diff --git a/2.4.7/_static/iris_api_reference_v2.0.4.html b/2.4.7/_static/iris_api_reference_v2.0.4.html new file mode 100644 index 00000000..8fd6138a --- /dev/null +++ b/2.4.7/_static/iris_api_reference_v2.0.4.html @@ -0,0 +1,2793 @@ + + + + + + IRIS + + + + + + + + + +
API docs by Redocly

IRIS (2.0.4)

Download OpenAPI specification:Download

DFIR-IRIS: contact@dfir-iris.org URL: https://docs.dfir-iris.org/contact/ License: LGPLv3

IRIS API

To use these API endpoint, an API key is needed and can be found in every user profile under My settings > API Key. +This specification applies to v2.4.0 > Iris > v2.3.7. The supported API version can be checked in Advanced > Server settings > Server versions on IRIS.
The API port is the same as the one used for the web interface, so 443 by default.

+

Changes

Changes in v2.0.0

+

This version introduces access control. Every request now needs to have the cid=x parameter in the URI.
Deletion endpoints have been migrated from GET to POST. Deletion GET endpoints have been marqued as deprecated and are not available anymore.

+

Changes in v1.4.5

+

v1.4.5 introduced the concept of custom attributes. These JSON objects that are stored into almost all case objects such as Assets, IOCs, etc. They are defined by administrators or modules and can vary from one objet to another despite being of the same type. Because of this, no definitive structure can be expected from these fields. They are all named custom_attributes.

+

Case general

Update case summary

Update the summary of a case. Carefull: this will trigger an overwrite of the summary. Summaries are shared interactively between users. If an update summary is issued, every user will receive the change and their locale changes will be lost.
The summary is a markdown-compatible text.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
string

Case ID

+
Request Body schema: application/json
case_description
required
string

The updated summary

+

Responses

Request samples

Content type
application/json
{
  • "case_description": "Dummy description",
  • "cid": 1
}

Response samples

Content type
application/json
{
  • "data": 3837413706,
  • "message": "Summary updated",
  • "status": "success"
}

Add task log

Add a task log to the case. The task log is registered under Activities and is be availble in reports templating. +If CID is omitted, the default case of the calling user is used.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
string

Case ID

+
Request Body schema: application/json
log_content
required
string

Responses

Request samples

Content type
application/json
{
  • "log_content": "A test"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Log saved",
  • "status": "success"
}

Export a case as JSON

Export a case in JSON format including all the information such as assets, iocs, etc. This request can take a very long time depending on the size of the case and is DB intensive.
The datastore is not part of the response and needs to be requested manually.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
string

ID Of the case to export

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Case assets

Get list of assets

Get a list of the assets linked to the case.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Fetch an asset

Fetch an asset.

+
Authorizations:
Bearer <bearer>
path Parameters
asset_id
required
integer
query Parameters
cid
required
string

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Add a new asset

Create an asset and link it to the case.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
asset_type_id
required
string
asset_domain
string
asset_ip
string
asset_info
string
asset_compromise_status_id
string
analysis_status_id
string
ioc_links
Array of strings
asset_name
required
string
asset_tags
string
asset_description
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "asset_type_id": "9",
  • "asset_domain": "iris.local",
  • "asset_ip": "127.0.0.1",
  • "asset_info": "",
  • "asset_compromise_status_id": "1",
  • "analysis_status_id": "3",
  • "ioc_links": [
    ],
  • "asset_name": "admin_laptop",
  • "asset_tags": "anewtag",
  • "asset_description": "A host description",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Asset added",
  • "data": {
    }
}

Update an asset

Update an asset

+
Authorizations:
Bearer <bearer>
path Parameters
asset_id
required
string

ID of the asset to update

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
asset_name
required
string
asset_type_id
required
string
asset_domain
string
asset_ip
string
asset_info
string
asset_compromise_status_id
string
analysis_status_id
string
ioc_links
Array of strings
asset_tags
string
asset_description
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "asset_name": "admin_laptop",
  • "asset_type_id": "9",
  • "asset_domain": "iris.local",
  • "asset_ip": "127.0.0.1",
  • "asset_info": "",
  • "asset_compromise_status_id": "1",
  • "analysis_status_id": "3",
  • "ioc_links": [
    ],
  • "asset_tags": "anewtag",
  • "asset_description": "A host description",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Updated asset admin_laptop",
  • "data": {
    }
}

Delete an asset Deprecated

This endpoint is deprecated. Use the POST equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
asset_id
required
string

ID of the note to delete

+
query Parameters
cid
required
string

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Deleted",
  • "status": "success"
}

Delete an asset

Delete an asset based on its ID. If the asset is linked to an event, the reference is deleted but not the event.

+
Authorizations:
Bearer <bearer>
path Parameters
asset_id
required
string

ID of the note to delete

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "value": {
    }
}

Case notes

Get list of groups and notes Deprecated

This endpoint is deprecated. Use /case/notes/directories/filter.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Get list of directories and notes

List the directories and notes associated to it.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": [
    ]
}

Fetch a notes group Deprecated

This endpoint is deprecated and not replaced yet.

+
Authorizations:
Bearer <bearer>
path Parameters
group_id
required
string

ID of the group to return

+
query Parameters
cid
required
string

ID Of the case

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Add a new notes group Deprecated

This endpoint is deprecated. Use /cases/notes/directories/add.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
string

Case ID

+
Request Body schema: application/json

If the group title isn't set, a default group name is set by the server.

+
group_title
string non-empty

Responses

Request samples

Content type
application/json
{
  • "group_title": "Test"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Notes group added",
  • "data": {
    }
}

Add a new notes directory

Create a new empty directory.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
string

Case ID

+
Request Body schema: application/json
name
required
string non-empty
parent_id
number

An existing parent directory ID. To add at the root, do not set the field or set it to null.

+

Responses

Request samples

Content type
application/json
{
  • "name": "Test",
  • "parent_id": null
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Notes group added",
  • "data": {
    }
}

Update a notes group Deprecated

This endpoint is deprecated. Use /case/notes/directories/update/{directory_id}.

+
Authorizations:
Bearer <bearer>
path Parameters
group_id
required
string

Group ID to update

+
query Parameters
cid
required
string

case ID

+
Request Body schema: application/json
group_title
required
string non-empty

Responses

Request samples

Content type
application/json
{
  • "group_title": "Test"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Updated title of group ID 186",
  • "data": {
    }
}

Update a notes directory Deprecated

Update the parent and name of a notes directory.

+
Authorizations:
Bearer <bearer>
path Parameters
directory_id
required
integer
query Parameters
cid
required
string

case ID

+
Request Body schema: application/json
name
required
string non-empty
parent_id
integer

An existing parent directory ID. To add at the root, do not set the field or set it to null.

+

Responses

Request samples

Content type
application/json
{
  • "name": "Test 1"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Directory modified",
  • "data": {
    }
}

Delete a group note Deprecated

This endpoint is deprecated. Use the POST /case/notes/directories/delete/{directory_id} equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
group_id
required
string
query Parameters
cid
required
integer

ID Of the case

+

Delete notes group Deprecated

This endpoint is deprecated. Use the POST /case/notes/directories/delete/{directory_id} equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
group_id
required
string
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Group ID 22 deleted",
  • "status": "success"
}

Delete notes group Deprecated

Delete a directory and its content including the associated subdirectories and notes.

+
Authorizations:
Bearer <bearer>
path Parameters
directory_id
required
integer
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Directory deleted",
  • "data": [ ]
}

Add a new note

Add a new note to an existing group.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
note_title
required
string non-empty
note_content
required
string non-empty
directory_id
required
number

Responses

Request samples

Content type
application/json
{
  • "note_title": "Title of the note",
  • "note_content": "Content of the note",
  • "directory_id": 36
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Note added",
  • "data": {
    }
}

Fetch a note

Fetch the content and metadata of a note.

+
Authorizations:
Bearer <bearer>
path Parameters
note_id
required
integer

ID of the note to fetch

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Save a note

Update the content and metadata of a note.

+
Authorizations:
Bearer <bearer>
path Parameters
note_id
required
integer

ID of the note to save

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
note_title
required
string
note_content
required
string
custom_attributes
object
parent_id
integer

Responses

Request samples

Content type
application/json
{
  • "note_title": "New title",
  • "note_content": "New content",
  • "custom_attributes": { },
  • "directory_id": 4
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Note ID 16 saved",
  • "data": {
    }
}

Delete a note

Delete a note.

+
Authorizations:
Bearer <bearer>
path Parameters
note_id
required
string

ID of the note to delete

+
query Parameters
cid
required
string

Case ID

+

Responses

Response samples

Content type
{
  • "status": "success",
  • "message": "Note deleted 856",
  • "data": [ ]
}

Delete note Deprecated

This endpoint is deprecated. Use the POST equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
note_id
required
string

ID of the note to delete

+

Responses

Case IOC

Get list of IOCs

Returns a list of IOCs as well as any existing links with other cases.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Fetch an ioc

Fetch an IOC

+
Authorizations:
Bearer <bearer>
path Parameters
ioc_id
required
integer

ID of the IOC to fetch

+
query Parameters
cid
required
string

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Add a new ioc

Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
ioc_type_id
required
integer
ioc_tlp_id
required
integer
ioc_value
required
string non-empty
ioc_description
required
string non-empty
ioc_tags
required
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "ioc_type_id": 1,
  • "ioc_tlp_id": 2,
  • "ioc_value": "8.8.8.8",
  • "ioc_description": "rewrw",
  • "ioc_tags": "",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
Example
{
  • "status": "success",
  • "message": "IOC added",
  • "data": {
    }
}

Delete an IOC

Delete an IOC from the case. If the IOC is still reference in other cases than it's only unlinked from the current case.

+
Authorizations:
Bearer <bearer>
path Parameters
ioc_id
required
integer
query Parameters
cid
required
string

Case ID

+

Responses

Response samples

Content type
application/json
Example
{
  • "status": "success",
  • "message": "IOC 3956 deleted",
  • "data": [ ]
}

Delete an IOC Deprecated

This endpoint is deprecated. Use the POST equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
ioc_id
required
integer

Responses

Update an IOC

Authorizations:
Bearer <bearer>
path Parameters
ioc_id
required
integer
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
ioc_value
string
ioc_tlp_id
integer
ioc_type_id
integer
ioc_description
string
ioc_tags
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "ioc_type_id": 1,
  • "ioc_tlp_id": 2,
  • "ioc_value": "evil",
  • "ioc_description": "IOC description",
  • "ioc_tags": "tag1,tag2",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Updated ioc \"evil\"",
  • "data": {
    }
}

Case timeline

Fetch the timeline Deprecated

The endpoint is deprecated. Use case/timeline/advanced-filter.

+
Authorizations:
Bearer <bearer>
path Parameters
asset_id
required
integer

Filter by assets

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "string",
  • "status": "string"
}

Fetch the timeline

Filter the timeline through a query. q should be a valid JSON mapping {field1:[value], field2: [value2]}.
Fields are AND together. The query needs to be URL encoded.

