID. Required
timer_id The timer ID. Required

Context Output

Path Type Description
DFIRe.CaseTimer.id Number The timer ID.

dfire-case-timer-complete

Marks a case SLA timer as complete.

Base Command

dfire-case-timer-complete

Input

Argument Name Description Required
case_id The case ID. Required
timer_id The timer ID. Required

Context Output

Path Type Description
DFIRe.CaseTimer.id Number The timer ID.

dfire-case-timer-reset

Resets a case SLA timer.

Base Command

dfire-case-timer-reset

Input

Argument Name Description Required
case_id The case ID. Required
timer_id The timer ID. Required

Context Output

Path Type Description
DFIRe.CaseTimer.id Number The timer ID.

dfire-case-get-by-number

Looks up a case by its human-readable case number.

Base Command

dfire-case-get-by-number

Input

Argument Name Description Required
case_number The case number (e.g. “CASE-2026-0001”). Required

Context Output

Path Type Description
DFIRe.Case.id Number The case ID.
DFIRe.Case.case_number String The case number.

dfire-item-resolve-short-id

Resolves an 8-character item short ID to its full UUID and parent case ID.

Base Command

dfire-item-resolve-short-id

Input

Argument Name Description Required
short_id The first 8 characters of the item UUID. Required

Context Output

Path Type Description
DFIRe.Item.uuid String The full item UUID.
DFIRe.Item.case Number The parent case ID.

dfire-incident-category-list

Lists ENISA incident categories (useful for picklists).

Base Command

dfire-incident-category-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
DFIRe.IncidentCategory.id Number The category ID.
DFIRe.IncidentCategory.name String The category name.

dfire-incident-phase-list

Lists configured incident-response phases.

Base Command

dfire-incident-phase-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
DFIRe.IncidentPhase.id Number The phase ID.
DFIRe.IncidentPhase.name String The phase name.

dfire-outcome-verdict-list

Lists case outcome verdicts (true positive, false positive, etc.).

Base Command

dfire-outcome-verdict-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
DFIRe.OutcomeVerdict.id Number The verdict ID.
DFIRe.OutcomeVerdict.name String The verdict name.

dfire-project-list

Lists projects.

Base Command

dfire-project-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
DFIRe.Project.id Number The project ID.
DFIRe.Project.name String The project name.

dfire-runbook-list

Lists available runbooks (used for todo runbook attachments).

Base Command

dfire-runbook-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
DFIRe.Runbook.slug String The runbook slug.
DFIRe.Runbook.name String The runbook name.

dfire-group-list

Lists user groups.

Base Command

dfire-group-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
DFIRe.Group.id Number The user group ID.
DFIRe.Group.name String The user group name.

Configuration parameters

  • url — Server URL (required)
  • apikey — API Key (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (75)

  • dfire-attachment-delete

    Deletes an attachment.

  • dfire-attachment-get

    Gets details of a specific attachment.

  • dfire-attachment-list

    Lists attachments, optionally filtered by evidence item UUID.

  • dfire-attachment-upload

    Uploads a file as an attachment to a case or evidence item.

  • dfire-case-can-report-generate

    Generates a new CAN report for a case.

  • dfire-case-can-report-list

    Lists CAN (Case Activity Notice) reports for a case.

  • dfire-case-chat

    Sends a chat message to the case AI assistant.

  • dfire-case-create

    Creates a new case in DFIRe.

  • dfire-case-delete

    Deletes a case from DFIRe.

  • dfire-case-generate-summary

    Triggers an AI-generated executive summary for a case.

  • dfire-case-get

    Retrieves details of a specific case.

  • dfire-case-get-by-number

    Looks up a case by its human-readable case number.

  • dfire-case-indicator-add

    Adds an indicator to a case. Creates the indicator if it does not exist.

  • dfire-case-indicator-list

    Lists indicators associated with a case.

  • dfire-case-indicator-remove

    Removes an indicator association from a case.

  • dfire-case-investigation-report-finalize

    Finalizes the investigation report for a case.

  • dfire-case-investigation-report-generate

    Generates AI content for a single section of a case's investigation report. Returns preview content; does not auto-save.

  • dfire-case-investigation-report-get

    Retrieves the investigation report for a case.

  • dfire-case-investigation-report-ready-for-qa

    Marks a single section of the investigation report as ready for QA review.

  • dfire-case-list

    Lists cases from DFIRe.

  • dfire-case-note-create

    Creates a note on a case.

  • dfire-case-note-list

    Lists notes for a case.

  • dfire-case-timeline-change-phase

    Moves a case to a new response phase in the timeline.

  • dfire-case-timer-complete

    Marks a case SLA timer as complete.

  • dfire-case-timer-get

    Retrieves a single SLA timer.

  • dfire-case-timer-list

    Lists the SLA timers for a case.

  • dfire-case-timer-reset

    Resets a case SLA timer.

  • dfire-case-todo-assign

    Assigns a todo to a user.

  • dfire-case-todo-attach-runbook

    Attaches a runbook to a todo.

  • dfire-case-todo-detach-runbook

    Detaches the runbook from a todo.

  • dfire-case-todo-get

    Retrieves a single todo with full details.

  • dfire-case-todo-list

    Lists todos for a case.

  • dfire-case-todo-note-set

    Sets or replaces the note on a todo.

  • dfire-case-type-list

    Lists available case types and their IDs.

  • dfire-case-update

    Updates an existing case in DFIRe.

  • dfire-case-update-report

    Updates the text of an AI-generated report attached to a case (e.g. an executive summary).

  • dfire-group-list

    Lists user groups.

  • dfire-incident-category-list

    Lists ENISA incident categories (useful for picklists).

  • dfire-incident-phase-list

    Lists configured incident-response phases.

  • dfire-indicator-add-tags

    Merges a list of tags into the indicator's existing tag set.

  • dfire-indicator-bulk-classify

    Bulk-updates classification for multiple indicators.

  • dfire-indicator-bulk-confidence

    The bulk-update confidence for multiple indicators.

  • dfire-indicator-bulk-delete

    Bulk-deletes indicators.

  • dfire-indicator-bulk-publish

    Bulk-publishes indicators.

  • dfire-indicator-bulk-revoke

    Bulk-revokes indicators.

  • dfire-indicator-bulk-tag

    Bulk adds/removes/sets tags on multiple indicators.

  • dfire-indicator-bulk-tlp

    Bulk-updates TLP designation for multiple indicators.

  • dfire-indicator-check

    Batch-checks whether IOCs already exist in the global registry.

  • dfire-indicator-correlated-list

    Lists indicators that appear in multiple cases.

  • dfire-indicator-create

    Creates a new indicator in the global IOC registry.

  • dfire-indicator-decompose

    Auto-decomposes an indicator (URL→domain, email→domain, etc.).

  • dfire-indicator-delete

    Deletes an indicator from the global IOC registry.

  • dfire-indicator-enrich

    Triggers external enrichment for an indicator.

  • dfire-indicator-enrichment-list

    Retrieves cached enrichment results for an indicator.

