commonfields: id: DFIRe version: -1 name: DFIRe display: DFIRe category: Forensics & Malware Analysis provider: DFIRe sectionorder: - Connect - Collect description: Integration with DFIRe (Digital Forensics and Incident Response) platform for case management and IOC indicator tracking. configuration: - name: url display: Server URL type: 0 required: true defaultvalue: https://your-dfire-instance.example.com section: Connect - name: apikey display: API Key type: 9 required: true displaypassword: API Key hiddenusername: true additionalinfo: Bearer API key (dfire_ak_...). Create under Settings > API Keys. section: Connect - name: proxy display: Use system proxy settings type: 8 required: false advanced: true section: Connect - name: insecure display: Trust any certificate (not secure) type: 8 required: false advanced: true section: Connect script: script: '-' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 feed: false commands: - name: dfire-search description: Searches across all DFIRe data (cases, indicators, notes, items). Supports AND, OR, NOT operators. arguments: - name: query description: The search query (min 2 characters). required: true outputs: - contextPath: DFIRe.Search.id description: The result ID. type: String - contextPath: DFIRe.Search.type description: The result type (e.g. case, indicator, note). type: String - contextPath: DFIRe.Search.title description: The result title. type: String - contextPath: DFIRe.Search.snippet description: The matching text snippet. type: String - contextPath: DFIRe.Search.rank description: The search relevance rank. type: Number - contextPath: DFIRe.Search.url description: The URL to the result in DFIRe. type: String - contextPath: DFIRe.Search.date description: The result date. type: Date - name: dfire-case-type-list description: Lists available case types and their IDs. arguments: [] outputs: - contextPath: DFIRe.CaseType.id description: The case type ID. type: Number - contextPath: DFIRe.CaseType.name description: The case type name. type: String - name: dfire-case-list description: Lists cases from DFIRe. arguments: - name: limit description: The maximum number of cases to return. defaultValue: '50' - name: page description: The page number for pagination. - name: status description: The status by which to filter cases. predefined: - OPEN - CLOSED - ARCHIVED - name: status_in description: A comma-separated list of statuses by which to filter cases, for example, "OPEN,CLOSED". - name: severity description: The severity by which to filter cases. predefined: - critical - high - medium - low - info - name: case_mode description: The mode by which to filter cases. predefined: - investigation - incident - name: lead_investigator description: The lead investigator user ID by which to filter cases. - name: created_at_gte description: The ISO-8601 datetime on or after which to filter cases, for example, "2026-05-01T00:00:00Z". - name: created_at_lte description: The ISO-8601 datetime on or before which to filter cases. - name: ordering description: The field by which to order results, for example, "created_at", or "-created_at" for descending order. outputs: - contextPath: DFIRe.Case.id description: The case ID. type: Number - contextPath: DFIRe.Case.title description: The case title. type: String - contextPath: DFIRe.Case.case_number description: The case number. type: String - contextPath: DFIRe.Case.status description: The case status. type: String - contextPath: DFIRe.Case.severity description: The case severity. type: String - contextPath: DFIRe.Case.case_mode description: The case mode, investigation or incident. type: String - contextPath: DFIRe.Case.case_type_name description: The case type name. type: String - contextPath: DFIRe.Case.lead_investigator description: The lead investigator user ID. type: Number - contextPath: DFIRe.Case.created_at description: Case creation timestamp. type: Date - name: dfire-case-get description: Retrieves details of a specific case. arguments: - name: case_id description: The ID of the case. required: true outputs: - contextPath: DFIRe.Case.id description: The case ID. type: Number - contextPath: DFIRe.Case.title description: The case title. type: String - contextPath: DFIRe.Case.case_number description: The case number. type: String - contextPath: DFIRe.Case.description description: The case description. type: String - contextPath: DFIRe.Case.notes description: The high-level case notes. type: String - contextPath: DFIRe.Case.status description: The case status. type: String - contextPath: DFIRe.Case.severity description: The case severity. type: String - contextPath: DFIRe.Case.case_mode description: The case mode, investigation or incident. type: String - contextPath: DFIRe.Case.case_type description: The case type ID. type: Number - contextPath: DFIRe.Case.case_type_name description: The case type name. type: String - contextPath: DFIRe.Case.external_id description: The external reference ID. type: String - contextPath: DFIRe.Case.lead_investigator description: The lead investigator user ID. type: Number - contextPath: DFIRe.Case.project_id description: The associated project ID. type: Number - contextPath: DFIRe.Case.current_phase_name description: The current case phase name. type: String - contextPath: DFIRe.Case.item_count description: The number of evidence items. type: Number - contextPath: DFIRe.Case.indicator_count description: The number of indicators. type: Number - contextPath: DFIRe.Case.created_at description: The case creation timestamp. type: Date - contextPath: DFIRe.Case.closed_at description: The case closure timestamp. type: Date - name: dfire-case-create description: Creates a new case in DFIRe. arguments: - name: title description: The case title. required: true - name: case_type description: The case type ID. required: true - name: description description: The case description. - name: notes description: The high-level case summary or notes. - name: severity description: The case severity. predefined: - critical - high - medium - low - info - name: case_mode description: The case mode, investigation or incident. predefined: - investigation - incident - name: lead_investigator description: The user ID of the lead investigator. - name: investigators description: A comma-separated list of investigator user IDs. isArray: true - name: viewers description: A comma-separated list of viewer user IDs. isArray: true - name: investigator_ids description: A comma-separated list of investigator IDs (alternate write field). isArray: true - name: viewer_ids description: A comma-separated list of viewer IDs (alternate write field). isArray: true - name: incident_category description: The ENISA incident category ID. - name: outcome_verdict description: The outcome verdict ID (true positive, false positive, etc.). - name: external_id description: The external reference ID (e.g. ticket number). - name: project_id description: The project ID to associate the case with. - name: attributes description: The JSON string of custom attributes to attach to the case. - name: create_slack_channel description: Whether to auto-create a Slack channel for this case. Defaults to false to avoid unintended channel creation from automated workflows. defaultValue: 'false' predefined: - 'true' - 'false' outputs: - contextPath: DFIRe.Case.id description: The ID of the created case. type: Number - contextPath: DFIRe.Case.title description: The title of the created case. type: String - contextPath: DFIRe.Case.case_number description: The assigned case number. type: String - contextPath: DFIRe.Case.status description: The case status. type: String - name: dfire-case-update description: Updates an existing case in DFIRe. arguments: - name: case_id description: The ID of the case to update. required: true - name: title description: The new title for the case. - name: description description: The new case description. - name: notes description: The high-level case summary or notes. - name: status description: The new case status. predefined: - OPEN - CLOSED - ARCHIVED - name: severity description: The new case severity. predefined: - critical - high - medium - low - info - name: case_mode description: The new case mode, investigation or incident. predefined: - investigation - incident - name: lead_investigator description: The new case lead investigator user ID. - name: investigators description: A comma-separated list of user IDs with which to replace the investigator list.. isArray: true - name: viewers description: A comma-separated list of user IDs with which to replace the viewer list. isArray: true - name: investigator_ids description: A comma-separated list of investigator IDs (alternate write field). isArray: true - name: viewer_ids description: A comma-separated list of viewer IDs (alternate write field). isArray: true - name: incident_category description: The ENISA incident category ID. - name: outcome_verdict description: The outcome verdict ID. - name: external_id description: The new external reference ID. - name: attributes description: The JSON string of custom attributes to attach to the case. outputs: - contextPath: DFIRe.Case.id description: The case ID. type: Number - contextPath: DFIRe.Case.title description: The updated case title. type: String - contextPath: DFIRe.Case.status description: The updated case status. type: String - name: dfire-case-delete description: Deletes a case from DFIRe. arguments: - name: case_id description: The ID of the case to delete. required: true outputs: [] - name: dfire-case-note-list description: Lists notes for a case. arguments: - name: case_id description: The case ID to list notes for. required: true outputs: - contextPath: DFIRe.CaseNote.id description: The note ID. type: Number - contextPath: DFIRe.CaseNote.case description: The case ID. type: Number - contextPath: DFIRe.CaseNote.note description: The note content. type: String - contextPath: DFIRe.CaseNote.author_name description: The note author. type: String - contextPath: DFIRe.CaseNote.created_at description: The note creation timestamp. type: Date - name: dfire-case-note-create description: Creates a note on a case. arguments: - name: case_id description: The case ID to add the note to. required: true - name: note description: The note content. required: true - name: show_on_timeline description: Whether to show this note on the case timeline. defaultValue: 'false' predefined: - 'true' - 'false' outputs: - contextPath: DFIRe.CaseNote.id description: The created note ID. type: Number - contextPath: DFIRe.CaseNote.case description: The case ID. type: Number - contextPath: DFIRe.CaseNote.note description: The note content. type: String - name: dfire-indicator-list description: Lists indicators from the global IOC registry. arguments: - name: limit description: The maximum number of indicators to return. defaultValue: '50' - name: offset description: The offset for pagination. defaultValue: '0' - name: search description: The search term by which to filter indicators. - name: stix_type description: The STIX type by which to filter indicators. predefined: - ipv4-addr - ipv6-addr - domain-name - url - email-addr - email-message - file - process - windows-registry-key - network-traffic - user-account - mac-addr - software - artifact - autonomous-system - directory - mutex - x509-certificate - name: classification description: The classification by which to filter indicators. predefined: - unknown - benign - suspicious - malicious - name: confidence description: The confidence level by which to filter indicators. predefined: - low - medium - high - name: tlp description: The TLP designation by which to filter indicators. predefined: - clear - green - amber - amber_strict - red - name: is_published description: Whether to filter indicators by published status. predefined: - 'true' - 'false' - name: is_revoked description: Whether to