API docs by Redocly

IRIS (2.0.1)

Download OpenAPI specification:Download

DFIR-IRIS: contact@dfir-iris.org License: LGPLv3

IRIS API

To use these API endpoint, an API key is needed and can be found in every user profile under My settings > API Key. This specification applies to Iris v2.1.0 and onward. The supported API version can be checked in Advanced > Server settings > Server versions on IRIS.

Changes

Changes in v2.0.0

This version introduces access control. Every request now needs to have the cid=x parameter in the URI.
Deletion endpoints have been migrated from GET to POST. Deletion GET endpoints have been marqued as deprecated and are not available anymore.

Changes in v1.4.5

v1.4.5 introduced the concept of custom attributes. These JSON objects that are stored into almost all case objects such as Assets, IOCs, etc. They are defined by administrators or modules and can vary from one objet to another despite being of the same type. Because of this, no definitive structure can be expected from these fields. They are all named custom_attributes.

Case general

Update case summary

Update the summary of a case. Attention this will trigger an overwrite of the summary. Summaries are shared interactively between users. If an update summary is issued, every user will receive the change and their locale changes will be lost.
The summary is a markdown-compatible text.

Authorizations:
Bearer <bearer>
Request Body schema: application/json
case_description
required
string

The updated summary

cid
required
integer

Case ID

Responses

Request samples

Content type
application/json
{
  • "case_description": "Dummy description",
  • "cid": 1
}

Response samples

Content type
application/json
{
  • "data": 3837413706,
  • "message": "Summary updated",
  • "status": "success"
}

Add task log

Add a task log to the case. The task log is registered under Activities and is be availble in reports templating. If CID is omitted, the default case of the calling user is used.

Authorizations:
Bearer <bearer>
Request Body schema: application/json
log_content
string
cid
integer

Responses

Request samples

Content type
application/json
{
  • "log_content": "A test"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Log saved",
  • "status": "success"
}

Export a case as JSON

Export a case in JSON format including all the information such as assets, iocs, etc. This request can take a very long time depending on the size of the case.

Authorizations:
Bearer <bearer>
query Parameters
cid
string

ID Of the case to export

Case assets

Get list of assets

Get a list of the assets linked to the case.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Fetch an asset

Fetch the content of an asset

Authorizations:
Bearer <bearer>
path Parameters
asset_id
required
integer
query Parameters
cid
string

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Add a new asset

Create an asset and link it to the case.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
asset_name
string
asset_type_id
integer
asset_domain
string
asset_ip
string
asset_info
string
asset_compromise_status_id
integer
analysis_status_id
integer
ioc_links
integer
asset_tags
string
asset_description
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "asset_name": "Demo asset",
  • "asset_type_id": 3,
  • "asset_domain": "my domain",
  • "asset_ip": "0.0.0.0",
  • "asset_info": "Additional info",
  • "asset_compromise_status_id": 1,
  • "analysis_status_id": 3,
  • "ioc_links": [
    ],
  • "asset_tags": "this,tag",
  • "asset_description": "Asset description",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Asset added",
  • "status": "success"
}

Update an asset

Update an asset

Authorizations:
Bearer <bearer>
path Parameters
asset_id
required
string

ID of the asset to update

query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
asset_name
string
asset_type_id
integer
analysis_status_id
integer
asset_description
string
asset_domain
string
asset_ip
string
asset_info
string
asset_compromise_status_id
integer
asset_tags
string
custom_attributes
object
cid
integer
ioc_links
Array of integers

Responses

Request samples

Content type
application/json
{
  • "asset_name": "string",
  • "asset_type_id": 1,
  • "analysis_status_id": 1,
  • "asset_description": "string",
  • "asset_domain": "string",
  • "asset_ip": "string",
  • "asset_info": "string",
  • "asset_compromise_status_id": 1,
  • "asset_tags": "string",
  • "custom_attributes": { },
  • "cid": 1,
  • "ioc_links": [
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Updated asset string",
  • "status": "success"
}

Delete an asset Deprecated

This endpoint is deprecated. Use the POST equivalent.

Authorizations:
Bearer <bearer>
path Parameters
asset_id
required
string

ID of the note to delete

query Parameters
cid
required
string

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Deleted",
  • "status": "success"
}

Delete an asset

Delete an asset based on its ID. If the asset is linked to an event, the reference is deleted but not the event.