  • dfire-indicator-get

    Retrieves details of a specific indicator.

  • dfire-indicator-list

    Lists indicators from the global IOC registry.

  • dfire-indicator-publish

    Publishes an indicator (making it visible to TAXII consumers and STIX exports).

  • dfire-indicator-revoke

    Revokes an indicator.

  • dfire-indicator-unpublish

    Unpublishes an indicator.

  • dfire-indicator-unrevoke

    Unrevokes an indicator.

  • dfire-indicator-update

    Updates an existing indicator.

  • dfire-ioc-extract

    Extracts candidate IOCs from a block of text. Returns suggestions only — does not add them to any case.

  • dfire-item-create

    Creates a new evidence item on a case.

  • dfire-item-flag-list

    Lists available item flags and their IDs.

  • dfire-item-get

    Retrieves details of a specific evidence item.

  • dfire-item-list

    Lists evidence items, optionally filtered by case.

  • dfire-item-resolve-short-id

    Resolves an 8-character item short ID to its full UUID and parent case ID.

  • dfire-item-type-list

    Lists available evidence item types and their IDs.

  • dfire-outcome-verdict-list

    Lists case outcome verdicts (true positive, false positive, etc.).

  • dfire-project-list

    Lists projects.

  • dfire-runbook-list

    Lists available runbooks (used for todo runbook attachments).

  • dfire-search

    Searches across all DFIRe data (cases, indicators, notes, items). Supports AND, OR, NOT operators.

  • dfire-timeline-create

    Adds a manual timeline event to a case.

  • dfire-timeline-list

    Lists timeline events for a case (newest first).

  • dfire-user-list

    Lists users in the DFIRe tenant. Useful for looking up user IDs for assignments.