+

The following fields are available:

+
    +
  • asset: Asset linked to the event
    • +
  • ioc: IOC linked to the event
    • +
  • tag: Tag within the event
    • +
  • title: Title of the event
    • +
  • description: Description of the event
    • +
  • raw : Raw event content
    • +
  • category: Category of the event
    • +
  • source: Source of the event
    • +
  • startDate: Start date to filter with
    • +
  • endDate: End date to filter with
    • +
+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+
q
required
string

Query filter

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "ok",
  • "data": {
    }
}

Fetch the timeline Deprecated

The endpoint is deprecated. Use case/timeline/advanced-filter.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

Fetch the timeline

Fetch the state of the timeline.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
string

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Add a new event

Create a new event in the timeline.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
event_title
required
string
event_raw
string
event_source
string
event_assets
Array of integers
event_iocs
Array of integers
event_category_id
string
event_in_summary
boolean
event_in_graph
boolean
event_color
string
event_date
required
string
event_sync_iocs_assets
boolean
event_tags
string
event_tz
required
string
event_content
string
custom_attributes
object
parent_event_id
integer

Responses

Request samples

Content type
application/json
{
  • "event_title": "An event",
  • "event_raw": "My event raw data",
  • "event_source": "My source",
  • "event_assets": [
    ],
  • "event_iocs": [
    ],
  • "event_category_id": "5",
  • "event_in_summary": true,
  • "event_in_graph": true,
  • "event_color": "#1572E899",
  • "event_date": "2023-03-08T03:02:00.000",
  • "event_sync_iocs_assets": true,
  • "event_tags": "tag",
  • "event_tz": "+00:00",
  • "event_content": "My description",
  • "parent_event_id": null,
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Event added",
  • "data": {
    }
}

Fetch an event

Return information of an event of the timeline

+
Authorizations:
Bearer <bearer>
path Parameters
event_id
required
integer
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Update an event

Update an event in the timeline

+
Authorizations:
Bearer <bearer>
path Parameters
event_id
required
integer
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
event_title
required
string
event_raw
string
event_source
string
event_assets
Array of integers
event_iocs
Array of integers
event_category_id
integer
event_in_summary
boolean
event_in_graph
boolean
event_color
string
event_date
required
string
event_sync_iocs_assets
boolean
event_tags
string
event_tz
required
string
event_content
string
custom_attributes
object
parent_event_id
string

Responses

Request samples

Content type
application/json
{
  • "event_title": "An event",
  • "event_raw": "My event raw data",
  • "event_source": "Source",
  • "parent_event_id": 122,
  • "event_assets": [
    ],
  • "event_iocs": [
    ],
  • "event_category_id": 5,
  • "event_in_summary": true,
  • "event_in_graph": true,
  • "event_color": "#1572E899",
  • "event_date": "2023-03-08T03:02:00.000",
  • "event_sync_iocs_assets": true,
  • "event_tags": "tag",
  • "event_tz": "+00:00",
  • "event_content": "My description",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Event updated",
  • "data": {
    }
}

Delete an event

Delete an event from the timeline. If the event has a child, the child event is not deleted and become a parent itself.

+
Authorizations:
Bearer <bearer>
path Parameters
event_id
required
integer
query Parameters
cid
string

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Event ID 14984 deleted",
  • "status": "success"
}

Delete an event Deprecated

This endpoint is deprecated. Use the POST equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
event_id
required
integer

Responses

Case tasks

Get case tasks

Get a list of all the tasks in the case

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Get a case task

Fetch a task

+
Authorizations:
Bearer <bearer>
path Parameters
task_id
required
integer

Task ID to fetch

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Delete a case task

Delete a case task.

+
Authorizations:
Bearer <bearer>
path Parameters
task_id
required
integer

Task ID to delete

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Task deleted",
  • "status": "success"
}

Delete a case task Deprecated

This endpoint is deprecated. Use the POST equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
task_id
required
integer

Task ID to delete

+

Responses

Add a case task

Add a new task to the case.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
task_assignees_id
required
Array of integers
task_description
string
task_status_id
required
integer
task_tags
string
task_title
required
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "task_assignees_id": [
    ],
  • "task_description": "",
  • "task_status_id": 1,
  • "task_tags": "",
  • "task_title": "dummy title",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Task 'dummy title' added",
  • "data": {
    }
}

Update a case task

Update an existing task of the case.

+
Authorizations:
Bearer <bearer>
path Parameters
task_id
required
integer

ID of the task

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
task_assignees_id
required
Array of integers
task_status_id
required
integer
task_title
required
string
task_description
string
task_tags
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "task_assignees_id": [
    ],
  • "task_status_id": 1,
  • "task_title": "New title",
  • "task_description": "new content",
  • "task_tags": "new tags",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Task 'New title' updated",
  • "status": "success"
}

Case evidences

Get case evidences

Returns a list of all evidences linked to the case.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

case id

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Add an evidence

Add a new evidence to the case.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
filename
required
string
file_size
string
file_hash
string
type_id
string
start_date
string
end_date
string
custom_attributes
object
file_description
string

Responses

Request samples

Content type
application/json
{
  • "filename": "dummy file",
  • "file_size": "77108",
  • "file_hash": "88BC9EF6F07F0FAE922AB25EB226906542F8BA0DC1A221F3EA7273CBCB5DB0D4",
  • "type_id": "2",
  • "start_date": "2024-04-13T03:02:00.000",
  • "end_date": "2024-04-04T00:00:00.000",
  • "custom_attributes": { },
  • "file_description": "Dummy description"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Evidence added",
  • "data": {
    }
}

Get an evidence

Returns an evidence metadata.

+
Authorizations:
Bearer <bearer>
path Parameters
evidence_id
required
integer

Evidence ID

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Delete a case evidence

Remove an evidence from the case.

+
Authorizations:
Bearer <bearer>
path Parameters
evidence_id
required
integer

Evidence ID

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "string",
  • "status": "string"
}

Delete an evidence

This endpoint is depreacted. Please use the POST equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
evidence_id
required
integer

Evidence ID

+

Responses

Update an evidence

Update an evidence.

+
Authorizations:
Bearer <bearer>
path Parameters
evidence_id
required
integer

Evidence ID

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
filename
required
string
file_size
string
file_hash
string
type_id
string
start_date
string
end_date
string
custom_attributes
object
file_description
string

Responses

Request samples

Content type
application/json
{
  • "filename": "dummy file",
  • "file_size": "77108",
  • "file_hash": "88BC9EF6F07F0FAE922AB25EB226906542F8BA0DC1A221F3EA7273CBCB5DB0D4",
  • "type_id": "2",
  • "start_date": "2024-04-13T03:02:00.000",
  • "end_date": "2024-04-04T00:00:00.000",
  • "custom_attributes": { },
  • "file_description": "Dummy description"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Evidence string updated",
  • "data": {
    }
}

Alerts

Fetch an alert

Fetch an alert

+
Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Filter alerts

Filter alerts. This endpoint uses paging. Each response contains a total, last_page, current_page and next_page information to fetch the next results.

+
Authorizations:
Bearer <bearer>
query Parameters
alert_title
string
alert_description
string
alert_source
string
alert_tags
string

Comma separated list of tags

+
alert_status_id
integer
alert_severity_id
integer
alert_classification_id
integer
alert_customer_id
integer
alert_start_date
string
alert_end_date
string
alert_assets
string

Comma separated list of assets

+
alert_iocs
string

Comma separated list of IOCs

+
alert_ids
string

Comma separated list of IDs

+
case_id
integer
alert_owner_id
integer
page
integer

Page to fetch

+
per_page
integer

Number of results per page

+
sort
string

desc or asc, based on the source alert time

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Add an alert

Add a new alert.

+
Authorizations:
Bearer <bearer>
Request Body schema: application/json
alert_title
string
alert_description
string
alert_source
string
alert_source_ref
string
alert_source_link
string
alert_severity_id
integer
alert_status_id
integer
object

Key-value JSON

+
alert_source_event_time
string
alert_note
string
alert_tags
string
Array of objects
Array of objects
alert_customer_id
integer
alert_classification_id
integer
alert_source_content
object

Free JSON representing the source alert

+

Responses

Request samples

Content type
application/json
{
  • "alert_title": "Low-reputation arbitrary code executed by signed executable",
  • "alert_description": "This is a test alert, courtesy of MS",
  • "alert_source": "Test Source",
  • "alert_source_ref": "Test-123",
  • "alert_source_link": "https://source_link.com",
  • "alert_source_content": {
    },
  • "alert_severity_id": 4,
  • "alert_status_id": 3,
  • "alert_context": {
    },
  • "alert_source_event_time": "2023-03-26T03:00:30",
  • "alert_note": "A note on",
  • "alert_tags": "defender,anothertag",
  • "alert_iocs": [
    ],
  • "alert_assets": [
    ],
  • "alert_customer_id": 1,
  • "alert_classification_id": 1
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Update an alert

Update an existing alert. To update only specific fields one can send only those fields.

+
Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID to update

+
Request Body schema: application/json
alert_title
string
alert_description
string
alert_source
string
alert_source_ref
string
alert_source_link
string
object
alert_severity_id
integer
alert_status_id
integer
object
alert_source_event_time
string
alert_note
string
alert_tags
string
Array of objects
alert_customer_id
integer
alert_classification_id
integer

Responses

Request samples

Content type
application/json
{
  • "alert_title": "Low-reputation arbitrary code executed by signed executable",
  • "alert_description": "This is a test alert, courtesy of MS",
  • "alert_source": "Test Source",
  • "alert_source_ref": "Test-123",
  • "alert_source_link": "https://source_link.com",
  • "alert_source_content": {
    },
  • "alert_severity_id": 4,
  • "alert_status_id": 3,
  • "alert_context": {
    },
  • "alert_source_event_time": "2023-03-26T03:00:30",
  • "alert_note": "A note on",
  • "alert_tags": "defender,anothertag",
  • "alert_customer_id": 1,
  • "alert_classification_id": 1
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Update a batch of alerts

Update a batch of. To update only specific fields one can send only those fields.

+
Authorizations:
Bearer <bearer>
Request Body schema: application/json
alert_ids
Array of integers
object

Responses

Request samples

Content type
application/json
{
  • "alert_ids": [
    ],
  • "updates": {
    }
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Batch update successful",
  • "data": [ ]
}

Delete an alert

Delete an alert

+
Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID to delete

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Delete an alert

Delete a batch of alerts

+
Authorizations:
Bearer <bearer>
Request Body schema: application/json
alert_ids
required
Array of integers

Responses

Request samples

Content type
application/json
{
  • "alert_ids": [
    ]
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Escalate an alert

Escalate an alert into a new case.

+
Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID to escalate

+
Request Body schema: application/json
iocs_import_list
Array of strings

A list of UUID matching the IOCs to import into the case. These UUIDs are provided when getting information on an alert.

+
assets_import_list
Array of strings

A list of UUID matching the assets to import into the case. These UUIDs are provided when getting information on an alert.

+
note
string
import_as_event
boolean

If set to True, a new event representing the alert is created in the case.