Authorizations:
Bearer <bearer>
path Parameters
asset_id
required
string

ID of the note to delete

query Parameters
cid
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "value": {
    }
}

Case notes

Get list of groups and notes

Get a list of the notes and groups. The content notes is not returned.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Fetch a notes group

Fetch a notes group

Authorizations:
Bearer <bearer>
path Parameters
group_id
required
string

ID of the group to return

query Parameters
cid
required
string

ID Of the case

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Add a new notes group

The created group is empty.

Authorizations:
Bearer <bearer>
Request Body schema: application/json

If the group title isn't set, a default group name is set by the server.

group_title
string non-empty
cid
required
number

Responses

Request samples

Content type
application/json
{
  • "group_title": "Test",
  • "cid": 5
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Update a notes group

Update the title of a note group

Authorizations:
Bearer <bearer>
path Parameters
group_id
required
string

Group ID to update

Request Body schema: application/json
group_title
required
string non-empty
cid
required
number

Responses

Request samples

Content type
application/json
{
  • "group_title": "Test",
  • "cid": 5
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Updated title of group ID 38",
  • "status": "success"
}

Delete a group note Deprecated

This endpoint is deprecated. Use the POST equivalent.

Authorizations:
Bearer <bearer>
path Parameters
group_id
required
string

ID of the group to delete

query Parameters
cid
required
integer

ID Of the case

Delete notes group

Delete a case notes group

Authorizations:
Bearer <bearer>
path Parameters
group_id
required
string

ID of the group to delete

query Parameters
cid
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Group ID 22 deleted",
  • "status": "success"
}

Add a new note

Add a new note to an existing group.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
note_title
required
string non-empty
note_content
required
string non-empty
group_id
required
number

Responses

Request samples

Content type
application/json
{
  • "note_title": "Title of the note",
  • "note_content": "Content of the note",
  • "group_id": 36,
  • "cid": 2
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Note added",
  • "status": "success"
}

Fetch a note

Fetch the content and information of a note

Authorizations:
Bearer <bearer>
path Parameters
note_id
required
integer

ID of the note to fetch

query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Delete a note

Delete a note.

Authorizations:
Bearer <bearer>
path Parameters
note_id
required
string

ID of the note to delete

query Parameters
cid
required
string

Case ID

Responses

Response samples

Content type
{
  • "data": [ ],
  • "message": "Deleted",
  • "status": "success"
}

Delete note Deprecated

This endpoint is deprecated. Use the POST equivalent.

Authorizations:
Bearer <bearer>
path Parameters
note_id
required
string

ID of the note to delete

Responses

Save a note

Update the content of a note.

Authorizations:
Bearer <bearer>
path Parameters
note_id
required
string

ID of the note to save

query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
note_title
required
string non-empty
note_content
string non-empty
custom_attributes
object
cid
required
integer

Responses

Request samples

Content type
application/json
{
  • "note_title": "New title",
  • "note_content": "New content",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Note ID 9 saved",
  • "status": "success"
}

Case IOC

Get list of IOCs

Returns a list of IOCs as well as any existing linked with other cases.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Fetch an ioc

Fetch the content of an ioc

Authorizations:
Bearer <bearer>
path Parameters
ioc_id
required
integer

ID of the IOC to fetch

query Parameters
cid
string

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Add a new ioc

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
ioc_type_id
required
integer
ioc_tlp_id
required
integer
ioc_value
required
string non-empty
ioc_description
required
string non-empty
ioc_tags
required
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "ioc_type_id": 1,
  • "ioc_tlp_id": 2,
  • "ioc_value": "8.8.8.8",
  • "ioc_description": "rewrw",
  • "ioc_tags": "",
  • "custom_attributes": { },
  • "cid": 2
}

Response samples

Content type
application/json
Example
{
  • "data": {
    },
  • "message": "IOC added",
  • "status": "success"
}

Delete an IOC

Delete an IOC from the case. If the IOC is still reference in other cases than it's only unlinked from the current case.

Authorizations:
Bearer <bearer>
path Parameters
ioc_id
required
integer
query Parameters
cid
required
string

Case ID

Responses

Response samples

Content type
application/json
Example
{
  • "data": [ ],
  • "message": "IOC deleted",
  • "status": "success"
}

Delete an IOC Deprecated

This endpoint is deprecated. Use the POST equivalent.