Source

DFIRe.py DFIRe_test.py DFIRe.yml
Download History Raw 
commonfields:
  id: DFIRe
  version: -1
name: DFIRe
display: DFIRe
category: Forensics & Malware Analysis
provider: DFIRe
sectionorder:
- Connect
- Collect
description: Integration with DFIRe (Digital Forensics and Incident Response) platform for case management and IOC indicator tracking.
configuration:
- name: url
  display: Server URL
  type: 0
  required: true
  defaultvalue: https://your-dfire-instance.example.com
  section: Connect
- name: apikey
  display: API Key
  type: 9
  required: true
  displaypassword: API Key
  hiddenusername: true
  additionalinfo: Bearer API key (dfire_ak_...). Create under Settings > API Keys.
  section: Connect
- name: proxy
  display: Use system proxy settings
  type: 8
  required: false
  advanced: true
  section: Connect
- name: insecure
  display: Trust any certificate (not secure)
  type: 8
  required: false
  advanced: true
  section: Connect
script:
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  feed: false
  commands:
  - name: dfire-search
    description: Searches across all DFIRe data (cases, indicators, notes, items). Supports AND, OR, NOT operators.
    arguments:
    - name: query
      description: The search query (min 2 characters).
      required: true
    outputs:
    - contextPath: DFIRe.Search.id
      description: The result ID.
      type: String
    - contextPath: DFIRe.Search.type
      description: The result type (e.g. case, indicator, note).
      type: String
    - contextPath: DFIRe.Search.title
      description: The result title.
      type: String
    - contextPath: DFIRe.Search.snippet
      description: The matching text snippet.
      type: String
    - contextPath: DFIRe.Search.rank
      description: The search relevance rank.
      type: Number
    - contextPath: DFIRe.Search.url
      description: The URL to the result in DFIRe.
      type: String
    - contextPath: DFIRe.Search.date
      description: The result date.
      type: Date
  - name: dfire-case-type-list
    description: Lists available case types and their IDs.
    arguments: []
    outputs:
    - contextPath: DFIRe.CaseType.id
      description: The case type ID.
      type: Number
    - contextPath: DFIRe.CaseType.name
      description: The case type name.
      type: String
  - name: dfire-case-list
    description: Lists cases from DFIRe.
    arguments:
    - name: limit
      description: The maximum number of cases to return.
      defaultValue: '50'
    - name: page
      description: The page number for pagination.
    - name: status
      description: The status by which to filter cases.
      predefined:
      - OPEN
      - CLOSED
      - ARCHIVED
    - name: status_in
      description: A comma-separated list of statuses by which to filter cases, for example, "OPEN,CLOSED".
    - name: severity
      description: The severity by which to filter cases.
      predefined:
      - critical
      - high
      - medium
      - low
      - info
    - name: case_mode
      description: The mode by which to filter cases.
      predefined:
      - investigation
      - incident
    - name: lead_investigator
      description: The lead investigator user ID by which to filter cases.
    - name: created_at_gte
      description: The ISO-8601 datetime on or after which to filter cases, for example, "2026-05-01T00:00:00Z".
    - name: created_at_lte
      description: The ISO-8601 datetime on or before which to filter cases.
    - name: ordering
      description: The field by which to order results, for example, "created_at", or "-created_at" for descending order.
    outputs:
    - contextPath: DFIRe.Case.id
      description: The case ID.
      type: Number
    - contextPath: DFIRe.Case.title
      description: The case title.
      type: String
    - contextPath: DFIRe.Case.case_number
      description: The case number.
      type: String
    - contextPath: DFIRe.Case.status
      description: The case status.
      type: String
    - contextPath: DFIRe.Case.severity
      description: The case severity.
      type: String
    - contextPath: DFIRe.Case.case_mode
      description: The case mode, investigation or incident.
      type: String
    - contextPath: DFIRe.Case.case_type_name
      description: The case type name.
      type: String
    - contextPath: DFIRe.Case.lead_investigator
      description: The lead investigator user ID.
      type: Number
    - contextPath: DFIRe.Case.created_at
      description: Case creation timestamp.
      type: Date
  - name: dfire-case-get
    description: Retrieves details of a specific case.
    arguments:
    - name: case_id
      description: The ID of the case.
      required: true
    outputs:
    - contextPath: DFIRe.Case.id
      description: The case ID.
      type: Number
    - contextPath: DFIRe.Case.title
      description: The case title.
      type: String
    - contextPath: DFIRe.Case.case_number
      description: The case number.
      type: String
    - contextPath: DFIRe.Case.description
      description: The case description.
      type: String
    - contextPath: DFIRe.Case.notes
      description: The high-level case notes.
      type: String
    - contextPath: DFIRe.Case.status
      description: The case status.
      type: String
    - contextPath: DFIRe.Case.severity
      description: The case severity.
      type: String
    - contextPath: DFIRe.Case.case_mode
      description: The case mode, investigation or incident.
      type: String
    - contextPath: DFIRe.Case.case_type
      description: The case type ID.
      type: Number
    - contextPath: DFIRe.Case.case_type_name
      description: The case type name.
      type: String
    - contextPath: DFIRe.Case.external_id
      description: The external reference ID.
      type: String
    - contextPath: DFIRe.Case.lead_investigator
      description: The lead investigator user ID.
      type: Number
    - contextPath: DFIRe.Case.project_id
      description: The associated project ID.
      type: Number
    - contextPath: DFIRe.Case.current_phase_name
      description: The current case phase name.
      type: String
    - contextPath: DFIRe.Case.item_count
      description: The number of evidence items.
      type: Number
    - contextPath: DFIRe.Case.indicator_count
      description: The number of indicators.
      type: Number
    - contextPath: DFIRe.Case.created_at
      description: The case creation timestamp.
      type: Date
    - contextPath: DFIRe.Case.closed_at
      description: The case closure timestamp.
      type: Date
  - name: dfire-case-create
    description: Creates a new case in DFIRe.
    arguments:
    - name: title
      description: The case title.
      required: true
    - name: case_type
      description: The case type ID.
      required: true
    - name: description
      description: The case description.
    - name: notes
      description: The high-level case summary or notes.
    - name: severity
      description: The case severity.
      predefined:
      - critical
      - high
      - medium
      - low
      - info
    - name: case_mode
      description: The case mode, investigation or incident.
      predefined:
      - investigation
      - incident
    - name: lead_investigator
      description: The user ID of the lead investigator.
    - name: investigators
      description: A comma-separated list of investigator user IDs.
      isArray: true
    - name: viewers
      description: A comma-separated list of viewer user IDs.
      isArray: true
    - name: investigator_ids
      description: A comma-separated list of investigator IDs (alternate write field).
      isArray: true
    - name: viewer_ids
      description: A comma-separated list of viewer IDs (alternate write field).
      isArray: true
    - name: incident_category
      description: The ENISA incident category ID.
    - name: outcome_verdict
      description: The outcome verdict ID (true positive, false positive, etc.).
    - name: external_id
      description: The external reference ID (e.g. ticket number).
    - name: project_id
      description: The project ID to associate the case with.
    - name: attributes
      description: The JSON string of custom attributes to attach to the case.
    - name: create_slack_channel
      description: Whether to auto-create a Slack channel for this case. Defaults to false to avoid unintended channel creation from automated workflows.
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: DFIRe.Case.id
      description: The ID of the created case.
      type: Number
    - contextPath: DFIRe.Case.title
      description: The title of the created case.
      type: String
    - contextPath: DFIRe.Case.case_number
      description: The assigned case number.
      type: String
    - contextPath: DFIRe.Case.status
      description: The case status.
      type: String
  - name: dfire-case-update
    description: Updates an existing case in DFIRe.
    arguments:
    - name: case_id
      description: The ID of the case to update.
      required: true
    - name: title
      description: The new title for the case.
    - name: description
      description: The new case description.
