DFIRe

Integration with DFIRe (Digital Forensics and Incident Response) platform for case management and IOC indicator tracking.

Category

Forensics & Malware Analysis

Pack

DFIRe

Configuration parameters

• url — Server URL (required)
• apikey — API Key (required)
• proxy — Use system proxy settings
• insecure — Trust any certificate (not secure)

Commands (75)

• dfire-attachment-delete — Deletes an attachment.
• dfire-attachment-get — Gets details of a specific attachment.
• dfire-attachment-list — Lists attachments, optionally filtered by evidence item UUID.
• dfire-attachment-upload — Uploads a file as an attachment to a case or evidence item.
• dfire-case-can-report-generate — Generates a new CAN report for a case.
• dfire-case-can-report-list — Lists CAN (Case Activity Notice) reports for a case.
• dfire-case-chat — Sends a chat message to the case AI assistant.
• dfire-case-create — Creates a new case in DFIRe.
• dfire-case-delete — Deletes a case from DFIRe.
• dfire-case-generate-summary — Triggers an AI-generated executive summary for a case.
• dfire-case-get — Retrieves details of a specific case.
• dfire-case-get-by-number — Looks up a case by its human-readable case number.
• dfire-case-indicator-add — Adds an indicator to a case. Creates the indicator if it does not exist.
• dfire-case-indicator-list — Lists indicators associated with a case.
• dfire-case-indicator-remove — Removes an indicator association from a case.
• dfire-case-investigation-report-finalize — Finalizes the investigation report for a case.
• dfire-case-investigation-report-generate — Generates AI content for a single section of a case's investigation report. Returns preview content; does not auto-save.
• dfire-case-investigation-report-get — Retrieves the investigation report for a case.
• dfire-case-investigation-report-ready-for-qa — Marks a single section of the investigation report as ready for QA review.
• dfire-case-list — Lists cases from DFIRe.
• dfire-case-note-create — Creates a note on a case.
• dfire-case-note-list — Lists notes for a case.
• dfire-case-timeline-change-phase — Moves a case to a new response phase in the timeline.
• dfire-case-timer-complete — Marks a case SLA timer as complete.
• dfire-case-timer-get — Retrieves a single SLA timer.
• dfire-case-timer-list — Lists the SLA timers for a case.
• dfire-case-timer-reset — Resets a case SLA timer.
• dfire-case-todo-assign — Assigns a todo to a user.
• dfire-case-todo-attach-runbook — Attaches a runbook to a todo.
• dfire-case-todo-detach-runbook — Detaches the runbook from a todo.
• dfire-case-todo-get — Retrieves a single todo with full details.
• dfire-case-todo-list — Lists todos for a case.
• dfire-case-todo-note-set — Sets or replaces the note on a todo.
• dfire-case-type-list — Lists available case types and their IDs.
• dfire-case-update — Updates an existing case in DFIRe.
• dfire-case-update-report — Updates the text of an AI-generated report attached to a case (e.g. an executive summary).
• dfire-group-list — Lists user groups.
• dfire-incident-category-list — Lists ENISA incident categories (useful for picklists).
• dfire-incident-phase-list — Lists configured incident-response phases.
• dfire-indicator-add-tags — Merges a list of tags into the indicator's existing tag set.
• dfire-indicator-bulk-classify — Bulk-updates classification for multiple indicators.
• dfire-indicator-bulk-confidence — The bulk-update confidence for multiple indicators.
• dfire-indicator-bulk-delete — Bulk-deletes indicators.
• dfire-indicator-bulk-publish — Bulk-publishes indicators.
• dfire-indicator-bulk-revoke — Bulk-revokes indicators.
• dfire-indicator-bulk-tag — Bulk adds/removes/sets tags on multiple indicators.
• dfire-indicator-bulk-tlp — Bulk-updates TLP designation for multiple indicators.
• dfire-indicator-check — Batch-checks whether IOCs already exist in the global registry.
• dfire-indicator-correlated-list — Lists indicators that appear in multiple cases.
• dfire-indicator-create — Creates a new indicator in the global IOC registry.
• dfire-indicator-decompose — Auto-decomposes an indicator (URL→domain, email→domain, etc.).
• dfire-indicator-delete — Deletes an indicator from the global IOC registry.
• dfire-indicator-enrich — Triggers external enrichment for an indicator.
• dfire-indicator-enrichment-list — Retrieves cached enrichment results for an indicator.
• dfire-indicator-get — Retrieves details of a specific indicator.
• dfire-indicator-list — Lists indicators from the global IOC registry.
• dfire-indicator-publish — Publishes an indicator (making it visible to TAXII consumers and STIX exports).
• dfire-indicator-revoke — Revokes an indicator.
• dfire-indicator-unpublish — Unpublishes an indicator.
• dfire-indicator-unrevoke — Unrevokes an indicator.
• dfire-indicator-update — Updates an existing indicator.
• dfire-ioc-extract — Extracts candidate IOCs from a block of text. Returns suggestions only — does not add them to any case.
• dfire-item-create — Creates a new evidence item on a case.
• dfire-item-flag-list — Lists available item flags and their IDs.
• dfire-item-get — Retrieves details of a specific evidence item.
• dfire-item-list — Lists evidence items, optionally filtered by case.
• dfire-item-resolve-short-id — Resolves an 8-character item short ID to its full UUID and parent case ID.
• dfire-item-type-list — Lists available evidence item types and their IDs.
• dfire-outcome-verdict-list — Lists case outcome verdicts (true positive, false positive, etc.).
• dfire-project-list — Lists projects.
• dfire-runbook-list — Lists available runbooks (used for todo runbook attachments).
• dfire-search — Searches across all DFIRe data (cases, indicators, notes, items). Supports AND, OR, NOT operators.
• dfire-timeline-create — Adds a manual timeline event to a case.
• dfire-timeline-list — Lists timeline events for a case (newest first).
• dfire-user-list — Lists users in the DFIRe tenant. Useful for looking up user IDs for assignments.