filter indicators by revoked status. predefined: - 'true' - 'false' - name: parent description: The ID of the parent indicator by which to filter results to return its child indicators. - name: ordering description: The field by which to order results, for example, "created_at", or "-confidence" for descending order. outputs: - contextPath: DFIRe.Indicator.id description: The indicator ID. type: Number - contextPath: DFIRe.Indicator.value description: The IOC value. type: String - contextPath: DFIRe.Indicator.stix_type description: The STIX 2.1 SCO type. type: String - contextPath: DFIRe.Indicator.classification description: The indicator classification (unknown/benign/suspicious/malicious). type: String - contextPath: DFIRe.Indicator.confidence description: The indicator confidence level. type: String - contextPath: DFIRe.Indicator.tlp description: The indicator TLP designation. type: String - contextPath: DFIRe.Indicator.is_published description: Whether the indicator is published. type: Boolean - contextPath: DFIRe.Indicator.is_revoked description: Whether the indicator is revoked. type: Boolean - contextPath: DFIRe.Indicator.case_count description: The number of associated cases for the indicator. type: Number - contextPath: DFIRe.Indicator.first_seen description: The indicator first seen timestamp. type: Date - contextPath: DFIRe.Indicator.created_at description: The indicator creation timestamp. type: Date - name: dfire-indicator-get description: Retrieves details of a specific indicator. arguments: - name: indicator_id description: The indicator ID. required: true outputs: - contextPath: DFIRe.Indicator.id description: The DFIRe indicator ID. type: Number - contextPath: DFIRe.Indicator.value description: The IOC value. type: String - contextPath: DFIRe.Indicator.value_normalized description: The normalized IOC value. type: String - contextPath: DFIRe.Indicator.stix_type description: The STIX 2.1 SCO type. type: String - contextPath: DFIRe.Indicator.classification description: The indicator classification. type: String - contextPath: DFIRe.Indicator.confidence description: The indicator confidence level. type: String - contextPath: DFIRe.Indicator.tlp description: The indicator TLP designation. type: String - contextPath: DFIRe.Indicator.tags description: The tags assigned to the indicator. type: Unknown - contextPath: DFIRe.Indicator.public_notes description: The indicator public notes. type: String - contextPath: DFIRe.Indicator.is_published description: Whether the indicator is published. type: Boolean - contextPath: DFIRe.Indicator.is_revoked description: Whether the indicator is revoked. type: Boolean - contextPath: DFIRe.Indicator.parent description: The parent indicator ID. type: Number - contextPath: DFIRe.Indicator.case_count description: The number of associated cases for the indicator. type: Number - contextPath: DFIRe.Indicator.children_count description: The number of child indicators. type: Number - contextPath: DFIRe.Indicator.first_seen description: The indicator first seen timestamp. type: Date - contextPath: DFIRe.Indicator.last_seen description: The indicator last seen timestamp. type: Date - contextPath: DFIRe.Indicator.created_at description: The indicator creation timestamp. type: Date - name: dfire-indicator-create description: Creates a new indicator in the global IOC registry. arguments: - name: value description: The IOC value (IP, domain, hash, URL, etc.). required: true - name: stix_type description: The STIX 2.1 SCO type. required: true predefined: - ipv4-addr - ipv6-addr - domain-name - url - email-addr - email-message - file - process - windows-registry-key - network-traffic - user-account - mac-addr - software - artifact - autonomous-system - directory - mutex - x509-certificate - name: classification description: The indicator classification. predefined: - unknown - benign - suspicious - malicious - name: confidence description: The indicator confidence level. predefined: - low - medium - high - name: tlp description: The incidator TLP designation. predefined: - clear - green - amber - amber_strict - red - name: tags description: A comma-separated list of indicator tags. isArray: true - name: public_notes description: The public notes about the indicator. - name: valid_until description: The indicator auto-revoke date (ISO 8601). outputs: - contextPath: DFIRe.Indicator.id description: The created indicator ID. type: Number - contextPath: DFIRe.Indicator.value description: The indicator value. type: String - contextPath: DFIRe.Indicator.stix_type description: The indicator STIX type. type: String - contextPath: DFIRe.Indicator.is_existing description: Whether the indicator already exists. type: Boolean - name: dfire-indicator-update description: Updates an existing indicator. arguments: - name: indicator_id description: The indicator ID to update. required: true - name: classification description: The new indicator classification. predefined: - unknown - benign - suspicious - malicious - name: confidence description: The new indicator confidence level. predefined: - low - medium - high - name: tlp description: The new indicator TLP designation. predefined: - clear - green - amber - amber_strict - red - name: tags description: A comma-separated list of new indicator tags (replaces the existing). isArray: true - name: public_notes description: The new indicator public notes. - name: valid_until description: The new indicator auto-revoke date (ISO 8601). Set it to empty to clear. outputs: - contextPath: DFIRe.Indicator.id description: The indicator ID. type: Number - contextPath: DFIRe.Indicator.value description: The IOC value. type: String - contextPath: DFIRe.Indicator.classification description: The updated indicator classification. type: String - name: dfire-indicator-delete description: Deletes an indicator from the global IOC registry. arguments: - name: indicator_id description: The indicator ID to delete. required: true outputs: [] - name: dfire-item-type-list description: Lists available evidence item types and their IDs. arguments: [] outputs: - contextPath: DFIRe.ItemType.id description: The item type ID. type: Number - contextPath: DFIRe.ItemType.name description: The item type name. type: String - contextPath: DFIRe.ItemType.icon description: The item type icon. type: String - name: dfire-item-flag-list description: Lists available item flags and their IDs. arguments: [] outputs: - contextPath: DFIRe.ItemFlag.id description: The flag ID. type: Number - contextPath: DFIRe.ItemFlag.name description: The flag name. type: String - contextPath: DFIRe.ItemFlag.color description: The flag color. type: String - contextPath: DFIRe.ItemFlag.description description: The flag description. type: String - name: dfire-item-list description: Lists evidence items, optionally filtered by case. arguments: - name: case_id description: The case ID by which to filter evidence items. outputs: - contextPath: DFIRe.Item.uuid description: The evidence item UUID. type: String - contextPath: DFIRe.Item.name description: The evidence item name. type: String - contextPath: DFIRe.Item.display_title description: The evidence item display title. type: String - contextPath: DFIRe.Item.item_type_name description: The evidence item type name. type: String - contextPath: DFIRe.Item.case description: The evidence item associated case ID. type: Number - contextPath: DFIRe.Item.location description: The evidence item location. type: String - contextPath: DFIRe.Item.attachment_count description: The number of attachments to the evidence item. type: Number - contextPath: DFIRe.Item.created_at description: The evidence item creation timestamp. type: Date - name: dfire-item-get description: Retrieves details of a specific evidence item. arguments: - name: item_id description: The evidence item ID. required: true outputs: - contextPath: DFIRe.Item.uuid description: The evidence item UUID. type: String - contextPath: DFIRe.Item.name description: The evidence item name. type: String - contextPath: DFIRe.Item.display_title description: The evidence item display title. type: String - contextPath: DFIRe.Item.item_type_name description: The evidence item type name. type: String - contextPath: DFIRe.Item.case description: The evidence item associated case ID. type: Number - contextPath: DFIRe.Item.location description: The evidence item location. type: String - contextPath: DFIRe.Item.attachment_count description: The number of attachments for the evidence item. type: Number - contextPath: DFIRe.Item.created_at description: The evidence item creation timestamp. type: Date - name: dfire-item-create description: Creates a new evidence item on a case. arguments: - name: case_id description: The case ID to add the evidence item to. required: true - name: item_type description: The evidence item type ID. required: true - name: location description: The evidence item location (e.g. storage location, lab). required: true - name: name description: The friendly name/label for the evidence item. - name: owner_id description: The legal entity ID of the evidence item owner. - name: primary_user_id description: The legal entity ID of the primary user. - name: collected_by description: The user ID of the collector. - name: parent_item description: The UUID of the parent evidence item. outputs: - contextPath: DFIRe.Item.uuid description: The created evidence item UUID. type: String - contextPath: DFIRe.Item.name description: The evidence item name. type: String - contextPath: DFIRe.Item.case description: The case ID. type: Number - name: dfire-attachment-list description: Lists attachments, optionally filtered by evidence item UUID. arguments: - name: item_uuid description: The evidence item UUID by which to filter attachments. outputs: - contextPath: DFIRe.Attachment.id description: The attachment ID. type: Number - contextPath: DFIRe.Attachment.filename description: The attachment filename. type: String - contextPath: DFIRe.Attachment.mime_type description: The attachment MIME type. type: String - contextPath: DFIRe.Attachment.size description: The attachment file size in bytes. type: Number - contextPath: DFIRe.Attachment.category description: The attachment category. type: String - contextPath: DFIRe.Attachment.case description: The attachment associated case ID. type: Number - contextPath: DFIRe.Attachment.item description: The attachment associated evidence item UUID. type: String - contextPath: DFIRe.Attachment.hash_sha256 description: The SHA-256 hash of the plaintext file attachment. type: String - contextPath: DFIRe.Attachment.uploaded_by_name description: Who uploaded the file attachment. type: String - contextPath: DFIRe.Attachment.uploaded_at description: The attachment upload timestamp. type: Date - name: dfire-attachment-get description: Gets details of a specific attachment. arguments: - name: attachment_id description: The attachment ID. required: true outputs: - contextPath: DFIRe.Attachment.id description: The DFIRe attachment ID. type: Number - contextPath: DFIRe.Attachment.filename description: The attachment filename. type: String - contextPath: DFIRe.Attachment.mime_type description: The attachment MIME type. type: String - contextPath: DFIRe.Attachment.size description: The attachment file size in bytes. type: Number - contextPath: DFIRe.Attachment.category description: The attachment category. type: String - contextPath: DFIRe.Attachment.description description: The attachment user-provided description. type: String - contextPath: DFIRe.Attachment.hash_sha256 description: The SHA-256 hash of the plaintext file attachment. type: String - contextPath: DFIRe.Attachment.status description: The attachment upload/encryption status. type: String - contextPath: DFIRe.Attachment.storage_location description: The attachment storage location (local, s3, smb). type: String - contextPath: DFIRe.Attachment.uploaded_at