    - name: notes
      description: The high-level case summary or notes.
    - name: status
      description: The new case status.
      predefined:
      - OPEN
      - CLOSED
      - ARCHIVED
    - name: severity
      description: The new case severity.
      predefined:
      - critical
      - high
      - medium
      - low
      - info
    - name: case_mode
      description: The new case mode, investigation or incident.
      predefined:
      - investigation
      - incident
    - name: lead_investigator
      description: The new case lead investigator user ID.
    - name: investigators
      description: A comma-separated list of user IDs with which to replace the investigator list..
      isArray: true
    - name: viewers
      description: A comma-separated list of user IDs with which to replace the viewer list.
      isArray: true
    - name: investigator_ids
      description: A comma-separated list of investigator IDs (alternate write field).
      isArray: true
    - name: viewer_ids
      description: A comma-separated list of viewer IDs (alternate write field).
      isArray: true
    - name: incident_category
      description: The ENISA incident category ID.
    - name: outcome_verdict
      description: The outcome verdict ID.
    - name: external_id
      description: The new external reference ID.
    - name: attributes
      description: The JSON string of custom attributes to attach to the case.
    outputs:
    - contextPath: DFIRe.Case.id
      description: The case ID.
      type: Number
    - contextPath: DFIRe.Case.title
      description: The updated case title.
      type: String
    - contextPath: DFIRe.Case.status
      description: The updated case status.
      type: String
  - name: dfire-case-delete
    description: Deletes a case from DFIRe.
    arguments:
    - name: case_id
      description: The ID of the case to delete.
      required: true
    outputs: []
  - name: dfire-case-note-list
    description: Lists notes for a case.
    arguments:
    - name: case_id
      description: The case ID to list notes for.
      required: true
    outputs:
    - contextPath: DFIRe.CaseNote.id
      description: The note ID.
      type: Number
    - contextPath: DFIRe.CaseNote.case
      description: The case ID.
      type: Number
    - contextPath: DFIRe.CaseNote.note
      description: The note content.
      type: String
    - contextPath: DFIRe.CaseNote.author_name
      description: The note author.
      type: String
    - contextPath: DFIRe.CaseNote.created_at
      description: The note creation timestamp.
      type: Date
  - name: dfire-case-note-create
    description: Creates a note on a case.
    arguments:
    - name: case_id
      description: The case ID to add the note to.
      required: true
    - name: note
      description: The note content.
      required: true
    - name: show_on_timeline
      description: Whether to show this note on the case timeline.
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: DFIRe.CaseNote.id
      description: The created note ID.
      type: Number
    - contextPath: DFIRe.CaseNote.case
      description: The case ID.
      type: Number
    - contextPath: DFIRe.CaseNote.note
      description: The note content.
      type: String
  - name: dfire-indicator-list
    description: Lists indicators from the global IOC registry.
    arguments:
    - name: limit
      description: The maximum number of indicators to return.
      defaultValue: '50'
    - name: offset
      description: The offset for pagination.
      defaultValue: '0'
    - name: search
      description: The search term by which to filter indicators.
    - name: stix_type
      description: The STIX type by which to filter indicators.
      predefined:
      - ipv4-addr
      - ipv6-addr
      - domain-name
      - url
      - email-addr
      - email-message
      - file
      - process
      - windows-registry-key
      - network-traffic
      - user-account
      - mac-addr
      - software
      - artifact
      - autonomous-system
      - directory
      - mutex
      - x509-certificate
    - name: classification
      description: The classification by which to filter indicators.
      predefined:
      - unknown
      - benign
      - suspicious
      - malicious
    - name: confidence
      description: The confidence level by which to filter indicators.
      predefined:
      - low
      - medium
      - high
    - name: tlp
      description: The TLP designation by which to filter indicators.
      predefined:
      - clear
      - green
      - amber
      - amber_strict
      - red
    - name: is_published
      description: Whether to filter indicators by published status.
      predefined:
      - 'true'
      - 'false'
    - name: is_revoked
      description: Whether to filter indicators by revoked status.
      predefined:
      - 'true'
      - 'false'
    - name: parent
      description: The ID of the parent indicator by which to filter results to return its child indicators.
    - name: ordering
      description: The field by which to order results, for example, "created_at", or "-confidence" for descending order.
    outputs:
    - contextPath: DFIRe.Indicator.id
      description: The indicator ID.
      type: Number
    - contextPath: DFIRe.Indicator.value
      description: The IOC value.
      type: String
    - contextPath: DFIRe.Indicator.stix_type
      description: The STIX 2.1 SCO type.
      type: String
    - contextPath: DFIRe.Indicator.classification
      description: The indicator classification (unknown/benign/suspicious/malicious).
      type: String
    - contextPath: DFIRe.Indicator.confidence
      description: The indicator confidence level.
      type: String
    - contextPath: DFIRe.Indicator.tlp
      description: The indicator TLP designation.
      type: String
    - contextPath: DFIRe.Indicator.is_published
      description: Whether the indicator is published.
      type: Boolean
    - contextPath: DFIRe.Indicator.is_revoked
      description: Whether the indicator is revoked.
      type: Boolean
    - contextPath: DFIRe.Indicator.case_count
      description: The number of associated cases for the indicator.
      type: Number
    - contextPath: DFIRe.Indicator.first_seen
      description: The indicator first seen timestamp.
      type: Date
    - contextPath: DFIRe.Indicator.created_at
      description: The indicator creation timestamp.
      type: Date
  - name: dfire-indicator-get
    description: Retrieves details of a specific indicator.
    arguments:
    - name: indicator_id
      description: The indicator ID.
      required: true
    outputs:
    - contextPath: DFIRe.Indicator.id
      description: The DFIRe indicator ID.
      type: Number
    - contextPath: DFIRe.Indicator.value
      description: The IOC value.
      type: String
    - contextPath: DFIRe.Indicator.value_normalized
      description: The normalized IOC value.
      type: String
    - contextPath: DFIRe.Indicator.stix_type
      description: The STIX 2.1 SCO type.
      type: String
    - contextPath: DFIRe.Indicator.classification
      description: The indicator classification.
      type: String
    - contextPath: DFIRe.Indicator.confidence
      description: The indicator confidence level.
      type: String
    - contextPath: DFIRe.Indicator.tlp
      description: The indicator TLP designation.
      type: String
    - contextPath: DFIRe.Indicator.tags
      description: The tags assigned to the indicator.
      type: Unknown
    - contextPath: DFIRe.Indicator.public_notes
      description: The indicator public notes.
      type: String
    - contextPath: DFIRe.Indicator.is_published
      description: Whether the indicator is published.
      type: Boolean
    - contextPath: DFIRe.Indicator.is_revoked
      description: Whether the indicator is revoked.
      type: Boolean
    - contextPath: DFIRe.Indicator.parent
      description: The parent indicator ID.
      type: Number
    - contextPath: DFIRe.Indicator.case_count
      description: The number of associated cases for the indicator.
      type: Number
    - contextPath: DFIRe.Indicator.children_count
      description: The number of child indicators.
      type: Number
    - contextPath: DFIRe.Indicator.first_seen
      description: The indicator first seen timestamp.
      type: Date
    - contextPath: DFIRe.Indicator.last_seen
      description: The indicator last seen timestamp.
      type: Date
    - contextPath: DFIRe.Indicator.created_at
      description: The indicator creation timestamp.
      type: Date
  - name: dfire-indicator-create
    description: Creates a new indicator in the global IOC registry.
    arguments:
    - name: value
      description: The IOC value (IP, domain, hash, URL, etc.).
      required: true
    - name: stix_type
      description: The STIX 2.1 SCO type.
      required: true
      predefined:
      - ipv4-addr
      - ipv6-addr
      - domain-name
      - url
      - email-addr
      - email-message
      - file
      - process
      - windows-registry-key
      - network-traffic
      - user-account
      - mac-addr
      - software
      - artifact