+
case_tags
string
case_template_id
string
case_title
string

Responses

Request samples

Content type
application/json
{
  • "iocs_import_list": [
    ],
  • "assets_import_list": [
    ],
  • "note": "Escalation note",
  • "import_as_event": true,
  • "case_tags": "Mobile Device Management (MDM) System",
  • "case_template_id": "1",
  • "case_title": "[ALERT] Command & Control Traffic 15"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Merge an alert

Merge an alert into an existing case.

+
Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID to merge

+
Request Body schema: application/json
iocs_import_list
Array of strings

A list of UUID matching the IOCs to import into the case. These UUIDs are provided when getting information on an alert.

+
assets_import_list
Array of strings

A list of UUID matching the assets to import into the case. These UUIDs are provided when getting information on an alert.

+
note
string
import_as_event
boolean

If set to True, a new event representing the alert is created in the case.

+
target_case_id
integer

Responses

Request samples

Content type
application/json
{
  • "iocs_import_list": [
    ],
  • "assets_import_list": [
    ],
  • "note": "dsa",
  • "import_as_event": true,
  • "target_case_id": "14"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Unmerge an alert

Unmerge an alert from a case. The alert is unlinked but the data provided by the alert (such as IOCs, assets, etc) remain in the case.

+
Authorizations:
Bearer <bearer>
path Parameters
alert_id
required
integer

Alert ID to unmerge

+
Request Body schema: application/json
target_case_id
integer

Responses

Request samples

Content type
application/json
{
  • "iocs_import_list": [
    ],
  • "assets_import_list": [
    ],
  • "note": "dsa",
  • "import_as_event": true,
  • "target_case_id": "14"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Datastore

Get the datastore tree

List datastore folders and files

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Add a new file

Add a new file to the datastore. The file password is not encrypted and transmited in view requests.

+
Authorizations:
Bearer <bearer>
path Parameters
parent_id
required
integer

Parent folder ID

+
Request Body schema: multipart/form-data
-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_original_name"
+
+the_original_filename
+-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_description"
+
+File description
+-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_password"
+
+FilePassword
+-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_tags"
+
+tag1,tag2
+-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_is_evidence"
+
+y
+-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_content"; filename="new filename"
+Content-Type: text/markdown
+
+File Content
+
+-----------------------------139681927112990666592379500992--
+
+
file_original_name
required
string
file_description
required
string
file_password
required
string
file_tags
required
string
file_is_evidence
required
string
file_content
string

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "File saved in datastore and added in evidence",
  • "status": "success"
}

Get datastore file info

Get a datastore file information. To download a file, use the /datastore/file/view endpoint.

+
Authorizations:
Bearer <bearer>
path Parameters
file_id
required
integer

File ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Update datastore file information

Update a datastore file. The file's content can be replaced. If a password was previously set, it is removed and cannot be re-enabled. The file identifiers stay the same.

+
Authorizations:
Bearer <bearer>
path Parameters
file_id
required
integer

File ID

+
Request Body schema: application/json
-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_original_name"
+
+the_original_filename
+-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_description"
+
+File description
+-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_tags"
+
+tag1,tag2
+-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_is_evidence"
+
+y
+-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_is_ioc"
+
+y
+-----------------------------139681927112990666592379500992
+Content-Disposition: form-data; name="file_content"; filename="new filename"
+Content-Type: text/markdown
+
+File Content
+
+-----------------------------139681927112990666592379500992--
+
+
object

Responses

Request samples

Content type
application/json
{ }

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "File saved in datastore and added in evidence",
  • "status": "success"
}

Delete a datastore file

Delete a file from the datastore. Once deleted the file cannot be recovered.

+
Authorizations:
Bearer <bearer>
path Parameters
file_id
required
integer

File ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "File 32 deleted",
  • "status": "success"
}

Download a datastore file

Download the content of a datastore file

+
Authorizations:
Bearer <bearer>
path Parameters
file_id
required
integer

File ID

+

Move a datastore file

Move a file to a new folder.

+
Authorizations:
Bearer <bearer>
path Parameters
file_id
required
string
Request Body schema: application/json
destination-node
integer

Responses

Request samples

Content type
application/json
{
  • "destination-node": 0
}

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "File successfully moved to IOCs",
  • "status": "success"
}

Add a datastore folder

Add a new datastore folder.

+
Authorizations:
Bearer <bearer>
Request Body schema: application/json
folder_name
string
parent_node
integer

Responses

Request samples

Content type
application/json
{
  • "folder_name": "string",
  • "parent_node": 0
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Folder added",
  • "status": "success"
}

Delete a datastore folder

Delete a folder. The children are also deleted.

+
Authorizations:
Bearer <bearer>
path Parameters
folder_id
required
integer

Folder ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Folder and children deleted",
  • "status": "success"
}

Rename a datastore folder

Rename a datastore folder.

+
Authorizations:
Bearer <bearer>
path Parameters
folder_id
required
string
query Parameters
cid
integer

Case ID

+
Request Body schema: application/json
parent_node
string
folder_name
string

Responses

Request samples

Content type
application/json
{
  • "parent_node": "53",
  • "folder_name": "New folder name"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Folder renamed",
  • "status": "success"
}

Move a datastore folder

Move a folder to a new folder.

+
Authorizations:
Bearer <bearer>
path Parameters
folder_id
required
integer

Folder ID

+
Request Body schema: application/json
destination-node
integer

Responses

Request samples

Content type
application/json
{
  • "destination-node": 49
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Folder \"New folder name\" successfully moved to \"Evidences\"",
  • "status": "success"
}

Comments

Add a new comment to a case object

Add a new comment to a case object

+
Authorizations:
Bearer <bearer>
path Parameters
object_name
required
string
Enum: "notes" "assets" "ioc" "events" "tasks" "evidences"

Name of the case object to comment

+
object_id
required
integer

ID of the object to comment

+
Request Body schema: application/json
comment_text
string

Responses

Request samples

Content type
application/json
{
  • "comment_text": "string"
}

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

List the comments of an object

List the comments a case object

+
Authorizations:
Bearer <bearer>
path Parameters
object_name
required
string
Enum: "notes" "assets" "ioc" "events" "tasks" "evidences"

Name of the case object to comment

+
object_id
required
integer

ID of the object to comment

+

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

Delete an object

Authorizations:
Bearer <bearer>
path Parameters
object_name
required
string
Enum: "notes" "assets" "ioc" "events" "tasks" "evidences"

Name of the case object to comment

+
object_id
required
integer

ID of the object to comment

+
comment_id
required
integer

ID of the comment to update

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Comment deleted",
  • "status": "success"
}

Edit a comment

Edit a comment

+
Authorizations:
Bearer <bearer>
path Parameters
object_name
required
string

Name of the case object to comment

+
object_id
required
integer

ID of the object to comment

+
comment_id
required
integer

ID of the comment to update

+
Request Body schema: application/json
comment_text
string

Responses

Request samples

Content type
application/json
{
  • "comment_text": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Comment edited",
  • "status": "success"
}

Iris Modules

Iris module task list

List current and previous tasks run by modules.

+
Authorizations:
Bearer <bearer>
path Parameters
rows_count
required
integer

Number of rows to return

+

Responses

Response samples

Content type
application/json
No sample

Iris module task list Deprecated

This endpoint is depreacted. Use /dim/tasks/list/

+
Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "string",
  • "status": "string"
}

Iris module task list

List all manual hooks available for a particular case object.
Available objects types are :

+
    +
  • case
    • +
  • ioc
    • +
  • asset
    • +
  • note
    • +
  • event
    • +
  • task
    • +
  • evidence
    • +
  • global_task
    • +
+

The returned information can provided to the /dim/hooks/call endpoint to trigger a hook.

+
Authorizations:
Bearer <bearer>
path Parameters
object_type
required
string

Object type

+

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

Call a module

Executes a manual trigger on a specified hook. This allows to trigger a hook as it would be done on the GUI. This only concerns manual hooks, and each call triggers a specific hook of a specific module, as specified in the request.

+

To get a list of all available hooks for a case object, use the /dim/hooks/options/<type>/list endpoint.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
hook_name
required
string non-empty

Internal name of the hook as specified in the hook documentation.

+
module_name
required
string non-empty

Name of the module to call

+
hook_ui_name
required
string non-empty

UI name of the hook, either auto generated by IRIS or provided by the module itself.

+
type
required
string non-empty

Type of data processed by the hook (ioc, asset, etc)

+
targets
required
Array of objects

List of objects ID of type "type" to process

+

Responses

Request samples

Content type
application/json
{
  • "hook_name": "on_manual_trigger_ioc",
  • "module_name": "iris_vt_module",
  • "hook_ui_name": "Get VT insight",
  • "type": "ioc",
  • "targets": [
    ]
}

Global tasks

List global tasks

Returns a list of all global tasks

+
Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Add a global task

Add a global task and assign it to a user.

+
Authorizations:
Bearer <bearer>
Request Body schema: application/json
task_assignee_id
required
integer

A user ID for whom the task will be assigned

+
task_status_id
required
integer

The initial status of the task

+
task_title
required
string >= 2 characters
task_description
required
string
task_tags
required
string

Responses

Request samples

Content type
application/json
{
  • "task_assignee_id": 1,
  • "task_status_id": 14,
  • "task_title": "Task title",
  • "task_description": "My task description",
  • "task_tags": ""
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Saved !",
  • "status": "success"
}

Update a global task

Authorizations:
Bearer <bearer>
path Parameters
task_id
required
string

Global task ID to update

+
Request Body schema: application/json
task_assignee_id
required
integer
task_status_id
required
integer
task_title
required
string non-empty
task_description
required
string non-empty
task_tags
required
string non-empty
cid
integer

Responses

Request samples

Content type
application/json
{
  • "task_assignee_id": 155,
  • "task_status_id": 14,
  • "task_title": "Task title",
  • "task_description": "A super description",
  • "task_tags": "tag1,tag2,tag3",
  • "cid": 1
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "string",
  • "status": "string"
}

Delete a global task

Authorizations:
Bearer <bearer>
path Parameters
task_id
required
string

Task to delete

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Task deleted",
  • "status": "success"
}

Manage Cases

Add a new case

Create a new immediate case. If cid is not set, a default case ID 1 is used. This does not change the behavior of the request and is only used for internal tracking.

+
Authorizations:
Bearer <bearer>
Request Body schema: application/json
case_soc_id
required
string non-empty

A SOC ticket reference

+
case_customer
required
number

The customer ID linked to the case.

+
case_name
required
string >= 2 characters

A short name for the case. The case number will be prepend.

+
case_description
required
string >= 2 characters

A short description of the case. This will be the summary of the case.

+
custom_attributes
object
case_template_id
integer
classification_id
integer

Responses

Request samples

Content type
application/json
{
  • "case_soc_id": "SOC_154",
  • "case_customer": 1,
  • "case_name": "My Case API",
  • "case_description": "A super nice description"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Case created",
  • "data": {
    }
}

Get cases list

Returns a list of all the cases, open and closed.

+
Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": [
    ]
}

Close a case Deprecated

This endpoint is deprecated - use the POST equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Case closed successfully",
  • "status": "success"
}

Close a case

The case will be listed under closed case. That's the only difference with an open case. It will stay editable and searchable.

+
Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Case closed successfully",
  • "data": {
    }
}

Reopen a case Deprecated

This endpoint is deprecated. Use the POST equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Case reopened successfully",
  • "status": "success"
}

Reopen a case

Reopen a case previously closed. A case can be reopened even if it is not closed.