Authorizations:
Bearer <bearer>
path Parameters
ioc_id
required
integer

Responses

Update an IOC

Authorizations:
Bearer <bearer>
path Parameters
ioc_id
required
integer
query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
ioc_value
string
ioc_tlp_id
integer
ioc_type_id
integer
ioc_description
string
ioc_tags
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "ioc_type_id": 1,
  • "ioc_tlp_id": 2,
  • "ioc_value": "evil",
  • "ioc_description": "IOC description",
  • "ioc_tags": "tag1,tag2",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Updated ioc \"evil\"",
  • "status": "success"
}

Case timeline

Fetch the timeline Deprecated

The endpoint is deprecated. Use case/timeline/advanced-filter.

Authorizations:
Bearer <bearer>
path Parameters
asset_id
required
integer

Filter by assets

query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "string",
  • "status": "string"
}

Fetch the timeline

Filter the timeline through a query. q should be a valid JSON mapping {field1:[value], field2: [value2]}.
Fields are AND together. The query needs to be URL encoded.

The following fields are available:

  • asset: Asset linked to the event
  • ioc: IOC linked to the event
  • tag: Tag within the event
  • title: Title of the event
  • description: Description of the event
  • raw : Raw event content
  • category: Category of the event
  • source: Source of the event
  • startDate: Start date to filter with
  • endDate: End date to filter with
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

q
required
string

Query filter

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "string",
  • "status": "string"
}

Fetch the timeline Deprecated

The endpoint is deprecated. Use case/timeline/advanced-filter.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

Fetch the timeline

Fetch the state of the timeline.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
string

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Add a new event

Create a new event in the timeline.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
event_title
string
event_raw
string
event_source
string
event_assets
Array of integers
event_iocs
Array of integers
event_category_id
string
event_in_summary
boolean
event_in_graph
boolean
event_color
string
event_date
string
event_sync_iocs_assets
boolean
event_tags
string
event_tz
string
event_content
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "event_title": "An event",
  • "event_raw": "My event raw data",
  • "event_source": "My source",
  • "event_assets": [
    ],
  • "event_iocs": [
    ],
  • "event_category_id": "5",
  • "event_in_summary": true,
  • "event_in_graph": true,
  • "event_color": "#1572E899",
  • "event_date": "2023-03-08T03:02:00.000",
  • "event_sync_iocs_assets": true,
  • "event_tags": "tag",
  • "event_tz": "+00:00",
  • "event_content": "My description",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "string",
  • "status": "string"
}

Update an event

Update an event in the timeline

Authorizations:
Bearer <bearer>
path Parameters
event_id
required
integer
query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
event_title
string
event_raw
string
event_source
string
event_assets
Array of integers
event_iocs
Array of integers
event_category_id
integer
event_in_summary
boolean
event_in_graph
boolean
event_color
string
event_date
string
event_sync_iocs_assets
boolean
event_tags
string
event_tz
string
event_content
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "event_title": "An event",
  • "event_raw": "My event raw data",
  • "event_source": "Source",
  • "event_assets": [
    ],
  • "event_iocs": [
    ],
  • "event_category_id": 5,
  • "event_in_summary": true,
  • "event_in_graph": true,
  • "event_color": "#1572E899",
  • "event_date": "2023-03-08T03:02:00.000",
  • "event_sync_iocs_assets": true,
  • "event_tags": "tag",
  • "event_tz": "+00:00",
  • "event_content": "My description",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Event updated",
  • "status": "success"
}

Delete an event

Delete an event from the timeline

Authorizations:
Bearer <bearer>
path Parameters
event_id
required
integer
query Parameters
cid
string

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Event ID 14984 deleted",
  • "status": "success"
}

Delete an event Deprecated

This endpoint is deprecated. Use the POST equivalent.

Authorizations:
Bearer <bearer>
path Parameters
event_id
required
integer

Responses

Fetch an event

Return information of an event of the timeline

Authorizations:
Bearer <bearer>
path Parameters
event_id
required
integer
query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Case tasks

Get case tasks

Get a list of all the tasks in the case

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Delete a case task

Delete a case task.

Authorizations:
Bearer <bearer>
path Parameters
task_id
required
integer

Task ID to delete

query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Task deleted",
  • "status": "success"
}

Delete a case task

This endpoint is deprecated. Use the POST equivalent.