      - autonomous-system
      - directory
      - mutex
      - x509-certificate
    - name: classification
      description: The indicator classification.
      predefined:
      - unknown
      - benign
      - suspicious
      - malicious
    - name: confidence
      description: The indicator confidence level.
      predefined:
      - low
      - medium
      - high
    - name: tlp
      description: The incidator TLP designation.
      predefined:
      - clear
      - green
      - amber
      - amber_strict
      - red
    - name: tags
      description: A comma-separated list of indicator tags.
      isArray: true
    - name: public_notes
      description: The public notes about the indicator.
    - name: valid_until
      description: The indicator auto-revoke date (ISO 8601).
    outputs:
    - contextPath: DFIRe.Indicator.id
      description: The created indicator ID.
      type: Number
    - contextPath: DFIRe.Indicator.value
      description: The indicator value.
      type: String
    - contextPath: DFIRe.Indicator.stix_type
      description: The indicator STIX type.
      type: String
    - contextPath: DFIRe.Indicator.is_existing
      description: Whether the indicator already exists.
      type: Boolean
  - name: dfire-indicator-update
    description: Updates an existing indicator.
    arguments:
    - name: indicator_id
      description: The indicator ID to update.
      required: true
    - name: classification
      description: The new indicator classification.
      predefined:
      - unknown
      - benign
      - suspicious
      - malicious
    - name: confidence
      description: The new indicator confidence level.
      predefined:
      - low
      - medium
      - high
    - name: tlp
      description: The new indicator TLP designation.
      predefined:
      - clear
      - green
      - amber
      - amber_strict
      - red
    - name: tags
      description: A comma-separated list of new indicator tags (replaces the existing).
      isArray: true
    - name: public_notes
      description: The new indicator public notes.
    - name: valid_until
      description: The new indicator auto-revoke date (ISO 8601). Set it to empty to clear.
    outputs:
    - contextPath: DFIRe.Indicator.id
      description: The indicator ID.
      type: Number
    - contextPath: DFIRe.Indicator.value
      description: The IOC value.
      type: String
    - contextPath: DFIRe.Indicator.classification
      description: The updated indicator classification.
      type: String
  - name: dfire-indicator-delete
    description: Deletes an indicator from the global IOC registry.
    arguments:
    - name: indicator_id
      description: The indicator ID to delete.
      required: true
    outputs: []
  - name: dfire-item-type-list
    description: Lists available evidence item types and their IDs.
    arguments: []
    outputs:
    - contextPath: DFIRe.ItemType.id
      description: The item type ID.
      type: Number
    - contextPath: DFIRe.ItemType.name
      description: The item type name.
      type: String
    - contextPath: DFIRe.ItemType.icon
      description: The item type icon.
      type: String
  - name: dfire-item-flag-list
    description: Lists available item flags and their IDs.
    arguments: []
    outputs:
    - contextPath: DFIRe.ItemFlag.id
      description: The flag ID.
      type: Number
    - contextPath: DFIRe.ItemFlag.name
      description: The flag name.
      type: String
    - contextPath: DFIRe.ItemFlag.color
      description: The flag color.
      type: String
    - contextPath: DFIRe.ItemFlag.description
      description: The flag description.
      type: String
  - name: dfire-item-list
    description: Lists evidence items, optionally filtered by case.
    arguments:
    - name: case_id
      description: The case ID by which to filter evidence items.
    outputs:
    - contextPath: DFIRe.Item.uuid
      description: The evidence item UUID.
      type: String
    - contextPath: DFIRe.Item.name
      description: The evidence item name.
      type: String
    - contextPath: DFIRe.Item.display_title
      description: The evidence item display title.
      type: String
    - contextPath: DFIRe.Item.item_type_name
      description: The evidence item type name.
      type: String
    - contextPath: DFIRe.Item.case
      description: The evidence item associated case ID.
      type: Number
    - contextPath: DFIRe.Item.location
      description: The evidence item location.
      type: String
    - contextPath: DFIRe.Item.attachment_count
      description: The number of attachments to the evidence item.
      type: Number
    - contextPath: DFIRe.Item.created_at
      description: The evidence item creation timestamp.
      type: Date
  - name: dfire-item-get
    description: Retrieves details of a specific evidence item.
    arguments:
    - name: item_id
      description: The evidence item ID.
      required: true
    outputs:
    - contextPath: DFIRe.Item.uuid
      description: The evidence item UUID.
      type: String
    - contextPath: DFIRe.Item.name
      description: The evidence item name.
      type: String
    - contextPath: DFIRe.Item.display_title
      description: The evidence item display title.
      type: String
    - contextPath: DFIRe.Item.item_type_name
      description: The evidence item type name.
      type: String
    - contextPath: DFIRe.Item.case
      description: The evidence item associated case ID.
      type: Number
    - contextPath: DFIRe.Item.location
      description: The evidence item location.
      type: String
    - contextPath: DFIRe.Item.attachment_count
      description: The number of attachments for the evidence item.
      type: Number
    - contextPath: DFIRe.Item.created_at
      description: The evidence item creation timestamp.
      type: Date
  - name: dfire-item-create
    description: Creates a new evidence item on a case.
    arguments:
    - name: case_id
      description: The case ID to add the evidence item to.
      required: true
    - name: item_type
      description: The evidence item type ID.
      required: true
    - name: location
      description: The evidence item location (e.g. storage location, lab).
      required: true
    - name: name
      description: The friendly name/label for the evidence item.
    - name: owner_id
      description: The legal entity ID of the evidence item owner.
    - name: primary_user_id
      description: The legal entity ID of the primary user.
    - name: collected_by
      description: The user ID of the collector.
    - name: parent_item
      description: The UUID of the parent evidence item.
    outputs:
    - contextPath: DFIRe.Item.uuid
      description: The created evidence item UUID.
      type: String
    - contextPath: DFIRe.Item.name
      description: The evidence item name.
      type: String
    - contextPath: DFIRe.Item.case
      description: The case ID.
      type: Number
  - name: dfire-attachment-list
    description: Lists attachments, optionally filtered by evidence item UUID.
    arguments:
    - name: item_uuid
      description: The evidence item UUID by which to filter attachments.
    outputs:
    - contextPath: DFIRe.Attachment.id
      description: The attachment ID.
      type: Number
    - contextPath: DFIRe.Attachment.filename
      description: The attachment filename.
      type: String
    - contextPath: DFIRe.Attachment.mime_type
      description: The attachment MIME type.
      type: String
    - contextPath: DFIRe.Attachment.size
      description: The attachment file size in bytes.
      type: Number
    - contextPath: DFIRe.Attachment.category
      description: The attachment category.
      type: String
    - contextPath: DFIRe.Attachment.case
      description: The attachment associated case ID.
      type: Number
    - contextPath: DFIRe.Attachment.item
      description: The attachment associated evidence item UUID.
      type: String
    - contextPath: DFIRe.Attachment.hash_sha256
      description: The SHA-256 hash of the plaintext file attachment.
      type: String
    - contextPath: DFIRe.Attachment.uploaded_by_name
      description: Who uploaded the file attachment.
      type: String
    - contextPath: DFIRe.Attachment.uploaded_at
      description: The attachment upload timestamp.
      type: Date
  - name: dfire-attachment-get
    description: Gets details of a specific attachment.
    arguments:
    - name: attachment_id
      description: The attachment ID.
      required: true
    outputs:
    - contextPath: DFIRe.Attachment.id
      description: The DFIRe attachment ID.
      type: Number
    - contextPath: DFIRe.Attachment.filename
      description: The attachment filename.
      type: String
    - contextPath: DFIRe.Attachment.mime_type
      description: The attachment MIME type.
      type: String
    - contextPath: DFIRe.Attachment.size
      description: The attachment file size in bytes.
      type: Number
    - contextPath: DFIRe.Attachment.category
      description: The attachment category.
      type: String
    - contextPath: DFIRe.Attachment.description
      description: The attachment user-provided description.
