Security & Identity · CONNECTIONManage DFIR-IRIS incident response cases, their IOCs, assets, tasks and notes, and alerts, on your own IRIS instance.
Explore 18 workflow actions for DFIR-IRIS, including account permissions and operation limits.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Add an asset, like a host or account, to a case.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Add an indicator of compromise to a case.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Add a note to a case's notes directory.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Add a task to a case and assign it.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Raise an alert, optionally with IOCs.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Open a case for a customer.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Delete an alert.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Delete a case.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Delete a case IOC.
A repeated request may repeat the external action. Review the previous result before retrying a write.
List alerts by title, source, tags, status, severity, classification, customer, dates, assets, IOCs or IDs.
Read an alert.
Read a case.
List a case's assets.
List a case's indicators of compromise.
List a case's tasks.
List cases by name, customer, owner, state, severity, SOC ID, open dates or open state.
Change only the given fields of an alert.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Change only the given fields of a case.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
Inspect step outputs and confirm the result in DFIR-IRIS. A saved workflow is not a completed provider action.