Authorizations:
Bearer <bearer>
path Parameters
task_id
required
integer

Task ID to delete

Responses

Fetch a case task

Return information of a specific task

Authorizations:
Bearer <bearer>
path Parameters
task_id
required
integer

Task ID to delete

query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Add a case task

Add a new task to the case.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
task_assignees_id
Array of integers
task_description
string
task_status_id
integer
task_tags
string
task_title
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "task_assignees_id": [
    ],
  • "task_description": "",
  • "task_status_id": 1,
  • "task_tags": "",
  • "task_title": "dummy title",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Task 'dummy title' added",
  • "status": "success"
}

Update a case task

Update an existing task of the case.

Authorizations:
Bearer <bearer>
path Parameters
task_id
required
integer

ID of the task

query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
task_assignees_id
Array of integers
task_status_id
integer
task_title
string
task_description
string
task_tags
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "task_assignees_id": [
    ],
  • "task_status_id": 1,
  • "task_title": "New title",
  • "task_description": "new content",
  • "task_tags": "new tags",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Task 'New title' updated",
  • "status": "success"
}

Case evidences

Get case evidences

Returns a list of all evidences linked to the case.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

case id

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Get an evidence

Returns information of a specific evidence

Authorizations:
Bearer <bearer>
path Parameters
evidence_id
required
integer

Evidence ID

query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Delete a case evidence

Remove an evidence from the case.

Authorizations:
Bearer <bearer>
path Parameters
evidence_id
required
integer

Evidence ID

query Parameters
cid
required
string

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "string",
  • "status": "string"
}

Delete an evidence

This endpoint is depreacted. Please use the POST equivalent.

Authorizations:
Bearer <bearer>
path Parameters
evidence_id
required
integer

Evidence ID

Responses

Update an evidence

Update an evidence.

Authorizations:
Bearer <bearer>
path Parameters
evidence_id
required
integer

Evidence ID

query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
filename
required
string non-empty
file_size
required
integer
file_hash
required
string non-empty
file_description
required
string non-empty
custom_attributes
required
object

Responses

Request samples

Content type
application/json
{
  • "filename": "string",
  • "file_size": 0,
  • "file_hash": "string",
  • "file_description": "string",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Evidence string updated",
  • "status": "success"
}

Add an evidence

Add a new evidence to the case.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
filename
string
file_size
integer
file_hash
string
file_description
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "filename": "string",
  • "file_size": 0,
  • "file_hash": "string",
  • "file_description": "string",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "string",
  • "status": "string"
}

Alerts

Fetch an alert

Fetch an alert

Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID

Responses

Filter alerts

Filter alerts. This endpoint uses paging. Each response contains a total, last_page, current_page and next_page information to fetch the next results.

Authorizations:
Bearer <bearer>
query Parameters
alert_title
string
alert_description
string
alert_source
string
alert_tags
string

Comma separated list of tags

alert_status_id
integer
alert_severity_id
integer
alert_classification_id
integer
alert_customer_id
integer
alert_start_date
string
alert_end_date
string
alert_assets
string

Comma separated list of assets

alert_iocs
string

Comma separated list of IOCs

alert_ids
string

Comma separated list of IDs

case_id
integer
alert_owner_id
integer
page
integer

Page to fetch

per_page
integer

Number of results per page

sort
string

desc or asc, based on the source alert time

Responses

Add an alert

Add a new alert.

Authorizations:
Bearer <bearer>
Request Body schema: application/json
alert_title
string
alert_description
string
alert_source
string
alert_source_ref
string
alert_source_link
string
alert_severity_id
integer
alert_status_id
integer
object

Key-value JSON

alert_source_event_time
string
alert_note
string
alert_tags
string
Array of objects
Array of objects
alert_customer_id
integer
alert_classification_id
integer
alert_source_content
object

Free JSON representing the source alert

Responses

Request samples

Content type
application/json
{
  • "alert_title": "Low-reputation arbitrary code executed by signed executable",
  • "alert_description": "This is a test alert, courtesy of MS",
  • "alert_source": "Test Source",
  • "alert_source_ref": "Test-123",
  • "alert_source_link": "https://source_link.com",
  • "alert_source_content": {
    },
  • "alert_severity_id": 4,
  • "alert_status_id": 3,
  • "alert_context": {
    },
  • "alert_source_event_time": "2023-03-26T03:00:30",
  • "alert_note": "A note on",
  • "alert_tags": "defender,anothertag",
  • "alert_iocs": [
    ],
  • "alert_assets": [
    ],
  • "alert_customer_id": 1,
  • "alert_classification_id": 1
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Update an alert

Update an existing alert. To update only specific fields one can send only those fields.

Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID to update

Request Body schema: application/json
alert_title
string
alert_description
string
alert_source
string
alert_source_ref
string
alert_source_link
string
alert_severity_id
integer
alert_status_id
integer
object

Key-value JSON

alert_source_event_time
string
alert_note
string
alert_tags
string
Array of objects
Array of objects
alert_customer_id
integer
alert_classification_id
integer
alert_source_content
object

Free JSON representing the source alert

Responses

Request samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "string",
  • "status": "string"
}

Delete an alert

Delete an alert

Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID to delete

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Escalate an alert

Escalate an alert into a new case.

Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID to escalate

Request Body schema: application/json
iocs_import_list
Array of strings

A list of UUID matching the IOCs to import into the case. These UUIDs are provided when getting information on an alert.

assets_import_list
Array of strings

A list of UUID matching the assets to import into the case. These UUIDs are provided when getting information on an alert.

note
string
import_as_event
boolean

If set to True, a new event representing the alert is created in the case.

case_tags
string
case_template_id
string
case_title
string

Responses

Request samples

Content type
application/json
{
  • "iocs_import_list": [
    ],
  • "assets_import_list": [
    ],
  • "note": "Escalation note",
  • "import_as_event": true,
  • "case_tags": "Mobile Device Management (MDM) System",
  • "case_template_id": "1",
  • "case_title": "[ALERT] Command & Control Traffic 15"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Merge an alert

Merge an alert into an existing case.

Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID to merge

Request Body schema: application/json
iocs_import_list
Array of strings

A list of UUID matching the IOCs to import into the case. These UUIDs are provided when getting information on an alert.

assets_import_list
Array of strings

A list of UUID matching the assets to import into the case. These UUIDs are provided when getting information on an alert.

note
string
import_as_event
boolean

If set to True, a new event representing the alert is created in the case.

target_case_id
integer

Responses

Request samples

Content type
application/json
{
  • "iocs_import_list": [
    ],
  • "assets_import_list": [
    ],
  • "note": "dsa",
  • "import_as_event": true,
  • "target_case_id": "14"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Unmerge an alert

Unmerge an alert from a case. The alert is unlinked but the data provided by the alert (such as IOCs, assets, etc) remain in the case.

Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID to unmerge

Request Body schema: application/json
target_case_id
integer

Responses

Request samples

Content type
application/json
{
  • "iocs_import_list": [
    ],
  • "assets_import_list": [
    ],
  • "note": "dsa",
  • "import_as_event": true,
  • "target_case_id": "14"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Datastore

Get the datastore tree

List datastore folders and files

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Add a new file

Add a new file to the datastore. The file password is not encrypted and transmited in view requests.

Authorizations:
Bearer <bearer>
path Parameters
parent_id
required
integer

Parent folder ID

Request Body schema: multipart/form-data
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_original_name"

the_original_filename
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_description"

File description
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_password"

FilePassword
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_tags"

tag1,tag2
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_is_evidence"

y
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_content"; filename="new filename"
Content-Type: text/markdown

File Content

-----------------------------139681927112990666592379500992--
file_original_name
string
file_description
string
file_password
string
file_tags
string
file_is_evidence
string
file_content
string

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "File saved in datastore and added in evidence",
  • "status": "success"
}

Get datastore file info

Get a datastore file information. To download a file, use the /datastore/file/view endpoint.

Authorizations:
Bearer <bearer>
path Parameters
file_id
required
integer

File ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Update datastore file information

Update a datastore file. The file content can be replaced. If a password was previously set, it is removed and cannot be re-enabled. The file identifiers stay the same.

Authorizations:
Bearer <bearer>
path Parameters
file_id
required
integer

File ID

Request Body schema: application/json
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_original_name"

the_original_filename
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_description"

File description
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_tags"

tag1,tag2
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_is_evidence"

y
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_is_ioc"

y
-----------------------------139681927112990666592379500992
Content-Disposition: form-data; name="file_content"; filename="new filename"
Content-Type: text/markdown

File Content

-----------------------------139681927112990666592379500992--
object

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "File saved in datastore and added in evidence",
  • "status": "success"
}

Delete a datastore file

Delete a file from the datastore. Once deleted the file cannot be recovered.