      type: String
    - contextPath: DFIRe.Attachment.hash_sha256
      description: The SHA-256 hash of the plaintext file attachment.
      type: String
    - contextPath: DFIRe.Attachment.status
      description: The attachment upload/encryption status.
      type: String
    - contextPath: DFIRe.Attachment.storage_location
      description: The attachment storage location (local, s3, smb).
      type: String
    - contextPath: DFIRe.Attachment.uploaded_at
      description: The attachment upload timestamp.
      type: Date
  - name: dfire-attachment-upload
    description: Uploads a file as an attachment to a case or evidence item.
    arguments:
    - name: entry_id
      description: The War Room entry ID of the file to upload.
      required: true
    - name: case_id
      description: The case ID to associate the attachment with.
    - name: item_uuid
      description: The evidence item UUID to associate the attachment with.
    - name: filename
      description: The name with which to override the filename. (default is the uploaded file name).
    - name: category
      description: The attachment category. `general` routes to the encrypted file store and is relevant for most playbooks. `evidence` is reserved for evidence photos and routes to the image gallery, not the file store.
      defaultValue: general
      predefined:
      - general
      - evidence
    outputs:
    - contextPath: DFIRe.Attachment.id
      description: The created attachment ID.
      type: Number
    - contextPath: DFIRe.Attachment.filename
      description: The attachment filename.
      type: String
    - contextPath: DFIRe.Attachment.size
      description: The attachment file size in bytes.
      type: Number
  - name: dfire-attachment-delete
    description: Deletes an attachment.
    arguments:
    - name: attachment_id
      description: The attachment ID to delete.
      required: true
    outputs: []
  - name: dfire-timeline-list
    description: Lists timeline events for a case (newest first).
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    outputs:
    - contextPath: DFIRe.TimelineEvent.id
      description: The timeline event ID.
      type: Number
    - contextPath: DFIRe.TimelineEvent.event_type
      description: The timeline event type.
      type: String
    - contextPath: DFIRe.TimelineEvent.subject
      description: The timeline event subject.
      type: String
    - contextPath: DFIRe.TimelineEvent.details
      description: The timeline event details.
      type: String
    - contextPath: DFIRe.TimelineEvent.event_datetime
      description: When the timeline event occurred.
      type: Date
    - contextPath: DFIRe.TimelineEvent.created_by_name
      description: Who created the timeline event.
      type: String
  - name: dfire-timeline-create
    description: Adds a manual timeline event to a case.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: subject
      description: The timeline event subject line.
      required: true
    - name: details
      description: The timeline event description.
    - name: event_datetime
      description: When the timeline event occurred (ISO 8601). Default is now.
    outputs:
    - contextPath: DFIRe.TimelineEvent.id
      description: The created timeline event ID.
      type: Number
    - contextPath: DFIRe.TimelineEvent.subject
      description: The timeline event subject.
      type: String
    - contextPath: DFIRe.TimelineEvent.event_datetime
      description: The timeline event timestamp.
      type: Date
  - name: dfire-user-list
    description: Lists users in the DFIRe tenant. Useful for looking up user IDs for assignments.
    arguments: []
    outputs:
    - contextPath: DFIRe.User.id
      description: The DFIRe user ID.
      type: Number
    - contextPath: DFIRe.User.username
      description: The DFIRe username.
      type: String
    - contextPath: DFIRe.User.full_name
      description: The DFIRe user's full name.
      type: String
    - contextPath: DFIRe.User.email
      description: The DFIRe user's email.
      type: String
    - contextPath: DFIRe.User.is_active
      description: Whether the DFIRe user is active.
      type: Boolean
    - contextPath: DFIRe.User.groups
      description: Groups the DFIRe user belongs to.
      type: Unknown
  - name: dfire-case-indicator-list
    description: Lists indicators associated with a case.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    outputs:
    - contextPath: DFIRe.CaseIndicator.id
      description: The association ID.
      type: Number
    - contextPath: DFIRe.CaseIndicator.case
      description: The case ID.
      type: Number
    - contextPath: DFIRe.CaseIndicator.indicator.id
      description: The indicator ID.
      type: Number
    - contextPath: DFIRe.CaseIndicator.indicator.value
      description: The indicator value.
      type: String
    - contextPath: DFIRe.CaseIndicator.indicator.stix_type
      description: The indicator STIX type.
      type: String
    - contextPath: DFIRe.CaseIndicator.context
      description: The case private notes about the associated indicator.
      type: String
    - contextPath: DFIRe.CaseIndicator.source
      description: How the associated indicator was added.
      type: String
    - contextPath: DFIRe.CaseIndicator.created_at
      description: The association timestamp.
      type: Date
    - contextPath: DFIRe.CaseIndicator.case_count
      description: The number of cases this indicator appears in.
      type: Number
  - name: dfire-case-indicator-add
    description: Adds an indicator to a case. Creates the indicator if it does not exist.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: value
      description: The indicator value.
      required: true
    - name: stix_type
      description: The indicator STIX 2.1 SCO type.
      required: true
      predefined:
      - ipv4-addr
      - ipv6-addr
      - domain-name
      - url
      - email-addr
      - email-message
      - file
      - process
      - windows-registry-key
      - network-traffic
      - user-account
      - mac-addr
      - software
      - artifact
      - autonomous-system
      - directory
      - mutex
      - x509-certificate
    - name: classification
      description: The indicator classification.
      defaultValue: unknown
      predefined:
      - unknown
      - benign
      - suspicious
      - malicious
    - name: confidence
      description: The indicator confidence level.
      defaultValue: low
      predefined:
      - low
      - medium
      - high
    - name: tlp
      description: The indicator TLP designation.
      defaultValue: amber
      predefined:
      - clear
      - green
      - amber
      - amber_strict
      - red
    - name: context
      description: The case private notes about the indicator.
    - name: tags
      description: A comma-separated list of indicator tags.
      isArray: true
    - name: source
      description: The source from which the indicator was obtained.
      predefined:
      - manual
      - automated
      - threat_intel
      - sandbox
      - enrichment
      - import
    - name: source_reference
      description: The free-form reference identifying the source (URL, ticket, report name, etc.).
    - name: valid_until
      description: The ISO-8601 datetime after which to automatically invalidate the indicator, for example, "2026-12-31T00:00:00Z".
    - name: decompose
      description: Whether to auto-decompose the indicator (URL→domain, email→domain).
      defaultValue: 'true'
      predefined:
      - 'true'
      - 'false'
    - name: publish
      description: Whether to publish the indicator immediately after creation.
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: DFIRe.CaseIndicator.id
      description: The association ID.
      type: Number
    - contextPath: DFIRe.CaseIndicator.indicator.id
      description: The indicator ID.
      type: Number
    - contextPath: DFIRe.CaseIndicator.indicator.value
      description: The indicator value.
      type: String
  - name: dfire-case-indicator-remove
    description: Removes an indicator association from a case.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: association_id
      description: The case indicator association ID.
      required: true
    outputs: []
  - name: dfire-ioc-extract
    description: Extracts candidate IOCs from a block of text. Returns suggestions only — does not add them to any case.
    arguments:
    - name: text
      description: The text to scan to extract indicators from.
      required: true
    outputs:
    - contextPath: DFIRe.IOCExtraction.candidates
      description: The list of extracted indicator candidates.
      type: Unknown
  - name: dfire-indicator-check
    description: Batch-checks whether IOCs already exist in the global registry.
    arguments:
    - name: indicators
      description: The JSON array of {value, stix_type} objects (mutually exclusive with values+stix_type).
    - name: values
      description: A comma-separated indicator values to check (used with stix_type).
      isArray: true
    - name: stix_type
      description: The STIX type to use when checking the values argument.
