IRIS DFIR

IRIS is a collaborative platform aiming to help incident responders to share technical details during investigations. It's free and open-source.

Case Management · IRIS DFIR

Configuration parameters

  • host — Server IP or Host Name (e.g., https://192.168.0.1) (required)
  • api_key — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type
  • incidentLastCaseID — Incident Last Case ID

Commands (10)

  • iris-add-new-note-to-group

    Add a new note to an existing group.

  • iris-change-case-state

    Change case state status.

  • iris-close-case-id

    Close a specific case by ID.

  • iris-create-notes-group

    Creates notes group.

  • iris-get-all-cases

    Return a list of all IRIS DFIR cases.

  • iris-get-ioc-content

    Fetch the content of an ioc.

  • iris-get-last-case-id

    IRIS Command to get the last case information.

  • iris-get-list-of-groups-and-notes

    Get a list of the notes and groups.

  • iris-get-list-of-iocs

    Returns a list of IOCs as well as any existing linked with other cases.

  • iris-reopen-case-id

    Reopen a specific case by ID.