+
Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "string",
  • "message": "string",
  • "data": {
    }
}

Delete a case

This implies the deletion of everything linked to the case including summary, assets, notes, timeline, tasks and evidences. The IOCs will only be deleted if they are not referenced in another case.

+
Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Case successfully deleted",
  • "status": "success"
}

Delete case Deprecated

This endpoint is deprecated. Use the POST equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

+

Responses

Update a case

Update informations of a case.

+
Authorizations:
Bearer <bearer>
path Parameters
case_id
required
integer

Case ID

+
Request Body schema: application/json
case_name
string
case_soc_id
string
classification_id
string
owner_id
string
state_id
string
status_id
string
Array of objects
case_tags
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "case_name": "Dummy ",
  • "case_soc_id": "soc_id_demo",
  • "classification_id": "2",
  • "owner_id": "2",
  • "status_id": "1",
  • "protagonists": [
    ],
  • "case_tags": "tag1,tag2",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Case updated",
  • "data": {
    }
}

Filter cases

Authorizations:
Bearer <bearer>
query Parameters
page
integer

Page number

+
per_page
integer

Number of results per page

+
case_ids
string

List of cases ID, comma separated

+
case_customer_id
integer

Customer ID

+
case_name
string

Name of the case

+
case_description
string

Description of the case

+
case_classification_id
integer

Classification of the case

+
case_owner_id
integer

Owner of the case

+
case_opening_user_id
integer

User opening the case

+
case_severity_id
string

Severity ID of the case

+
case_state_id
integer

State ID of the case

+
case_soc_id
string

SOC ID

+
sort
string

asc or desc

+
start_open_date
string

Case opening date - lower boundary

+
end_open_date
string

Case opening date - higher boundary

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": {
    },
  • "data": [ ]
}

Manage customers

List customers

List customers

+
Authorizations:
Bearer <bearer>
query Parameters
cid
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

List customers

Get a customer

+
Authorizations:
Bearer <bearer>
path Parameters
customer_id
required
string
query Parameters
cid
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Add a customer

Add a new customer that will be available at case creation.

+
Authorizations:
Bearer <bearer>
Request Body schema: application/json
customer_name
required
string
customer_description
required
string
customer_sla
required
string
custom_attributes
required
object

Responses

Request samples

Content type
application/json
{
  • "customer_name": "New customer",
  • "customer_description": "New customer description",
  • "customer_sla": "New customer SLA",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Added successfully",
  • "status": "success"
}

Update a customer

Update an existing customer. The new customer name should be one which is not already taken.

+
Authorizations:
Bearer <bearer>
path Parameters
customer_id
required
integer

Customer ID to update

+
Request Body schema: application/json
customer_name
string
customer_description
string
customer_sla
string
custom_attributes
object

Responses

Request samples

Content type
application/json
{
  • "customer_name": "New customer",
  • "customer_description": "New customer description",
  • "customer_sla": "New customer SLA",
  • "custom_attributes": { }
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Customer updated",
  • "status": "success"
}

Delete a customer

A customer can be deleted only if it is not referenced in a case. +To delete a referenced, every referencing cases musth be deleted before.

+
Authorizations:
Bearer <bearer>
path Parameters
customer_id
required
integer

ID of the customer to delete

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Deleted successfully",
  • "status": "success"
}

Add a customer contact

Add a new customer contact.

+
Authorizations:
Bearer <bearer>
path Parameters
customer_id
required
integer

ID of the customer

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
contact_name
string
contact_role
string
contact_email
string
contact_work_phone
string
contact_mobile_phone
string
contact_note
string

Responses

Request samples

Content type
application/json
{
  • "contact_name": "New contact",
  • "contact_role": "Manager",
  • "contact_email": "contact@iris.local",
  • "contact_work_phone": "1111111",
  • "contact_mobile_phone": "2222222",
  • "contact_note": "Notes on the contact"
}

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Deleted successfully",
  • "status": "success"
}

Add a customer contact

Update a customer contact.

+
Authorizations:
Bearer <bearer>
path Parameters
customer_id
required
integer

ID of the customer

+
contact_id
required
string

ID of the contact

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
contact_name
string
contact_role
string
contact_email
string
contact_work_phone
string
contact_mobile_phone
string
contact_note
string

Responses

Request samples

Content type
application/json
{
  • "contact_name": "New contact",
  • "contact_role": "Manager",
  • "contact_email": "contact@iris.local",
  • "contact_work_phone": "1111111",
  • "contact_mobile_phone": "2222222",
  • "contact_note": "Notes on the contact"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Added successfully",
  • "status": "success"
}

Manage users

Delete a user

Only users that never done any activities can be deleted. This is to prevent any internal logic errors and keep tracks of every past activities.

+

Requires administrator role.

+
Authorizations:
Bearer <bearer>
path Parameters
user_id
required
integer

User ID

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Cannot delete active user",
  • "status": "error"
}

get-manage-users-delete-user_id Deprecated

This endpoint is deprecated. Please use the POST equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
user_id
required
integer

User ID

+
query Parameters
cid
integer

Case ID

+

Responses

Update a user

Requires administrator role.

+
Authorizations:
Bearer <bearer>
path Parameters
user_id
required
integer

User ID

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
user_name
string
user_login
string
user_email
string
user_password
string

Responses

Request samples

Content type
application/json
{
  • "user_name": "string",
  • "user_login": "string",
  • "user_email": "string",
  • "user_password": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "string",
  • "status": "string"
}

Add a user

Administrator role required.

+
Authorizations:
Bearer <bearer>
Request Body schema: application/json
user_name
required
string non-empty
user_login
required
string non-empty

Has to be unique

+
user_email
required
string non-empty

Has to be unique

+
user_password
string non-empty

Must satisfy policy of 12chars, 1 uppercase, 1 number

+
user_is_service_account
boolean

Responses

Request samples

Content type
application/json
{
  • "user_name": "string",
  • "user_login": "string",
  • "user_email": "string",
  • "user_password": "string",
  • "user_is_service_account": true
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "user created",
  • "data": {
    }
}

Update user groups

Administrator role required. Update the groups of a user.

+
Authorizations:
Bearer <bearer>
path Parameters
user_id
required
integer

User ID

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
groups_membership
required
Array of integers

Responses

Request samples

Content type
application/json
{
  • "groups_membership": [
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "string",
  • "status": "string"
}

Update user cases access

Administrator role required. Update the case access of a user.

+
Authorizations:
Bearer <bearer>
path Parameters
user_id
required
integer

User ID

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
cases_list
required
Array of integers
access_level
integer

Responses

Request samples

Content type
application/json
{
  • "cases_list": [
    ],
  • "access_level": 2
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "string",
  • "status": "string"
}

Delete user cases access

Administrator role required. Remove cases access from a user.

+
Authorizations:
Bearer <bearer>
path Parameters
user_id
required
integer

User ID

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
cases
required
integer

Responses

Request samples

Content type
application/json
{
  • "cases": [
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "User case access updated",
  • "status": "success"
}

Get user list

Return a list of available users.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": [
    ]
}

Fetch a user

Recompute the effective user access.

+
Authorizations:
Bearer <bearer>
path Parameters
user_id
required
integer

user ID

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Updated",
  • "status": "success"
}

Fetch a user

Returns information of a specific user.

+
Authorizations:
Bearer <bearer>
path Parameters
user_id
required
integer

user ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Manage Groups

Add a new group

Requires administrative rights.

+
Authorizations:
Bearer <bearer>
path Parameters
user_id
required
integer

user ID

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
group_name
required
string
group_description
required
string
group_permissions
required
integer

Responses

Request samples

Content type
application/json
{
  • "group_name": "New group",
  • "group_description": "New description",
  • "group_permissions": 1
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Update a group

Requires administrative rights.

+
Authorizations:
Bearer <bearer>
path Parameters
group_id
required
integer

Group ID

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
group_name
required
string
group_description
required
string
group_permissions
required
integer

Responses

Request samples

Content type
application/json
{
  • "group_name": "New group",
  • "group_description": "New description",
  • "group_permissions": 1
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Update group members

Requires administrative rights. Set the members of a group.

+
Authorizations:
Bearer <bearer>
path Parameters
group_id
required
integer

Group ID

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
group_members
Array of integers

Responses

Request samples

Content type
application/json
{
  • "group_members": [
    ]
}

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Group deleted",
  • "status": "success"
}

Delete a Group

Requires administrative rights.

+
Authorizations:
Bearer <bearer>
path Parameters
group_id
required
integer

Group ID

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Group deleted",
  • "status": "success"
}

Delete a member of a group

Requires administrative rights.

+
Authorizations:
Bearer <bearer>
path Parameters
group_id
required
integer

Group ID

+
user_id
required
integer

User ID

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Group deleted",
  • "status": "success"
}

Set case access of a group

Requires administrative rights.

+
Authorizations:
Bearer <bearer>
path Parameters
group_id
required
integer

Group ID

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
access_level
required
integer
cases_list
required
Array of integers
auto_follow_cases
required
boolean

Responses

Request samples

Content type
application/json
{
  • "access_level": 0,
  • "cases_list": [
    ],
  • "auto_follow_cases": false
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Delete cases access of a group

Requires administrative rights.

+
Authorizations:
Bearer <bearer>
path Parameters
group_id
required
integer

Group ID

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
cases
Array of integers

Responses

Request samples

Content type
application/json
{
  • "cases": [
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

List the groups

List the groups

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+
Request Body schema: application/json
Array of objects
message
string
status
string

Request samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

Manage Assets Types

Get assets types

Return a list of available assets types.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

Get assets types

Returns information on a specific asset type.

+
Authorizations:
Bearer <bearer>
path Parameters
asset_type_id
required
integer

Asset Type ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Get assets types

Delete an asset type. Administrator role required.

+
Authorizations:
Bearer <bearer>
path Parameters
asset_type_id
required
integer

Asset Type ID

+
query Parameters
cid
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Deleted asset type ID 16 successfully",
  • "status": "success"
}

Delete Asset Type Deprecated

This endpoint is deprecated. Use the POSt equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
asset_type_id
required
integer

Asset Type ID

+

Responses

Add a new asset type

Administrator role required. See the example for the expected data.

+
Authorizations:
Bearer <bearer>
Request Body schema: multipart/form-data
-----------------------------145784024822865434322863553415
+Content-Disposition: form-data; name="asset_name"
+
+My asset name
+-----------------------------145784024822865434322863553415
+Content-Disposition: form-data; name="asset_description"
+
+My asset description
+-----------------------------145784024822865434322863553415
+Content-Disposition: form-data; name="asset_icon_not_compromised"; filename="ex.png"
+Content-Type: image/png
+
+‰PNG DATA
+-----------------------------145784024822865434322863553415
+Content-Disposition: form-data; name="asset_icon_compromised"; filename="ex_1.png"
+Content-Type: image/png
+
+‰PNG DATA
+-----------------------------145784024822865434322863553415--
+
+
asset_name
required
string
asset_description
required
string
asset_icon_not_compromised
required
string
asset_icon_compromised
required
string

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Asset type updated",
  • "status": "success"
}

Update an asset type

Administrator role required.