description: The attachment upload timestamp. type: Date - name: dfire-attachment-upload description: Uploads a file as an attachment to a case or evidence item. arguments: - name: entry_id description: The War Room entry ID of the file to upload. required: true - name: case_id description: The case ID to associate the attachment with. - name: item_uuid description: The evidence item UUID to associate the attachment with. - name: filename description: The name with which to override the filename. (default is the uploaded file name). - name: category description: The attachment category. `general` routes to the encrypted file store and is relevant for most playbooks. `evidence` is reserved for evidence photos and routes to the image gallery, not the file store. defaultValue: general predefined: - general - evidence outputs: - contextPath: DFIRe.Attachment.id description: The created attachment ID. type: Number - contextPath: DFIRe.Attachment.filename description: The attachment filename. type: String - contextPath: DFIRe.Attachment.size description: The attachment file size in bytes. type: Number - name: dfire-attachment-delete description: Deletes an attachment. arguments: - name: attachment_id description: The attachment ID to delete. required: true outputs: [] - name: dfire-timeline-list description: Lists timeline events for a case (newest first). arguments: - name: case_id description: The case ID. required: true outputs: - contextPath: DFIRe.TimelineEvent.id description: The timeline event ID. type: Number - contextPath: DFIRe.TimelineEvent.event_type description: The timeline event type. type: String - contextPath: DFIRe.TimelineEvent.subject description: The timeline event subject. type: String - contextPath: DFIRe.TimelineEvent.details description: The timeline event details. type: String - contextPath: DFIRe.TimelineEvent.event_datetime description: When the timeline event occurred. type: Date - contextPath: DFIRe.TimelineEvent.created_by_name description: Who created the timeline event. type: String - name: dfire-timeline-create description: Adds a manual timeline event to a case. arguments: - name: case_id description: The case ID. required: true - name: subject description: The timeline event subject line. required: true - name: details description: The timeline event description. - name: event_datetime description: When the timeline event occurred (ISO 8601). Default is now. outputs: - contextPath: DFIRe.TimelineEvent.id description: The created timeline event ID. type: Number - contextPath: DFIRe.TimelineEvent.subject description: The timeline event subject. type: String - contextPath: DFIRe.TimelineEvent.event_datetime description: The timeline event timestamp. type: Date - name: dfire-user-list description: Lists users in the DFIRe tenant. Useful for looking up user IDs for assignments. arguments: [] outputs: - contextPath: DFIRe.User.id description: The DFIRe user ID. type: Number - contextPath: DFIRe.User.username description: The DFIRe username. type: String - contextPath: DFIRe.User.full_name description: The DFIRe user's full name. type: String - contextPath: DFIRe.User.email description: The DFIRe user's email. type: String - contextPath: DFIRe.User.is_active description: Whether the DFIRe user is active. type: Boolean - contextPath: DFIRe.User.groups description: Groups the DFIRe user belongs to. type: Unknown - name: dfire-case-indicator-list description: Lists indicators associated with a case. arguments: - name: case_id description: The case ID. required: true outputs: - contextPath: DFIRe.CaseIndicator.id description: The association ID. type: Number - contextPath: DFIRe.CaseIndicator.case description: The case ID. type: Number - contextPath: DFIRe.CaseIndicator.indicator.id description: The indicator ID. type: Number - contextPath: DFIRe.CaseIndicator.indicator.value description: The indicator value. type: String - contextPath: DFIRe.CaseIndicator.indicator.stix_type description: The indicator STIX type. type: String - contextPath: DFIRe.CaseIndicator.context description: The case private notes about the associated indicator. type: String - contextPath: DFIRe.CaseIndicator.source description: How the associated indicator was added. type: String - contextPath: DFIRe.CaseIndicator.created_at description: The association timestamp. type: Date - contextPath: DFIRe.CaseIndicator.case_count description: The number of cases this indicator appears in. type: Number - name: dfire-case-indicator-add description: Adds an indicator to a case. Creates the indicator if it does not exist. arguments: - name: case_id description: The case ID. required: true - name: value description: The indicator value. required: true - name: stix_type description: The indicator STIX 2.1 SCO type. required: true predefined: - ipv4-addr - ipv6-addr - domain-name - url - email-addr - email-message - file - process - windows-registry-key - network-traffic - user-account - mac-addr - software - artifact - autonomous-system - directory - mutex - x509-certificate - name: classification description: The indicator classification. defaultValue: unknown predefined: - unknown - benign - suspicious - malicious - name: confidence description: The indicator confidence level. defaultValue: low predefined: - low - medium - high - name: tlp description: The indicator TLP designation. defaultValue: amber predefined: - clear - green - amber - amber_strict - red - name: context description: The case private notes about the indicator. - name: tags description: A comma-separated list of indicator tags. isArray: true - name: source description: The source from which the indicator was obtained. predefined: - manual - automated - threat_intel - sandbox - enrichment - import - name: source_reference description: The free-form reference identifying the source (URL, ticket, report name, etc.). - name: valid_until description: The ISO-8601 datetime after which to automatically invalidate