Authorizations:
Bearer <bearer>
path Parameters
file_id
required
integer

File ID

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "File 32 deleted",
  • "status": "success"
}

Download a datastore file

Download the content of a datastore file

Authorizations:
Bearer <bearer>
path Parameters
file_id
required
integer

File ID

Move a datastore file

Move a file to a new folder.

Authorizations:
Bearer <bearer>
path Parameters
file_id
required
string
Request Body schema: application/json
destination-node
integer

Responses

Request samples

Content type
application/json
{
  • "destination-node": 0
}

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "File successfully moved to IOCs",
  • "status": "success"
}

Add a datastore folder

Add a new datastore folder.

Authorizations:
Bearer <bearer>
Request Body schema: application/json
folder_name
string
parent_node
integer

Responses

Request samples

Content type
application/json
{
  • "folder_name": "string",
  • "parent_node": 0
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Folder added",
  • "status": "success"
}

Delete a datastore folder

Delete a folder. The children are also deleted.

Authorizations:
Bearer <bearer>
path Parameters
folder_id
required
integer

Folder ID

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Folder and children deleted",
  • "status": "success"
}

Rename a datastore folder

Rename a datastore folder.

Authorizations:
Bearer <bearer>
path Parameters
folder_id
required
string
query Parameters
cid
integer

Case ID

Request Body schema: application/json
parent_node
string
folder_name
string

Responses

Request samples

Content type
application/json
{
  • "parent_node": "53",
  • "folder_name": "New folder name"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Folder renamed",
  • "status": "success"
}

Move a datastore folder

Move a folder to a new folder.

Authorizations:
Bearer <bearer>
path Parameters
folder_id
required
integer

Folder ID

Request Body schema: application/json
destination-node
integer

Responses

Request samples

Content type
application/json
{
  • "destination-node": 49
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Folder \"New folder name\" successfully moved to \"Evidences\"",
  • "status": "success"
}

Comments

Add a new comment to a case object

Add a new comment to a case object

Authorizations:
Bearer <bearer>
path Parameters
object_name
required
string
Enum: "notes" "assets" "ioc" "events" "tasks" "evidences"

Name of the case object to comment

object_id
required
integer

ID of the object to comment

Request Body schema: application/json
comment_text
string

Responses

Request samples

Content type
application/json
{
  • "comment_text": "string"
}

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

List the comments of an object

List the comments a case object

Authorizations:
Bearer <bearer>
path Parameters
object_name
required
string
Enum: "notes" "assets" "ioc" "events" "tasks" "evidences"

Name of the case object to comment

object_id
required
integer

ID of the object to comment

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

Delete an object

Authorizations:
Bearer <bearer>
path Parameters
object_name
required
string
Enum: "notes" "assets" "ioc" "events" "tasks" "evidences"

Name of the case object to comment

object_id
required
integer

ID of the object to comment

comment_id
required
integer

ID of the comment to update

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Comment deleted",
  • "status": "success"
}

Edit a comment

Edit a comment

Authorizations:
Bearer <bearer>
path Parameters
object_name
required
string

Name of the case object to comment

object_id
required
integer

ID of the object to comment

comment_id
required
integer

ID of the comment to update

Request Body schema: application/json
comment_text
string

Responses

Request samples

Content type
application/json
{
  • "comment_text": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Comment edited",
  • "status": "success"
}

Iris Modules

Iris module task list

List current and previous tasks run by modules.

Authorizations:
Bearer <bearer>
path Parameters
rows_count
required
integer

Number of rows to return

Responses

Response samples

Content type
application/json
No sample

Iris module task list Deprecated

This endpoint is depreacted. Use /dim/tasks/list/

Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "string",
  • "status": "string"
}

Iris module task list

List all manual hooks available for a particular case object.
Available objects types are :

  • case
  • ioc
  • asset
  • note
  • event
  • task
  • evidence
  • global_task

The returned information can provided to the /dim/hooks/call endpoint to trigger a hook.

Authorizations:
Bearer <bearer>
path Parameters
object_type
required
string

Object type

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

Call a module

Executes a manual trigger on a specified hook. This allows to trigger a hook as it would be done on the GUI. This only concerns manual hooks, and each call triggers a specific hook of a specific module, as specified in the request.