+
Authorizations:
Bearer <bearer>
path Parameters
asset_type_id
required
integer

Asset Type to update

+
query Parameters
cid
required
integer

Case ID

+
Request Body schema: multipart/form-data
-----------------------------145784024822865434322863553415
+Content-Disposition: form-data; name="asset_name"
+
+My asset name
+-----------------------------145784024822865434322863553415
+Content-Disposition: form-data; name="asset_description"
+
+My asset description
+-----------------------------145784024822865434322863553415
+Content-Disposition: form-data; name="asset_icon_not_compromised"; filename="ex.png"
+Content-Type: image/png
+
+‰PNG DATA
+-----------------------------145784024822865434322863553415
+Content-Disposition: form-data; name="asset_icon_compromised"; filename="ex_1.png"
+Content-Type: image/png
+
+‰PNG DATA
+-----------------------------145784024822865434322863553415--
+
+
asset_name
required
string
asset_description
required
string
asset_icon_not_compromised
required
string
asset_icon_compromised
required
string

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Asset type updated",
  • "status": "success"
}

Manage Task Status

List task status

Return a list of available task status.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

Get task status

Return information on a task status.

+
Authorizations:
Bearer <bearer>
path Parameters
task_status_id
required
integer

Task status to get

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Manage Analysis Status

List analysis status

Return a list of available analysis status.

+
Authorizations:
Bearer <bearer>
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "",
  • "status": "success"
}

Get Analysis Status

Return information on an analysis status.

+
Authorizations:
Bearer <bearer>
path Parameters
analysis_status_id
required
integer

Analysis Status ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Manage IOC Types

List IOC types

Return a list of available IOC types.

+
Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "message": "string",
  • "status": "string"
}

Get IOC type

Return information on an IOC type.

+
Authorizations:
Bearer <bearer>
path Parameters
ioc_type_id
required
integer

IOC Type ID

+
query Parameters
cid
required
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Delete IOC type

Delete an IOC type. Administrator role required.

+
Authorizations:
Bearer <bearer>
path Parameters
ioc_type_id
required
integer

IOC Type ID

+
query Parameters
cid
integer

Case ID

+

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "Deleted ioc type ID 6",
  • "status": "success"
}

Delete IOC type Deprecated

This endpoint is deprecated. Use the POST equivalent.

+
Authorizations:
Bearer <bearer>
path Parameters
ioc_type_id
required
integer

IOC Type ID

+

Responses

Add an IOC type

Administrator role required.

+
Authorizations:
Bearer <bearer>
Request Body schema: application/json
type_name
required
string
type_description
required
string
type_taxonomy
required
string
type_validation_regex
required
string
type_validation_expect
required
string

Responses

Request samples

Content type
application/json
{
  • "type_name": "campaign-id",
  • "type_description": "Associated campaign ID",
  • "type_taxonomy": "dsa",
  • "type_validation_regex": "*.",
  • "type_validation_expect": "Explanation"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "Added successfully",
  • "status": "success"
}

Update an IOC type

Administrator role required.

+
Authorizations:
Bearer <bearer>
path Parameters
ioc_type_id
required
integer

IOC Type ID

+
Request Body schema: application/json
type_name
string
type_description
string
type_taxonomy
string
type_validation_regex
string
type_validation_expect
string

Responses

Request samples

Content type
application/json
{
  • "type_name": "campaign-id",
  • "type_description": "Associated campaign ID",
  • "type_taxonomy": "dsa",
  • "type_validation_regex": "*.",
  • "type_validation_expect": "Explanation"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "IOC type updated",
  • "status": "success"
}

Manage Cases Templates

Add a case template

Add a new case template.

+
Authorizations:
Bearer <bearer>
Request Body schema: application/json
case_template_json
string

Responses

Request samples

Content type
application/json
{
  • "case_template_json": "{\n \"name\": \"Template name\",\n \"display_name\": \"Template Display Name\",\n \"description\": \"Template description\",\n \"author\": \"YOUR NAME\",\n \"classification\": \"known-template-classification\",\n \"title_prefix\": \"[PREFIX]\",\n \"summary\": \"Summary to be set\",\n \"tags\": [\n \"ransomware\",\n \"malware\"\n ],\n \"tasks\": [\n {\n \"title\": \"Task 1\",\n \"description\": \"Task 1 description\",\n \"tags\": [\n \"tag1\",\n \"tag2\"\n ]\n }\n ],\n \"note_groups\": [\n {\n \"title\": \"Note group 1\",\n \"notes\": [\n {\n \"title\": \"Note 1\",\n \"content\": \"Note 1 content\"\n }\n ]\n }\n ]\n}"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "IOC type updated",
  • "status": "success"
}

Update a case template

Update a case template.

+
Authorizations:
Bearer <bearer>
path Parameters
template_id
required
integer

Case Template ID

+
Request Body schema: application/json
case_template_json
string

Responses

Request samples

Content type
application/json
{
  • "case_template_json": "{\n \"name\": \"Template name\",\n \"display_name\": \"Template Display Name\",\n \"description\": \"Template description\",\n \"author\": \"YOUR NAME\",\n \"classification\": \"known-template-classification\",\n \"title_prefix\": \"[PREFIX]\",\n \"summary\": \"Summary to be set\",\n \"tags\": [\n \"ransomware\",\n \"malware\"\n ],\n \"tasks\": [\n {\n \"title\": \"Task 1\",\n \"description\": \"Task 1 description\",\n \"tags\": [\n \"tag1\",\n \"tag2\"\n ]\n }\n ],\n \"note_groups\": [\n {\n \"title\": \"Note group 1\",\n \"notes\": [\n {\n \"title\": \"Note 1\",\n \"content\": \"Note 1 content\"\n }\n ]\n }\n ]\n}"
}

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "IOC type updated",
  • "status": "success"
}

Delete a case template

Delete a case template.

+
Authorizations:
Bearer <bearer>
path Parameters
template_id
required
integer

Case Template ID

+

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "IOC type updated",
  • "status": "success"
}

Manage Cases Classifications

List case classifications

List the case classifications.

+
Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": [
    ]
}

Get case classification

Get a case classification from an ID.

+
Authorizations:
Bearer <bearer>
path Parameters
classification_id
required
integer

Classification ID to fetch

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Add a case classification

Authorizations:
Bearer <bearer>
Request Body schema: application/json
name
string
name_expanded
string
description
string

Responses

Request samples

Content type
application/json
{
  • "name": "NewClassification",
  • "name_expanded": "New Classification",
  • "description": "Superbe new classification"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Case classification added",
  • "data": {
    }
}

Update a case classification

Authorizations:
Bearer <bearer>
path Parameters
classification_id
required
string

Classification ID

+
Request Body schema: application/json
name
string
name_expanded
string
description
string

Responses

Request samples

Content type
application/json
{
  • "name": "NewClassification",
  • "name_expanded": "New Classification",
  • "description": "Superbe new classification"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Case classification updated",
  • "data": {
    }
}

Delete a case classification

Authorizations:
Bearer <bearer>
path Parameters
classification_id
required
string

Classification ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Case classification deleted",
  • "data": [ ]
}

Delete a case classification

Authorizations:
Bearer <bearer>
path Parameters
state_id
required
integer

State ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Case state deleted",
  • "data": [ ]
}

Delete an evidence type

Authorizations:
Bearer <bearer>
path Parameters
state_id
required
integer

State ID

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Evidence type deleted",
  • "data": [ ]
}

Manage Cases states

List case states

List the case states.

+
Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": [
    ]
}

Get case state

Get a case state from an ID.

+
Authorizations:
Bearer <bearer>
path Parameters
state_id
required
integer

state ID to fetch

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Add a case state

Authorizations:
Bearer <bearer>
Request Body schema: application/json
state_name
required
string
state_description
required
string

Responses

Request samples

Content type
application/json
{
  • "state_name": "New state",
  • "state_description": "Superbe new state"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Case state added",
  • "data": {
    }
}

Update a case state

Authorizations:
Bearer <bearer>
path Parameters
state_id
required
string

state ID

+
Request Body schema: application/json
state_name
string
state_description
string

Responses

Request samples

Content type
application/json
{
  • "state_name": "New state",
  • "state_description": "Superbe new state"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Case state updated",
  • "data": {
    }
}

Manage evidence types

List evidence types

List the evidence types.

+
Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": [
    ]
}

Get an evidence type

Get a evidence type from an ID.

+
Authorizations:
Bearer <bearer>
path Parameters
type_id
required
integer

state ID to fetch

+

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "",
  • "data": {
    }
}

Add an evidence type

Authorizations:
Bearer <bearer>
Request Body schema: application/json
name
required
string
description
required
string

Responses

Request samples

Content type
application/json
{
  • "name": "Evidence Type",
  • "description": "Superbe Evidence Type"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Evidence type added",
  • "data": {
    }
}

Update an evidence type

Authorizations:
Bearer <bearer>
path Parameters
type_id
required
string

Type ID

+
Request Body schema: application/json
name
string
description
string

Responses

Request samples

Content type
application/json
{
  • "name": "Evidence Type",
  • "description": "Superbe Evidence Type"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "message": "Evidence type updated",
  • "data": {
    }
}

API

Get API versions

Returns information on API versions supported by the server.

+
Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "message": "",
  • "status": "success"
}

Ping server

Used to test authentication. Respond "pong" if authentication is successfull.

