IRIS DFIR

IRIS is a collaborative platform aiming to help incident responders to share technical details during investigations. It's free and open-source.

Category

Case Management

Pack

IRISDFIR

Configuration parameters

• host — Server IP or Host Name (e.g., https://192.168.0.1) (required)
• api_key — (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• isFetch — Fetch incidents
• incidentFetchInterval — Incidents Fetch Interval
• incidentType — Incident type
• incidentLastCaseID — Incident Last Case ID

Commands (10)

• iris-add-new-note-to-group — Add a new note to an existing group.
• iris-change-case-state — Change case state status.
• iris-close-case-id — Close a specific case by ID.
• iris-create-notes-group — Creates notes group.
• iris-get-all-cases — Return a list of all IRIS DFIR cases.
• iris-get-ioc-content — Fetch the content of an ioc.
• iris-get-last-case-id — IRIS Command to get the last case information.
• iris-get-list-of-groups-and-notes — Get a list of the notes and groups.
• iris-get-list-of-iocs — Returns a list of IOCs as well as any existing linked with other cases.
• iris-reopen-case-id — Reopen a specific case by ID.