the indicator, for example, "2026-12-31T00:00:00Z". - name: decompose description: Whether to auto-decompose the indicator (URL→domain, email→domain). defaultValue: 'true' predefined: - 'true' - 'false' - name: publish description: Whether to publish the indicator immediately after creation. defaultValue: 'false' predefined: - 'true' - 'false' outputs: - contextPath: DFIRe.CaseIndicator.id description: The association ID. type: Number - contextPath: DFIRe.CaseIndicator.indicator.id description: The indicator ID. type: Number - contextPath: DFIRe.CaseIndicator.indicator.value description: The indicator value. type: String - name: dfire-case-indicator-remove description: Removes an indicator association from a case. arguments: - name: case_id description: The case ID. required: true - name: association_id description: The case indicator association ID. required: true outputs: [] - name: dfire-ioc-extract description: Extracts candidate IOCs from a block of text. Returns suggestions only — does not add them to any case. arguments: - name: text description: The text to scan to extract indicators from. required: true outputs: - contextPath: DFIRe.IOCExtraction.candidates description: The list of extracted indicator candidates. type: Unknown - name: dfire-indicator-check description: Batch-checks whether IOCs already exist in the global registry. arguments: - name: indicators description: The JSON array of {value, stix_type} objects (mutually exclusive with values+stix_type). - name: values description: A comma-separated indicator values to check (used with stix_type). isArray: true - name: stix_type description: The STIX type to use when checking the values argument. predefined: - ipv4-addr - ipv6-addr - domain-name - url - email-addr - email-message - file - process - windows-registry-key - network-traffic - user-account - mac-addr - software - artifact - autonomous-system - directory - mutex - x509-certificate outputs: - contextPath: DFIRe.IndicatorCheck.results description: The status and details of each submitted indicator. type: Unknown - name: dfire-indicator-enrich description: Triggers external enrichment for an indicator. arguments: - name: indicator_id description: The indicator ID. required: true - name: providers description: A comma-separated list of provider names (omit this to run all providers). isArray: true - name: force description: Whether to re-enrich even if cached results exist. predefined: - 'true' - 'false' outputs: - contextPath: DFIRe.Indicator.id description: The indicator ID. type: Number - name: dfire-indicator-enrichment-list description: Retrieves cached enrichment results for an indicator. arguments: - name: indicator_id description: The indicator ID. required: true outputs: - contextPath: DFIRe.Enrichment.enrichments description: The enrichment records. type: Unknown - name: dfire-indicator-publish description: Publishes an indicator (making it visible to TAXII consumers and STIX exports). arguments: - name: indicator_id description: The indicator ID. required: true outputs: - contextPath: DFIRe.Indicator.id description: The DFIRe indicator ID. type: Number - contextPath: DFIRe.Indicator.is_published description: Whether the indicator is published. type: Boolean - name: dfire-indicator-unpublish description: Unpublishes an indicator. arguments: - name: indicator_id description: The indicator ID. required: true outputs: - contextPath: DFIRe.Indicator.id description: The DFIRe indicator ID. type: Number - contextPath: DFIRe.Indicator.is_published description: Whether the indicator is published. type: Boolean - name: dfire-indicator-revoke description: Revokes an indicator. arguments: - name: indicator_id description: The indicator ID. required: true outputs: - contextPath: DFIRe.Indicator.id description: The DFIRe indicator ID. type: Number - contextPath: DFIRe.Indicator.is_revoked description: Whether the indicator is revoked. type: Boolean - name: dfire-indicator-unrevoke description: Unrevokes an indicator. arguments: - name: indicator_id description: The indicator ID. required: true outputs: - contextPath: DFIRe.Indicator.id description: The DFIRe indicator ID. type: Number - contextPath: DFIRe.Indicator.is_revoked description: Whether the indicator is revoked. type: Boolean - name: dfire-indicator-decompose description: Auto-decomposes an indicator (URL→domain, email→domain, etc.). arguments: - name: indicator_id description: The indicator ID. required: true outputs: - contextPath: DFIRe.Indicator.id description: The DFIRe indicator ID. type: Number - name: dfire-indicator-add-tags description: Merges a list of tags into the indicator's existing tag set. arguments: - name: indicator_id description: The indicator ID. required: true - name: tags description: A comma-separated list of tags to add. required: true isArray: true outputs: - contextPath: DFIRe.Indicator.id description: The DFIRe indicator ID. type: Number - contextPath: DFIRe.Indicator.tags description: The updated tag list. type: Unknown - name: dfire-indicator-correlated-list description: Lists indicators that appear in multiple cases. arguments: [] outputs: - contextPath: DFIRe.IndicatorCorrelated.results description: The indicators correlated across cases. type: Unknown - name: dfire-indicator-bulk-classify description: Bulk-updates classification for multiple indicators. arguments: - name: indicator_ids description: A comma-separated list of indicator IDs. required: true isArray: true - name: classification description: The new indicator classification. required: true predefined: - unknown - benign - suspicious - malicious outputs: - contextPath: DFIRe.BulkResult description: The bulk operation result. type: Unknown - name: dfire-indicator-bulk-confidence description: The bulk-update confidence for multiple indicators. arguments: - name: indicator_ids description: A comma-separated list of indicator IDs. required: true isArray: true - name: confidence description: The new indicator confidence level. required: true predefined: - low - medium - high outputs: - contextPath: DFIRe.BulkResult description: The bulk operation result. type: Unknown - name: dfire-indicator-bulk-tag description: Bulk adds/removes/sets tags on multiple indicators. arguments: - name: indicator_ids description: A comma-separated list of indicator IDs. required: true isArray: true - name: tags description: A comma-separated list of indicator tags. required: true isArray: true - name: mode description: The action to perform on the tags (add, remove, set). defaultValue: add predefined: - add - remove - set outputs: - contextPath: DFIRe.BulkResult description: The bulk operation result. type: Unknown - name: dfire-indicator-bulk-tlp description: Bulk-updates TLP designation for multiple indicators. arguments: - name: indicator_ids description: A comma-separated list of indicator IDs. required: true isArray: true - name: tlp description: The new indicator TLP designation. required: true predefined: - clear - green - amber - amber_strict - red outputs: - contextPath: DFIRe.BulkResult description: The bulk operation result. type: Unknown - name: dfire-indicator-bulk-publish description: Bulk-publishes indicators. arguments: - name: indicator_ids description: A comma-separated list of indicator IDs. required: true isArray: true outputs: - contextPath: DFIRe.BulkPublishResponse.published_count description: The number of indicators published. type: Number - contextPath: DFIRe.BulkPublishResponse.skipped_revoked description: The number of indicators skipped because they were revoked. type: Number - contextPath: DFIRe.BulkPublishResponse.skipped_red description: The number of indicators skipped because of TLP status RED. type: Number - name: dfire-indicator-bulk-revoke description: Bulk-revokes indicators. arguments: - name: indicator_ids description: A comma-separated list of indicator IDs. required: true isArray: true outputs: - contextPath: DFIRe.BulkResult description: The bulk operation result. type: Unknown - name: dfire-indicator-bulk-delete description: Bulk-deletes indicators. arguments: - name: indicator_ids description: A comma-separated list of indicator IDs. required: true isArray: true outputs: - contextPath: DFIRe.BulkResult description: The bulk operation result. type: Unknown - name: dfire-case-generate-summary description: Triggers an AI-generated executive summary for a case. arguments: - name: case_id description: The case ID. required: true outputs: - contextPath: DFIRe.CaseSummary description: The summary result. type: Unknown - name: dfire-case-chat description: Sends a chat message to the case AI assistant. arguments: - name: case_id description: The case ID. required: true - name: message description: The user message to send. required: true outputs: - contextPath: DFIRe.CaseChat description: The chat response. type: Unknown - name: dfire-case-update-report description: Updates the text of an AI-generated report attached to a case (e.g. an executive summary). arguments: - name: case_id description: The case ID the report belongs to. required: true - name: report_id description: The ID of the generated report to update. required: true - name: report_text description: The new report text content. required: true outputs: - contextPath: DFIRe.CaseReport description: The updated report. type: Unknown - name: dfire-case-can-report-list description: Lists CAN (Case Activity Notice) reports for a case. arguments: - name: case_id description: The case ID. required: true outputs: - contextPath: DFIRe.CANReport.id description: The CAN report ID. type: Number - name: dfire-case-can-report-generate description: Generates a new CAN report for a case. arguments: - name: case_id description: The case ID. required: true - name: body description: The optional JSON body describing the report parameters. outputs: - contextPath: DFIRe.CANReport.id description: The generated report ID. type: Number - name: dfire-case-investigation-report-get description: Retrieves the investigation report for a case. arguments: - name: case_id description: The case ID. required: true outputs: - contextPath: DFIRe.InvestigationReport description: The investigation report. type: Unknown - name: dfire-case-investigation-report-generate description: Generates AI content for a single section of a case's investigation report. Returns preview content; does not auto-save. arguments: - name: case_id description: The case ID. required: true - name: section_id description: The ID of the report section to generate content for. required: true outputs: - contextPath: DFIRe.InvestigationReport.content description: The generated section content. type: String - contextPath: DFIRe.InvestigationReport.model description: The model used to generate the content. type: String - name: dfire-case-investigation-report-finalize description: Finalizes the investigation report for a case. arguments: - name: case_id description: The case ID. required: true outputs: - contextPath: DFIRe.InvestigationReport description: The finalized investigation report. type: Unknown - name: dfire-case-investigation-report-ready-for-qa description: Marks a single section of the investigation report as ready for QA review. arguments: - name: case_id description: The case ID. required: true - name: section_id description: The ID of the report section to mark ready for QA. required: true outputs: - contextPath: DFIRe.InvestigationReport description: The investigation report section after the state change. type: Unknown - name: dfire-case-timeline-change-phase description: Moves a case to a new response phase in the timeline. arguments: - name: case_id description: The case ID. required: true - name: phase_id description: The target phase ID. - name: phase_name description: The target phase name (used if phase_id is omitted). - name: note description: The optional note explaining the phase change. outputs: - contextPath: DFIRe.TimelineEvent.id description: The created phase change timeline event ID. type: Number - name: dfire-case-todo-list description: Lists todos for a case. arguments: - name: case_id description: The case ID. required: true outputs: - contextPath: DFIRe.CaseTodo.id description: The todo ID. type: Number - contextPath: DFIRe.CaseTodo.title description: The todo title. type: String - contextPath: DFIRe.CaseTodo.status description: The todo status. type: String - name: dfire-case-todo-get description: Retrieves a single todo with full details. arguments: - name: case_id description: The case ID. required: true - name: todo_id description: The todo ID. required: true outputs: - contextPath: DFIRe.CaseTodo.id description: The todo ID. type: Number - name: dfire-case-todo-assign description: Assigns a todo to a user. arguments: - name: case_id description: The case ID. required: true - name: todo_id description: The todo ID. required: true - name: user_id description: The user ID of the assignee. outputs: - contextPath: DFIRe.CaseTodo.id description: The todo ID. type: Number - contextPath: DFIRe.CaseTodo.assignee_name description: The assignee display name. type: String - name: dfire-case-todo-note-set description: Sets or replaces the note on a todo. arguments: - name: case_id description: The case ID. required: true - name: todo_id description: The todo ID. required: true - name: note description: The new note content. required: true outputs: - contextPath: DFIRe.CaseTodo.id description: The todo ID. type: Number - name: dfire-case-todo-attach-runbook description: Attaches a runbook to a todo. arguments: - name: case_id description: The case ID. required: true - name: todo_id description: The todo ID. required: true - name: runbook_slug description: The runbook slug to attach. required: true outputs: - contextPath: DFIRe.CaseTodo.id description: The todo ID. type: Number - contextPath: DFIRe.CaseTodo.runbook_slug description: The attached runbook slug. type: String - name: dfire-case-todo-detach-runbook description: Detaches the runbook from a todo. arguments: - name: case_id description: The case ID. required: true - name: todo_id description: The todo ID. required: true outputs: - contextPath: DFIRe.CaseTodo.id description: The todo ID. type: Number - name: dfire-case-timer-list description: Lists the SLA timers for a case. arguments: - name: case_id description: The case ID. required: true outputs: - contextPath: DFIRe.CaseTimer.id description: The timer ID. type: Number - contextPath: DFIRe.CaseTimer.name description: The timer name. type: String - contextPath: DFIRe.CaseTimer.framework description: The compliance framework. type: String - name: dfire-case-timer-get description: Retrieves a single SLA timer. arguments: - name: case_id description: The case ID. required: true - name: timer_id description: The timer ID. required: true outputs: - contextPath: DFIRe.CaseTimer.id description: The timer ID. type: Number - name: dfire-case-timer-complete description: Marks a case SLA timer as complete. arguments: - name: case_id description: The case ID. required: true - name: timer_id description: The timer ID. required: true outputs: - contextPath: DFIRe.CaseTimer.id description: The timer ID. type: Number - name: dfire-case-timer-reset description: Resets a case SLA timer. arguments: - name: case_id description: The case ID. required: true - name: timer_id description: The timer ID. required: true outputs: - contextPath: DFIRe.CaseTimer.id description: The timer ID. type: Number - name: dfire-case-get-by-number description: Looks up a case by its human-readable case number. arguments: - name: case_number description: The case number (e.g. "CASE-2026-0001"). required: true outputs: - contextPath: DFIRe.Case.id description: The case ID. type: Number - contextPath: DFIRe.Case.case_number description: The case number. type: String - name: dfire-item-resolve-short-id description: Resolves an 8-character item short ID to its full UUID and parent case ID. arguments: - name: short_id description: The first 8 characters of the item UUID. required: true outputs: - contextPath: DFIRe.Item.uuid description: The full item UUID. type: String - contextPath: DFIRe.Item.case description: The parent case ID. type: Number - name: dfire-incident-category-list description: Lists ENISA incident categories (useful for picklists). arguments: [] outputs: - contextPath: DFIRe.IncidentCategory.id description: The category ID. type: Number - contextPath: DFIRe.IncidentCategory.name description: The category name. type: String - name: dfire-incident-phase-list description: Lists configured incident-response phases. arguments: [] outputs: - contextPath: DFIRe.IncidentPhase.id description: The phase ID. type: Number - contextPath: DFIRe.IncidentPhase.name description: The phase name. type: String - name: dfire-outcome-verdict-list description: Lists case outcome verdicts (true positive, false positive, etc.). arguments: [] outputs: - contextPath: DFIRe.OutcomeVerdict.id description: The verdict ID. type: Number - contextPath: DFIRe.OutcomeVerdict.name description: The verdict name. type: String - name: dfire-project-list description: Lists projects. arguments: [] outputs: - contextPath: DFIRe.Project.id description: The project ID. type: Number - contextPath: DFIRe.Project.name description: The project name. type: String - name: dfire-runbook-list description: Lists available runbooks (used for todo runbook attachments). arguments: [] outputs: - contextPath: DFIRe.Runbook.slug description: The runbook slug. type: String - contextPath: DFIRe.Runbook.name description: The runbook name. type: String - name: dfire-group-list description: Lists user groups. arguments: [] outputs: - contextPath: DFIRe.Group.id description: The user group ID. type: Number - contextPath: DFIRe.Group.name description: The user group name. type: String fromversion: 6.10.0 tests: - No tests (auto formatted)