To get a list of all available hooks for a case object, use the /dim/hooks/options/<type>/list endpoint.

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

Request Body schema: application/json
hook_name
required
string non-empty

Internal name of the hook as specified in the hook documentation.

module_name
required
string non-empty

Name of the module to call

hook_ui_name
required
string non-empty

UI name of the hook, either auto generated by IRIS or provided by the module itself.

type
required
string non-empty

Type of data processed by the hook (ioc, asset, etc)

targets
required
Array of objects

List of objects ID of type "type" to process

Responses

Request samples

Content type
application/json
{
  • "hook_name": "on_manual_trigger_ioc",
  • "module_name": "iris_vt_module",
  • "hook_ui_name": "Get VT insight",
  • "type": "ioc",
  • "targets": [
    ]
}

Global tasks

List global tasks

Returns a list of all global tasks

Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Add a global task

Add a global task and assign it to a user.

Authorizations:
Bearer <bearer>
Request Body schema: application/json
task_assignee_id
required
integer

A user ID for whom the task will be assigned

task_status_id
required
integer

The initial status of the task

task_title
required
string >= 2 characters
task_description
required
string
task_tags
required
string

Responses

Request samples

Content type
application/json
{
  • "task_assignee_id": 1,
  • "task_status_id": 14,
  • "task_title": "Task title",
  • "task_description": "My task description",
  • "task_tags": ""
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Saved !",
  • "status": "success"
}

Update a global task

Authorizations:
Bearer <bearer>
path Parameters
task_id
required
string

Global task ID to update

Request Body schema: application/json
task_assignee_id
required
integer
task_status_id
required
integer
task_title
required
string non-empty
task_description
required
string non-empty
task_tags
required
string non-empty
cid
integer

Responses

Request samples

Content type
application/json
{
  • "task_assignee_id": 155,
  • "task_status_id": 14,
  • "task_title": "Task title",
  • "task_description": "A super description",
  • "task_tags": "tag1,tag2,tag3",
  • "cid": 1
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "string",
  • "status": "string"
}

Delete a global task

Authorizations:
Bearer <bearer>
path Parameters
task_id
required
string

Task to delete

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Task deleted",
  • "status": "success"
}

Manage case

Add a new case

Create a new immediate case. If cid is not set, a default case ID 1 is used. This does not change the behavior of the request and is only used for internal tracking.

Authorizations:
Bearer <bearer>
Request Body schema: application/json
case_soc_id
required
string non-empty

A SOC ticket reference

case_customer
required
number

The customer ID linked to the case.

case_name
required
string >= 2 characters

A short name for the case. The case number will be prepend.

case_description
required
string >= 2 characters

A short description of the case. This will be the summary of the case.

cid
integer

Context case ID. If not set, a default case is used.

custom_attributes
object
case_template_id
integer
classification_id
integer

Responses

Request samples

Content type
application/json
{
  • "case_soc_id": "SOC_154",
  • "case_customer": 1,
  • "case_name": "My Case API",
  • "case_description": "A super nice description"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Case created",
  • "status": "success"
}

Get cases list

Returns a list of all the cases, open and closed.

Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": [
    ]
}

Close a case Deprecated

This endpoint is deprecated - use the POST equivalent.

Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Case closed successfully",
  • "status": "success"
}

Reopen a case Deprecated

This endpoint is deprecated. Use the POST equivalent.

Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Case reopened successfully",
  • "status": "success"
}

Delete a case

This implies the deletion of everything linked to the case including summary, assets, notes, timeline, tasks and evidences. The IOCs will only be deleted if they are not referenced in another case.

Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Case successfully deleted",
  • "status": "success"
}

Delete case Deprecated

This endpoint is deprecated. Use the POST equivalent.

Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

Responses

Update a case

Update informations of a case.

Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

Request Body schema: application/json
case_name
string
case_soc_id
string
classification_id
string
owner_id
string
state_id
string
status_id
string
Array of objects
case_tags
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "case_name": "Dummy ",
  • "case_soc_id": "soc_id_demo",
  • "classification_id": "2",
  • "owner_id": "2",
  • "status_id": "1",
  • "protagonists": [
    ],
  • "case_tags": "tag1,tag2",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Case updated",
  • "data": {