      predefined:
      - ipv4-addr
      - ipv6-addr
      - domain-name
      - url
      - email-addr
      - email-message
      - file
      - process
      - windows-registry-key
      - network-traffic
      - user-account
      - mac-addr
      - software
      - artifact
      - autonomous-system
      - directory
      - mutex
      - x509-certificate
    outputs:
    - contextPath: DFIRe.IndicatorCheck.results
      description: The status and details of each submitted indicator.
      type: Unknown
  - name: dfire-indicator-enrich
    description: Triggers external enrichment for an indicator.
    arguments:
    - name: indicator_id
      description: The indicator ID.
      required: true
    - name: providers
      description: A comma-separated list of provider names (omit this to run all providers).
      isArray: true
    - name: force
      description: Whether to re-enrich even if cached results exist.
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: DFIRe.Indicator.id
      description: The indicator ID.
      type: Number
  - name: dfire-indicator-enrichment-list
    description: Retrieves cached enrichment results for an indicator.
    arguments:
    - name: indicator_id
      description: The indicator ID.
      required: true
    outputs:
    - contextPath: DFIRe.Enrichment.enrichments
      description: The enrichment records.
      type: Unknown
  - name: dfire-indicator-publish
    description: Publishes an indicator (making it visible to TAXII consumers and STIX exports).
    arguments:
    - name: indicator_id
      description: The indicator ID.
      required: true
    outputs:
    - contextPath: DFIRe.Indicator.id
      description: The DFIRe indicator ID.
      type: Number
    - contextPath: DFIRe.Indicator.is_published
      description: Whether the indicator is published.
      type: Boolean
  - name: dfire-indicator-unpublish
    description: Unpublishes an indicator.
    arguments:
    - name: indicator_id
      description: The indicator ID.
      required: true
    outputs:
    - contextPath: DFIRe.Indicator.id
      description: The DFIRe indicator ID.
      type: Number
    - contextPath: DFIRe.Indicator.is_published
      description: Whether the indicator is published.
      type: Boolean
  - name: dfire-indicator-revoke
    description: Revokes an indicator.
    arguments:
    - name: indicator_id
      description: The indicator ID.
      required: true
    outputs:
    - contextPath: DFIRe.Indicator.id
      description: The DFIRe indicator ID.
      type: Number
    - contextPath: DFIRe.Indicator.is_revoked
      description: Whether the indicator is revoked.
      type: Boolean
  - name: dfire-indicator-unrevoke
    description: Unrevokes an indicator.
    arguments:
    - name: indicator_id
      description: The indicator ID.
      required: true
    outputs:
    - contextPath: DFIRe.Indicator.id
      description: The DFIRe indicator ID.
      type: Number
    - contextPath: DFIRe.Indicator.is_revoked
      description: Whether the indicator is revoked.
      type: Boolean
  - name: dfire-indicator-decompose
    description: Auto-decomposes an indicator (URL→domain, email→domain, etc.).
    arguments:
    - name: indicator_id
      description: The indicator ID.
      required: true
    outputs:
    - contextPath: DFIRe.Indicator.id
      description: The DFIRe indicator ID.
      type: Number
  - name: dfire-indicator-add-tags
    description: Merges a list of tags into the indicator's existing tag set.
    arguments:
    - name: indicator_id
      description: The indicator ID.
      required: true
    - name: tags
      description: A comma-separated list of tags to add.
      required: true
      isArray: true
    outputs:
    - contextPath: DFIRe.Indicator.id
      description: The DFIRe indicator ID.
      type: Number
    - contextPath: DFIRe.Indicator.tags
      description: The updated tag list.
      type: Unknown
  - name: dfire-indicator-correlated-list
    description: Lists indicators that appear in multiple cases.
    arguments: []
    outputs:
    - contextPath: DFIRe.IndicatorCorrelated.results
      description: The indicators correlated across cases.
      type: Unknown
  - name: dfire-indicator-bulk-classify
    description: Bulk-updates classification for multiple indicators.
    arguments:
    - name: indicator_ids
      description: A comma-separated list of indicator IDs.
      required: true
      isArray: true
    - name: classification
      description: The new indicator classification.
      required: true
      predefined:
      - unknown
      - benign
      - suspicious
      - malicious
    outputs:
    - contextPath: DFIRe.BulkResult
      description: The bulk operation result.
      type: Unknown
  - name: dfire-indicator-bulk-confidence
    description: The bulk-update confidence for multiple indicators.
    arguments:
    - name: indicator_ids
      description: A comma-separated list of indicator IDs.
      required: true
      isArray: true
    - name: confidence
      description: The new indicator confidence level.
      required: true
      predefined:
      - low
      - medium
      - high
    outputs:
    - contextPath: DFIRe.BulkResult
      description: The bulk operation result.
      type: Unknown
  - name: dfire-indicator-bulk-tag
    description: Bulk adds/removes/sets tags on multiple indicators.
    arguments:
    - name: indicator_ids
      description: A comma-separated list of indicator IDs.
      required: true
      isArray: true
    - name: tags
      description: A comma-separated list of indicator tags.
      required: true
      isArray: true
    - name: mode
      description: The action to perform on the tags (add, remove, set).
      defaultValue: add
      predefined:
      - add
      - remove
      - set
    outputs:
    - contextPath: DFIRe.BulkResult
      description: The bulk operation result.
      type: Unknown
  - name: dfire-indicator-bulk-tlp
    description: Bulk-updates TLP designation for multiple indicators.
    arguments:
    - name: indicator_ids
      description: A comma-separated list of indicator IDs.
      required: true
      isArray: true
    - name: tlp
      description: The new indicator TLP designation.
      required: true
      predefined:
      - clear
      - green
      - amber
      - amber_strict
      - red
    outputs:
    - contextPath: DFIRe.BulkResult
      description: The bulk operation result.
      type: Unknown
  - name: dfire-indicator-bulk-publish
    description: Bulk-publishes indicators.
    arguments:
    - name: indicator_ids
      description: A comma-separated list of indicator IDs.
      required: true
      isArray: true
    outputs:
    - contextPath: DFIRe.BulkPublishResponse.published_count
      description: The number of indicators published.
      type: Number
    - contextPath: DFIRe.BulkPublishResponse.skipped_revoked
      description: The number of indicators skipped because they were revoked.
      type: Number
    - contextPath: DFIRe.BulkPublishResponse.skipped_red
      description: The number of indicators skipped because of TLP status RED.
      type: Number
  - name: dfire-indicator-bulk-revoke
    description: Bulk-revokes indicators.
    arguments:
    - name: indicator_ids
      description: A comma-separated list of indicator IDs.
      required: true
      isArray: true
    outputs:
    - contextPath: DFIRe.BulkResult
      description: The bulk operation result.
      type: Unknown
  - name: dfire-indicator-bulk-delete
    description: Bulk-deletes indicators.
    arguments:
    - name: indicator_ids
      description: A comma-separated list of indicator IDs.
      required: true
      isArray: true
    outputs:
    - contextPath: DFIRe.BulkResult
      description: The bulk operation result.
      type: Unknown
  - name: dfire-case-generate-summary
    description: Triggers an AI-generated executive summary for a case.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    outputs:
    - contextPath: DFIRe.CaseSummary
      description: The summary result.
      type: Unknown
  - name: dfire-case-chat
    description: Sends a chat message to the case AI assistant.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: message
      description: The user message to send.
      required: true
    outputs:
    - contextPath: DFIRe.CaseChat
      description: The chat response.
      type: Unknown
  - name: dfire-case-update-report
    description: Updates the text of an AI-generated report attached to a case (e.g. an executive summary).
    arguments:
    - name: case_id
      description: The case ID the report belongs to.
      required: true
    - name: report_id
      description: The ID of the generated report to update.
      required: true
    - name: report_text
      description: The new report text content.
      required: true
    outputs:
    - contextPath: DFIRe.CaseReport
      description: The updated report.
      type: Unknown
  - name: dfire-case-can-report-list
    description: Lists CAN (Case Activity Notice) reports for a case.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    outputs:
    - contextPath: DFIRe.CANReport.id
      description: The CAN report ID.
      type: Number
  - name: dfire-case-can-report-generate
    description: Generates a new CAN report for a case.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: body
      description: The optional JSON body describing the report parameters.
    outputs:
    - contextPath: DFIRe.CANReport.id
      description: The generated report ID.
      type: Number
  - name: dfire-case-investigation-report-get
    description: Retrieves the investigation report for a case.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    outputs:
    - contextPath: DFIRe.InvestigationReport
      description: The investigation report.
      type: Unknown
  - name: dfire-case-investigation-report-generate
    description: Generates AI content for a single section of a case's investigation report. Returns preview content; does not auto-save.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: section_id
      description: The ID of the report section to generate content for.
      required: true
    outputs:
    - contextPath: DFIRe.InvestigationReport.content
      description: The generated section content.
      type: String
    - contextPath: DFIRe.InvestigationReport.model
      description: The model used to generate the content.
      type: String
  - name: dfire-case-investigation-report-finalize
    description: Finalizes the investigation report for a case.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    outputs:
    - contextPath: DFIRe.InvestigationReport
      description: The finalized investigation report.
      type: Unknown
  - name: dfire-case-investigation-report-ready-for-qa
    description: Marks a single section of the investigation report as ready for QA review.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: section_id
      description: The ID of the report section to mark ready for QA.
      required: true
    outputs:
    - contextPath: DFIRe.InvestigationReport
      description: The investigation report section after the state change.
      type: Unknown
  - name: dfire-case-timeline-change-phase
    description: Moves a case to a new response phase in the timeline.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: phase_id
      description: The target phase ID.
    - name: phase_name
      description: The target phase name (used if phase_id is omitted).
    - name: note
      description: The optional note explaining the phase change.
    outputs:
    - contextPath: DFIRe.TimelineEvent.id
      description: The created phase change timeline event ID.
      type: Number
  - name: dfire-case-todo-list
    description: Lists todos for a case.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    outputs:
    - contextPath: DFIRe.CaseTodo.id
      description: The todo ID.
      type: Number
    - contextPath: DFIRe.CaseTodo.title
      description: The todo title.
      type: String
    - contextPath: DFIRe.CaseTodo.status
      description: The todo status.
      type: String
  - name: dfire-case-todo-get
    description: Retrieves a single todo with full details.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: todo_id
      description: The todo ID.
      required: true
    outputs:
    - contextPath: DFIRe.CaseTodo.id
      description: The todo ID.
      type: Number
  - name: dfire-case-todo-assign
    description: Assigns a todo to a user.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: todo_id
      description: The todo ID.
      required: true
    - name: user_id
      description: The user ID of the assignee.
    outputs:
    - contextPath: DFIRe.CaseTodo.id
      description: The todo ID.
      type: Number
    - contextPath: DFIRe.CaseTodo.assignee_name
      description: The assignee display name.
      type: String
  - name: dfire-case-todo-note-set
    description: Sets or replaces the note on a todo.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: todo_id
      description: The todo ID.
      required: true
    - name: note
      description: The new note content.
      required: true
    outputs:
    - contextPath: DFIRe.CaseTodo.id
      description: The todo ID.
      type: Number
  - name: dfire-case-todo-attach-runbook
    description: Attaches a runbook to a todo.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: todo_id
      description: The todo ID.
      required: true
    - name: runbook_slug
      description: The runbook slug to attach.
      required: true
    outputs:
    - contextPath: DFIRe.CaseTodo.id
      description: The todo ID.
      type: Number
    - contextPath: DFIRe.CaseTodo.runbook_slug
      description: The attached runbook slug.
      type: String
  - name: dfire-case-todo-detach-runbook
    description: Detaches the runbook from a todo.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: todo_id
      description: The todo ID.
      required: true
    outputs:
    - contextPath: DFIRe.CaseTodo.id
      description: The todo ID.
      type: Number
  - name: dfire-case-timer-list
    description: Lists the SLA timers for a case.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    outputs:
    - contextPath: DFIRe.CaseTimer.id
      description: The timer ID.
      type: Number
    - contextPath: DFIRe.CaseTimer.name
      description: The timer name.
      type: String
    - contextPath: DFIRe.CaseTimer.framework
      description: The compliance framework.
      type: String
  - name: dfire-case-timer-get
    description: Retrieves a single SLA timer.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: timer_id
      description: The timer ID.
      required: true
    outputs:
    - contextPath: DFIRe.CaseTimer.id
      description: The timer ID.
      type: Number
  - name: dfire-case-timer-complete
    description: Marks a case SLA timer as complete.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: timer_id
      description: The timer ID.
      required: true
    outputs:
    - contextPath: DFIRe.CaseTimer.id
      description: The timer ID.
      type: Number
  - name: dfire-case-timer-reset
    description: Resets a case SLA timer.
    arguments:
    - name: case_id
      description: The case ID.
      required: true
    - name: timer_id
      description: The timer ID.
      required: true
    outputs:
    - contextPath: DFIRe.CaseTimer.id
      description: The timer ID.
      type: Number
  - name: dfire-case-get-by-number
    description: Looks up a case by its human-readable case number.
    arguments:
    - name: case_number
      description: The case number (e.g. "CASE-2026-0001").
      required: true
    outputs:
    - contextPath: DFIRe.Case.id
      description: The case ID.
      type: Number
    - contextPath: DFIRe.Case.case_number
      description: The case number.
      type: String
  - name: dfire-item-resolve-short-id
    description: Resolves an 8-character item short ID to its full UUID and parent case ID.
    arguments:
    - name: short_id
      description: The first 8 characters of the item UUID.
      required: true
    outputs:
    - contextPath: DFIRe.Item.uuid
      description: The full item UUID.
      type: String
    - contextPath: DFIRe.Item.case
      description: The parent case ID.
      type: Number
  - name: dfire-incident-category-list
    description: Lists ENISA incident categories (useful for picklists).
    arguments: []
    outputs:
    - contextPath: DFIRe.IncidentCategory.id
      description: The category ID.
      type: Number
    - contextPath: DFIRe.IncidentCategory.name
      description: The category name.
      type: String
  - name: dfire-incident-phase-list
    description: Lists configured incident-response phases.
    arguments: []
    outputs:
    - contextPath: DFIRe.IncidentPhase.id
      description: The phase ID.
      type: Number
    - contextPath: DFIRe.IncidentPhase.name
      description: The phase name.
      type: String
  - name: dfire-outcome-verdict-list
    description: Lists case outcome verdicts (true positive, false positive, etc.).
    arguments: []
    outputs:
    - contextPath: DFIRe.OutcomeVerdict.id
      description: The verdict ID.
      type: Number
    - contextPath: DFIRe.OutcomeVerdict.name
      description: The verdict name.
      type: String
  - name: dfire-project-list
    description: Lists projects.
    arguments: []
    outputs:
    - contextPath: DFIRe.Project.id
      description: The project ID.
      type: Number
    - contextPath: DFIRe.Project.name
      description: The project name.
      type: String
  - name: dfire-runbook-list
    description: Lists available runbooks (used for todo runbook attachments).
    arguments: []
    outputs:
    - contextPath: DFIRe.Runbook.slug
      description: The runbook slug.
      type: String
    - contextPath: DFIRe.Runbook.name
      description: The runbook name.
      type: String
  - name: dfire-group-list
    description: Lists user groups.
    arguments: []
    outputs:
    - contextPath: DFIRe.Group.id
      description: The user group ID.
      type: Number
    - contextPath: DFIRe.Group.name
      description: The user group name.
      type: String
fromversion: 6.10.0
tests:
- No tests (auto formatted)