+
Authorizations:
Bearer <bearer>

Responses

Response samples

Content type
application/json
{
  • "data": [ ],
  • "message": "pong",
  • "status": "success"
}
+ + + + diff --git a/2.4.7/api_reference/reference/iris.v2.0.4.yaml b/2.4.7/api_reference/reference/iris.v2.0.4.yaml index d1d10429..a68550cd 100644 --- a/2.4.7/api_reference/reference/iris.v2.0.4.yaml +++ b/2.4.7/api_reference/reference/iris.v2.0.4.yaml @@ -103,58 +103,69 @@ paths: content: application/json: schema: - description: '' type: object x-examples: - example-1: + Example 1: + status: success + message: Log saved data: - activity_date: 'Fri, 21 Jan 2022 17:33:48 GMT' + activity_date: null activity_desc: A test case: null case_id: 1 - id: 21632 + display_in_ui: true + id: 2135 + is_from_api: true + registry: null user: null user_id: 1 user_input: true - message: Log saved - status: success properties: + status: + type: string + message: + type: string data: type: object required: - activity_date - activity_desc + - case - case_id + - display_in_ui - id + - is_from_api + - registry + - user - user_id - user_input properties: activity_date: - type: string - minLength: 1 + type: 'null' activity_desc: type: string - minLength: 1 - case: {} + case: + type: 'null' case_id: - type: number + type: integer + display_in_ui: + type: boolean id: - type: number - user: {} + type: integer + is_from_api: + type: boolean + registry: + type: 'null' + user: + type: 'null' user_id: - type: number + type: integer user_input: type: boolean - message: - type: string - minLength: 1 - status: - type: string - minLength: 1 required: - - data - - message - status + - message + - data examples: Success: value: @@ -243,7 +254,7 @@ paths: summary: Export a case as JSON operationId: get-case-export description: |- - Export a case in JSON format including all the information such as assets, iocs, etc. This request can take a very long time depending on the size of the case. + Export a case in JSON format including all the information such as assets, iocs, etc. This request can take a very long time depending on the size of the case and is DB intensive. The datastore is not part of the response and needs to be requested manually. security: - Bearer : [] @@ -263,691 +274,843 @@ paths: application/json: schema: type: object - properties: - status: - type: string - message: - type: string - data: - type: object - properties: + x-examples: + Example 1: + status: success + message: '' + data: case: - type: object - properties: - name: - type: string - open_date: - type: string - description: - type: string - soc_id: - type: string - opened_by: - type: string - for_customer: - type: string - close_date: - type: 'null' - custom_attributes: - type: 'null' - case_id: - type: integer - case_uuid: - type: string - status_id: - type: integer - status_name: - type: string + client: + customer_name: irisinitialclient300 + customer_description: null + customer_sla: null + customer_id: 1 + client_uuid: be6bb7a3-ba21-4946-8992-45213de680ad + creation_date: '2024-03-18T08:34:33.855919' + last_update_date: '2024-03-18T08:34:33.855919' + custom_attributes: null + owner: + id: 1 + user_name: administrator + user_login: administrator + user_email: administrator@localhost + classification: + name: 'other:other' + name_expanded: 'Other: other' + description: 'All incidents that do not fit in one of the given categories should be put into this class. If the number of incidents in this category increases, it is an indicator that the classification scheme must be revised.' + id: 36 + creation_date: '2024-03-18T08:34:32.675030' + state: + state_name: Open + state_description: Case is open + state_id: 3 + protected: true + tags: + - tag_title: tag1 + id: 5 + - tag_title: tag2 + id: 6 + user: + id: 1 + user_name: administrator + user_login: administrator + user_email: administrator@localhost + reviewer: null + review_status: null + severity: null + status_name: unknown + protagonists: [] + alerts: + - 22 + - 20 + - 46 + - 142 + - 118 + - 140 + - 68 + - 94 + - 116 + - 70 + - 92 + - 44 + case_id: 1 + soc_id: soc_id_demo + client_id: 1 + name: '#1 - Dummy name' + description: Dummy description + open_date: '2024-03-18' + close_date: null + initial_date: '2024-03-18T08:34:33.862920' + closing_note: null + user_id: 1 + owner_id: 1 + status_id: 0 + state_id: 3 + custom_attributes: null + case_uuid: 932fe26f-50e0-472b-a4d6-e576578f9a18 + classification_id: 36 + reviewer_id: null + review_status_id: null + severity_id: null + modification_history: {} + note_directories: + - 1 + - 4 + - 2 + - 3 + - 5 + - 7 evidences: - type: array - items: - type: object - properties: - filename: - type: string - date_added: - type: string - file_hash: - type: string - added_by: - type: string - custom_attributes: - type: object - properties: {} - file_uuid: - type: string - id: - type: integer - file_size: - type: integer + - filename: dummy file + date_added: '2024-03-21T09:24:00.945016' + file_hash: C417B856459BC5D82E4E6C35F8DCC0C01A20CCF1A1F9AB8240A2870204B9A966 + added_by: administrator + custom_attributes: null + file_uuid: 1954f7ac-1946-4255-a5a2-9f55e3f4935f + id: 1 + file_size: 77143 + - filename: dummy file + date_added: '2024-03-23T09:34:30.198322' + file_hash: 88BC9EF6F07F0FAE922AB25EB226906542F8BA0DC1A221F3EA7273CBCB5DB0D4 + added_by: administrator + custom_attributes: null + file_uuid: eae4e269-9e46-42f3-8626-b1bbebb23785 + id: 34 + file_size: 77108 timeline: - type: array - items: - type: object - properties: - event_id: - type: integer - event_title: - type: string - event_in_summary: - type: boolean - event_date: - type: string - event_tz: - type: string - event_date_wtz: - type: string - event_content: - type: string - event_tags: - type: string - event_source: - type: string - event_raw: - type: string - custom_attributes: - type: object - properties: {} - category: - type: string - last_edited_by: - type: string - event_uuid: - type: string - event_in_graph: - type: boolean - event_color: - type: string - event_is_flagged: - type: boolean - assets: - type: array - items: - type: string - iocs: - type: array - items: - type: object - properties: - ioc_id: - type: integer - ioc_value: - type: string - ioc_description: - type: string - tlp_name: - type: string - type: - type: string - iocs: - type: array - items: - type: object - properties: - ioc_value: - type: string - type_name: - type: string - ioc_tags: - type: string - ioc_description: - type: string - custom_attributes: - type: object - properties: {} - ioc_id: - type: integer - ioc_uuid: - type: string - tlp_name: - type: string - added_by: - type: string - assets: - type: array - items: - type: object - properties: - asset_id: - type: integer - asset_uuid: - type: string - asset_name: - type: string - asset_description: - type: string - asset_compromise_status_id: - type: integer - type: - type: string - analysis_status: - type: string - date_added: - type: string - asset_domain: - type: string - asset_ip: - type: string - asset_info: - type: string - asset_tags: - type: string - custom_attributes: - type: object - properties: {} - light_asset_description: - type: string - asset_ioc: - type: array - items: - type: object - properties: - ioc_value: - type: string - type_name: - type: string - ioc_description: - type: string - asset_compromise_status: - type: string - tasks: - type: array - items: - type: object - properties: - task_title: - type: string - task_status: - type: string - task_tags: - type: string - task_open_date: - type: string - task_close_date: - type: 'null' - task_last_update: - type: string - task_description: - type: string - custom_attributes: - type: object - properties: {} - task_uuid: - type: string - id: - type: integer - task_assignees: - type: array - items: - type: object - properties: - user: - type: string - name: - type: string - id: - type: integer - comments: - type: array - items: - type: object - properties: {} - notes: - type: array - items: - type: object - properties: - note_title: - type: string - note_content: - type: string - note_creationdate: - type: string - note_lastupdate: - type: string - custom_attributes: - type: object - properties: {} - note_id: - type: integer - note_uuid: - type: string - group_title: - type: string - group_id: - type: integer - group_user: - type: integer - export_date: - type: string - x-examples: - Example 1: - status: success - message: '' - data: - case: - name: '#1 - Initial Demo' - open_date: '2023-11-29' - description: Dummy description - soc_id: soc_id_demo - opened_by: administrator - for_customer: IrisInitialClient - close_date: null - custom_attributes: null - case_id: 1 - case_uuid: da80a133-d3c2-40bd-a0ba-8966ef7679a3 - status_id: 0 - status_name: unknown - evidences: - - filename: A super evidence - date_added: '2023-11-29T15:52:11.216704' - file_hash: dhjajhdkadqw - added_by: administrator - custom_attributes: {} - file_uuid: 6287ebbc-4332-4f37-b8d8-c9e70e238c08 - id: 1 - file_size: 0 - timeline: - - event_id: 2 - event_title: A second event + - event_id: 88 + event_title: '[ALERT] Super alert 5' event_in_summary: true - event_date: '2023-11-03T23:03:00.003000' - event_tz: '+01:00' - event_date_wtz: '2023-11-04T00:03:00.003000' - event_content: Super event - event_tags: logs - event_source: MySource - event_raw: Raw event log - custom_attributes: {} - category: Command and Control + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null last_edited_by: administrator - event_uuid: 7c8a624f-6017-4ccd-a93f-7ef702cc24dd + event_uuid: 96730e40-0de9-4bb4-97df-954e2e5f079f event_in_graph: true - event_color: '#F2596199' + event_color: null event_is_flagged: false - assets: - - LinuxServer (Linux - Server) - - main_router (Router) - iocs: - - ioc_id: 1 - ioc_value: root - ioc_description: '' - tlp_name: amber - type: account - - event_id: 3 - event_title: 'A third event ' + assets: [] + iocs: [] + - event_id: 16 + event_title: '[ALERT] Super alert 5' event_in_summary: true - event_date: '2023-11-03T23:03:00.003000' - event_tz: '+01:00' - event_date_wtz: '2023-11-04T00:03:00.003000' - event_content: Super event - event_tags: logs - event_source: MySource - event_raw: Raw event log - custom_attributes: {} - category: Command and Control + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null last_edited_by: administrator - event_uuid: 7c8a624f-6017-4ccd-a93f-7ef702cc24dd + event_uuid: a9025fba-354f-4865-8890-932f73fa0a41 event_in_graph: true - event_color: '#F2596199' + event_color: null event_is_flagged: false - assets: - - LinuxServer (Linux - Server) - - main_router (Router) - iocs: - - ioc_id: 1 - ioc_value: root - ioc_description: '' - tlp_name: amber - type: account - - event_id: 1 - event_title: 'An event ' + assets: [] + iocs: [] + - event_id: 53 + event_title: '[ALERT] Super alert 5' event_in_summary: true - event_date: '2023-11-09T23:03:00.003000' - event_tz: '+01:00' - event_date_wtz: '2023-11-10T00:03:00.003000' - event_content: Super event - event_tags: logs - event_source: MySource - event_raw: Raw event log - custom_attributes: {} - category: Command and Control + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null last_edited_by: administrator - event_uuid: 7c8a624f-6017-4ccd-a93f-7ef702cc24dd + event_uuid: ecd0f42d-53a6-43ed-87da-1bc731a695be event_in_graph: true - event_color: '#48ABF799' + event_color: null event_is_flagged: false - assets: - - LinuxServer (Linux - Server) - - main_router (Router) - iocs: - - ioc_id: 1 - ioc_value: root - ioc_description: '' - tlp_name: amber - type: account - iocs: - - ioc_value: root - type_name: account - ioc_tags: router - ioc_description: '' - custom_attributes: {} - ioc_id: 1 - ioc_uuid: 94188da2-ca10-4299-ad73-0689719a61c3 - tlp_name: amber - added_by: administrator - assets: - - asset_id: 1 - asset_uuid: 4c8211fb-676e-4d84-9164-2c62d2c82558 - asset_name: LinuxServer - asset_description: 'The super service ' - asset_compromise_status_id: 2 - type: Linux - Server - analysis_status: Canceled - date_added: '2023-11-29T15:40:13.759084' - asset_domain: local.local - asset_ip: 127.0.0.1 - asset_info: '' - asset_tags: test - custom_attributes: {} - light_asset_description: 'The super service ' - asset_ioc: - - ioc_value: root - type_name: account - ioc_description: '' - asset_compromise_status: Not Compromised - - asset_id: 2 - asset_uuid: 7371f6fd-17dc-42d7-b21b-43824b71abb3 - asset_name: main_router - asset_description: '' - asset_compromise_status_id: 1 - type: Router - analysis_status: To be done - date_added: '2023-11-29T15:40:41.128370' - asset_domain: local.local - asset_ip: 192.168.1.3 - asset_info: '' - asset_tags: router - custom_attributes: {} - light_asset_description: '' - asset_ioc: - - ioc_value: root - type_name: account - ioc_description: '' - asset_compromise_status: Compromised - tasks: - - task_title: A task - task_status: In progress - task_tags: task1 - task_open_date: '2023-11-29T15:48:49.811798' - task_close_date: null - task_last_update: '2023-11-29T15:48:49.811798' - task_description: 'Task description ' - custom_attributes: {} - task_uuid: 0693c71b-b4f7-41cd-a12a-0dcd24519e7f - id: 1 - task_assignees: - - user: administrator - name: administrator - id: 1 - - task_title: Another task - task_status: To do - task_tags: tas - task_open_date: '2023-11-29T15:49:09.053863' - task_close_date: null - task_last_update: '2023-11-29T15:49:09.053863' - task_description: Another task description - custom_attributes: {} - task_uuid: 6d27e7f2-3310-454e-aebf-00432ebbfb2d - id: 2 - task_assignees: - - user: administrator - name: administrator - id: 1 - comments: [] - notes: - - note_title: Something else - note_content: A nother note content - note_creationdate: '2023-11-29T15:39:02.056124' - note_lastupdate: '2023-11-29T15:39:30.039339' - custom_attributes: {} - note_id: 1 - note_uuid: 71a50086-2b11-4d80-8916-e94bd93ad28b - group_title: A note group A - group_id: 1 - group_user: 1 - - note_title: And another thing - note_content: A note content - note_creationdate: '2023-11-29T15:39:11.127181' - note_lastupdate: '2023-11-29T15:39:23.065014' - custom_attributes: {} - note_id: 2 - note_uuid: 641943a8-767a-4789-a02c-1475243cbb37 - group_title: A note group B - group_id: 2 - group_user: 1 - export_date: '2023-11-29T15:52:18.839881' - examples: - Example 1: - value: - status: success - message: '' - data: - case: - name: '#1 - Initial Demo' - open_date: '2023-11-29' - description: Dummy description - soc_id: soc_id_demo - opened_by: administrator - for_customer: IrisInitialClient - close_date: null - custom_attributes: null - case_id: 1 - case_uuid: da80a133-d3c2-40bd-a0ba-8966ef7679a3 - status_id: 0 - status_name: unknown - evidences: - - filename: A super evidence - date_added: '2023-11-29T15:52:11.216704' - file_hash: dhjajhdkadqw - added_by: administrator - custom_attributes: {} - file_uuid: 6287ebbc-4332-4f37-b8d8-c9e70e238c08 - id: 1 - file_size: 0 - timeline: - - event_id: 2 - event_title: A second event + assets: [] + iocs: [] + - event_id: 70 + event_title: '[ALERT] Super alert 5' event_in_summary: true - event_date: '2023-11-03T23:03:00.003000' - event_tz: '+01:00' - event_date_wtz: '2023-11-04T00:03:00.003000' - event_content: Super event - event_tags: logs - event_source: MySource - event_raw: Raw event log - custom_attributes: {} - category: Command and Control + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null last_edited_by: administrator - event_uuid: 7c8a624f-6017-4ccd-a93f-7ef702cc24dd + event_uuid: 0d36e81b-1fbe-464c-968c-f6019e7e920c event_in_graph: true - event_color: '#F2596199' + event_color: null event_is_flagged: false - assets: - - LinuxServer (Linux - Server) - - main_router (Router) - iocs: - - ioc_id: 1 - ioc_value: root - ioc_description: '' - tlp_name: amber - type: account - - event_id: 3 - event_title: 'A third event ' + assets: [] + iocs: [] + - event_id: 105 + event_title: '[ALERT] Super alert 5' event_in_summary: true - event_date: '2023-11-03T23:03:00.003000' - event_tz: '+01:00' - event_date_wtz: '2023-11-04T00:03:00.003000' - event_content: Super event - event_tags: logs - event_source: MySource - event_raw: Raw event log - custom_attributes: {} - category: Command and Control + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null last_edited_by: administrator - event_uuid: 7c8a624f-6017-4ccd-a93f-7ef702cc24dd + event_uuid: 548ad69f-7f82-4a88-9415-32b974fe9b96 event_in_graph: true - event_color: '#F2596199' + event_color: null event_is_flagged: false - assets: - - LinuxServer (Linux - Server) - - main_router (Router) - iocs: - - ioc_id: 1 - ioc_value: root - ioc_description: '' - tlp_name: amber - type: account - - event_id: 1 - event_title: 'An event ' + assets: [] + iocs: [] + - event_id: 87 + event_title: '[ALERT] Super alert 5' event_in_summary: true - event_date: '2023-11-09T23:03:00.003000' - event_tz: '+01:00' - event_date_wtz: '2023-11-10T00:03:00.003000' - event_content: Super event - event_tags: logs - event_source: MySource - event_raw: Raw event log + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: 44dc9b10-2d30-43bd-bb5f-7aec439c844a + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 35 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: 274cd72b-e133-4d3f-999c-839321f649d6 + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 106 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: fd2232bc-6188-429b-992d-f3fde7a1bae2 + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 17 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: bdb78e95-d6bf-4075-ac38-7d843a92f8d4 + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 89 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: a912ac40-6d72-4e37-9d13-35da374e8ec1 + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 33 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: 29073f55-cb89-4939-83b9-f08cc2a1fe84 + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 34 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: c502b95a-0413-485b-8e80-6f3e101de7c3 + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 71 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: 82565abe-7584-4475-977e-62c92cc8cf8c + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 15 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: 47e3f07b-1569-45e2-bc69-daa2bff418ff + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 107 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: f14ce7fc-7919-4b77-81e4-99ea18178407 + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 52 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: 24af1c39-8995-4f72-bda4-24a484ed9d36 + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 51 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: f92f599d-105a-4f2c-a7b2-0a6cc7078341 + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 69 + event_title: '[ALERT] Super alert 5' + event_in_summary: true + event_date: '2023-03-26T03:00:30' + event_tz: '+00:00' + event_date_wtz: '2023-03-26T03:00:30' + event_content: This is a test alert + event_tags: defender + event_source: Test Source + event_raw: '{}' + custom_attributes: null + category: null + last_edited_by: administrator + event_uuid: 969551ea-7910-439a-8110-2da7a36c8944 + event_in_graph: true + event_color: null + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 1 + event_title: dsaasd + event_in_summary: false + event_date: '2024-03-06T03:33:00' + event_tz: '+00:00' + event_date_wtz: '2024-03-06T03:33:00' + event_content: '' + event_tags: '' + event_source: '' + event_raw: '' custom_attributes: {} - category: Command and Control + category: Unspecified last_edited_by: administrator - event_uuid: 7c8a624f-6017-4ccd-a93f-7ef702cc24dd + event_uuid: 1b1185f6-7c30-4c63-b22b-20c94d95ac7f event_in_graph: true - event_color: '#48ABF799' + event_color: null event_is_flagged: false - assets: - - LinuxServer (Linux - Server) - - main_router (Router) - iocs: - - ioc_id: 1 - ioc_value: root - ioc_description: '' - tlp_name: amber - type: account - iocs: - - ioc_value: root - type_name: account - ioc_tags: router - ioc_description: '' + assets: [] + iocs: [] + - event_id: 3 + event_title: dummy event + event_in_summary: false + event_date: '2024-03-21T09:12:59.776385' + event_tz: '+00:00' + event_date_wtz: '2024-03-21T09:12:59.776385' + event_content: '' + event_tags: '' + event_source: '' + event_raw: '' custom_attributes: {} - ioc_id: 1 - ioc_uuid: 94188da2-ca10-4299-ad73-0689719a61c3 - tlp_name: amber - added_by: administrator - assets: - - asset_id: 1 - asset_uuid: 4c8211fb-676e-4d84-9164-2c62d2c82558 - asset_name: LinuxServer - asset_description: 'The super service ' - asset_compromise_status_id: 2 - type: Linux - Server - analysis_status: Canceled - date_added: '2023-11-29T15:40:13.759084' - asset_domain: local.local - asset_ip: 127.0.0.1 - asset_info: '' - asset_tags: test + category: Unspecified + last_edited_by: administrator + event_uuid: 2dd3d539-921d-427f-b285-c0141aaaaefd + event_in_graph: true + event_color: '' + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 5 + event_title: dummy event + event_in_summary: false + event_date: '2024-03-21T09:15:00.411243' + event_tz: '+00:00' + event_date_wtz: '2024-03-21T09:15:00.411243' + event_content: '' + event_tags: '' + event_source: '' + event_raw: '' custom_attributes: {} - light_asset_description: 'The super service ' - asset_ioc: - - ioc_value: root - type_name: account - ioc_description: '' - asset_compromise_status: Not Compromised - - asset_id: 2 - asset_uuid: 7371f6fd-17dc-42d7-b21b-43824b71abb3 - asset_name: main_router - asset_description: '' + category: Unspecified + last_edited_by: administrator + event_uuid: 432e4ec4-39a5-4cce-b568-93941fc45674 + event_in_graph: true + event_color: '' + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 7 + event_title: dummy event + event_in_summary: false + event_date: '2024-03-21T09:19:38.409298' + event_tz: '+00:00' + event_date_wtz: '2024-03-21T09:19:38.409298' + event_content: '' + event_tags: '' + event_source: '' + event_raw: '' + custom_attributes: {} + category: Unspecified + last_edited_by: administrator + event_uuid: 79b777a9-2644-4b3d-9846-6b8023c1ab50 + event_in_graph: true + event_color: '' + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 9 + event_title: dummy event + event_in_summary: false + event_date: '2024-03-21T09:20:31.274028' + event_tz: '+00:00' + event_date_wtz: '2024-03-21T09:20:31.274028' + event_content: '' + event_tags: '' + event_source: '' + event_raw: '' + custom_attributes: {} + category: Unspecified + last_edited_by: administrator + event_uuid: 4577fb9f-da3d-4e9b-a446-04934674d1b4 + event_in_graph: true + event_color: '' + event_is_flagged: false + assets: [] + iocs: [] + - event_id: 11 + event_title: dummy event + event_in_summary: false + event_date: '2024-03-21T09:21:43.551325' + event_tz: '+00:00' + event_date_wtz: '2024-03-21T09:21:43.551325' + event_content: '' + event_tags: '' + event_source: '' + event_raw: '' + custom_attributes: {} + category: Unspecified + last_edited_by: administrator + event_uuid: 16fbb9e4-65da-4dfc-a398-7b4ae7b0f6f8 + event_in_graph: true + event_color: '' + event_is_flagged: false + assets: [] + iocs: [] + iocs: + - ioc_value: dsaasdas + type_name: authentihash + ioc_tags: dsa + ioc_description: dasdas + custom_attributes: {} + ioc_id: 3 + ioc_uuid: d1536920-7358-4d92-b061-336d73405aeb + tlp_name: amber + added_by: administrator + - ioc_value: test + type_name: authentihash + ioc_tags: '' + ioc_description: '' + custom_attributes: {} + ioc_id: 4 + ioc_uuid: c06b29e9-95de-421c-afd9-0c8cdfe4fd46 + tlp_name: amber + added_by: administrator + - ioc_value: C417B856459BC5D82E4E6C35F8DCC0C01A20CCF1A1F9AB8240A2870204B9A966 + type_name: sha256 + ioc_tags: datastore + ioc_description: SHA256 of dummy file. Imported from datastore. + custom_attributes: null + ioc_id: 53 + ioc_uuid: df8cb1fb-5f4a-402b-abd5-931fee4a407b + tlp_name: amber + added_by: administrator + - ioc_value: 88BC9EF6F07F0FAE922AB25EB226906542F8BA0DC1A221F3EA7273CBCB5DB0D4 + type_name: sha256 + ioc_tags: datastore + ioc_description: SHA256 of dummy file. Imported from datastore. + custom_attributes: null + ioc_id: 286 + ioc_uuid: 7c726e26-eb07-49a4-b802-e15466a4b73e + tlp_name: amber + added_by: administrator + assets: + - asset_id: 1 + asset_uuid: 842b6a91-384f-440e-90e9-8b047b968335 + asset_name: myasset + asset_description: '' asset_compromise_status_id: 1 - type: Router - analysis_status: To be done - date_added: '2023-11-29T15:40:41.128370' - asset_domain: local.local - asset_ip: 192.168.1.3 + type: Linux - Computer + analysis_status: Started + date_added: '2024-03-18T08:35:53.550141' + asset_domain: '' + asset_ip: 1.1.1.1 asset_info: '' - asset_tags: router + asset_tags: dsd custom_attributes: {} light_asset_description: '' - asset_ioc: - - ioc_value: root - type_name: account - ioc_description: '' + asset_ioc: [] asset_compromise_status: Compromised tasks: - - task_title: A task + - task_title: dasas task_status: In progress - task_tags: task1 - task_open_date: '2023-11-29T15:48:49.811798' + task_tags: '' + task_open_date: '2024-03-18T09:36:19.705123' task_close_date: null - task_last_update: '2023-11-29T15:48:49.811798' - task_description: 'Task description ' + task_last_update: '2024-03-18T09:36:19.705123' + task_description: '' custom_attributes: {} - task_uuid: 0693c71b-b4f7-41cd-a12a-0dcd24519e7f + task_uuid: dfa4e1ca-e24b-4376-b85b-f1d53e0d0981 id: 1 task_assignees: - user: administrator name: administrator id: 1 - - task_title: Another task - task_status: To do - task_tags: tas - task_open_date: '2023-11-29T15:49:09.053863' + - task_title: dsa + task_status: On hold + task_tags: '' + task_open_date: '2024-03-18T09:36:34.063779' task_close_date: null - task_last_update: '2023-11-29T15:49:09.053863' - task_description: Another task description + task_last_update: '2024-03-18T09:36:34.063779' + task_description: dsa custom_attributes: {} - task_uuid: 6d27e7f2-3310-454e-aebf-00432ebbfb2d + task_uuid: a84eb035-8b58-44d8-875c-4f30a49416c3 id: 2 task_assignees: - user: administrator name: administrator id: 1 + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-21T09:24:02.175803' + task_close_date: null + task_last_update: '2024-03-26T06:01:56.856654' + task_description: '' + custom_attributes: {} + task_uuid: 9fe2bc97-0e24-490e-a37d-b86fc7c13289 + id: 3 + task_assignees: + - user: administrator + name: administrator + id: 1 + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-23T09:34:31.372107' + task_close_date: null + task_last_update: '2024-03-26T06:02:00.859224' + task_description: '' + custom_attributes: {} + task_uuid: 2060eab6-9d27-4317-83e4-579cf46391b6 + id: 51 + task_assignees: + - user: administrator + name: administrator + id: 1 + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-21T09:32:23.685183' + task_close_date: null + task_last_update: '2024-03-26T06:02:06.656190' + task_description: '' + custom_attributes: {} + task_uuid: eda52a99-7756-4539-b514-a73b64ad2684 + id: 33 + task_assignees: + - user: administrator + name: administrator + id: 1 + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-21T09:24:10.826955' + task_close_date: null + task_last_update: '2024-03-26T06:02:10.697594' + task_description: '' + custom_attributes: {} + task_uuid: 067f4e22-4ce5-40ba-bd06-12d314b5123f + id: 9 + task_assignees: + - user: administrator + name: administrator + id: 1 + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-23T09:34:38.574508' + task_close_date: null + task_last_update: '2024-03-26T06:02:14.722574' + task_description: '' + custom_attributes: {} + task_uuid: 0f43bee5-0f6c-4110-a833-1830fc9b345c + id: 57 + task_assignees: + - user: administrator + name: administrator + id: 1 + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-21T09:26:36.787134' + task_close_date: null + task_last_update: '2024-03-26T06:02:18.461499' + task_description: '' + custom_attributes: {} + task_uuid: e9c28320-fd71-4b68-a766-6e0cbe6e83fd + id: 15 + task_assignees: + - user: administrator + name: administrator + id: 1 + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-24T08:49:19.031395' + task_close_date: null + task_last_update: '2024-03-26T06:02:22.316850' + task_description: '' + custom_attributes: {} + task_uuid: 1262a44d-6d56-41b0-9ed0-be2be1858e74 + id: 63 + task_assignees: + - user: administrator + name: administrator + id: 1 + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-21T09:33:13.617062' + task_close_date: null + task_last_update: '2024-03-26T06:02:27.214159' + task_description: '' + custom_attributes: {} + task_uuid: 46d96290-0930-436c-ac3d-f7851aa1471f + id: 39 + task_assignees: + - user: administrator + name: administrator + id: 1 + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-21T09:26:44.062844' + task_close_date: null + task_last_update: '2024-03-21T09:26:44.062844' + task_description: '' + custom_attributes: {} + task_uuid: 47afad53-d01e-455a-b3ce-af17f05d0147 + id: 21 + task_assignees: [] + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-21T09:32:16.531544' + task_close_date: null + task_last_update: '2024-03-26T06:49:22.861647' + task_description: |- + ygi uyguyg ohb jhbiuhbo hb ouhbo uhb oiubhohubo uyh + uyg oihpi u + ouyf oiyg + uyg uhg + uyfg iuygu + ugoi ughoi + custom_attributes: {} + task_uuid: bd03e8a9-b208-48d9-81ae-6dbdfb9816f0 + id: 27 + task_assignees: + - user: administrator + name: administrator + id: 1 + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-21T09:33:20.792768' + task_close_date: null + task_last_update: '2024-03-26T06:01:45.022397' + task_description: '' + custom_attributes: {} + task_uuid: 9dfe50ea-8c5e-4deb-a670-6b705e59ee3c + id: 45 + task_assignees: + - user: administrator + name: administrator + id: 1 + - task_title: dummy title + task_status: To do + task_tags: '' + task_open_date: '2024-03-24T08:49:26.103349' + task_close_date: null + task_last_update: '2024-03-26T06:01:49.231280' + task_description: '' + custom_attributes: {} + task_uuid: 619ceac1-c42c-4ac8-af1b-5497e66580c5 + id: 69 + task_assignees: + - user: administrator + name: administrator + id: 1 comments: [] notes: - - note_title: Something else - note_content: A nother note content - note_creationdate: '2023-11-29T15:39:02.056124' - note_lastupdate: '2023-11-29T15:39:30.039339' - custom_attributes: {} + - directory: + id: 5 + name: Dummy title + parent_id: null + case_id: 1 note_id: 1 - note_uuid: 71a50086-2b11-4d80-8916-e94bd93ad28b - group_title: A note group A - group_id: 1 - group_user: 1 - - note_title: And another thing - note_content: A note content - note_creationdate: '2023-11-29T15:39:11.127181' - note_lastupdate: '2023-11-29T15:39:23.065014' - custom_attributes: {} - note_id: 2 - note_uuid: 641943a8-767a-4789-a02c-1475243cbb37 - group_title: A note group B - group_id: 2 - group_user: 1 - export_date: '2023-11-29T15:52:18.839881' - '': - description: A full export of the case without the files in the datastore - parameters: [] - /case/assets/list: - get: - summary: Get list of assets - responses: - '200': - description: OK - content: - application/json: - schema: - type: object + note_uuid: b8391125-f446-40ec-b4cf-f610fefd0029 + note_title: New note + note_content: |- + Super note + + # hey hey + note_user: 1 + note_creationdate: '2024-03-18T08:35:22.999299' + note_lastupdate: '2024-03-18T08:35:22.999313' + note_case_id: 1 + custom_attributes: null + directory_id: 5 + modification_history: {} + comments: [] + export_date: '2024-03-27T17:37:26.516383' properties: status: type: string @@ -955,103 +1118,793 @@ paths: type: string data: type: object + required: + - case + - evidences + - timeline + - iocs + - assets + - tasks + - comments + - notes + - export_date properties: - assets: - type: array - items: - type: object - properties: - asset_id: - type: integer - asset_uuid: - type: string - asset_name: - type: string - asset_type: - type: string - asset_icon_compromised: - type: string - asset_icon_not_compromised: - type: string - asset_description: - type: string - asset_domain: - type: string - asset_compromise_status_id: - type: - - integer - - 'null' - asset_ip: - type: string - asset_type_id: - type: integer - analysis_status: - type: string - analysis_status_id: + case: + type: object + required: + - client + - owner + - classification + - state + - tags + - user + - reviewer + - review_status + - severity + - status_name + - protagonists + - alerts + - case_id + - soc_id + - client_id + - name + - description + - open_date + - close_date + - initial_date + - closing_note + - user_id + - owner_id + - status_id + - state_id + - custom_attributes + - case_uuid + - classification_id + - reviewer_id + - review_status_id + - severity_id + - modification_history + - note_directories + properties: + client: + type: object + required: + - customer_name + - customer_description + - customer_sla + - customer_id + - client_uuid + - creation_date + - last_update_date + - custom_attributes + properties: + customer_name: + type: string + customer_description: + type: 'null' + customer_sla: + type: 'null' + customer_id: + type: integer + client_uuid: + type: string + creation_date: + type: string + last_update_date: + type: string + custom_attributes: + type: 'null' + owner: + type: object + required: + - id + - user_name + - user_login + - user_email + properties: + id: + type: integer + user_name: + type: string + user_login: + type: string + user_email: + type: string + classification: + type: object + required: + - name + - name_expanded + - description + - id + - creation_date + properties: + name: + type: string + name_expanded: + type: string + description: + type: string + id: + type: integer + creation_date: + type: string + state: + type: object + required: + - state_name + - state_description + - state_id + - protected + properties: + state_name: + type: string + state_description: + type: string + state_id: + type: integer + protected: + type: boolean + tags: + type: array + items: + type: object + properties: + tag_title: + type: string + id: + type: integer + required: + - tag_title + - id + user: + type: object + required: + - id + - user_name + - user_login + - user_email + properties: + id: + type: integer + user_name: + type: string + user_login: + type: string + user_email: + type: string + reviewer: + type: 'null' + review_status: + type: 'null' + severity: + type: 'null' + status_name: + type: string + protagonists: + type: array + items: + type: object + alerts: + type: array + items: type: integer - asset_tags: + case_id: + type: integer + soc_id: + type: string + client_id: + type: integer + name: + type: string + description: + type: string + open_date: + type: string + close_date: + type: 'null' + initial_date: + type: string + closing_note: + type: 'null' + user_id: + type: integer + owner_id: + type: integer + status_id: + type: integer + state_id: + type: integer + custom_attributes: + type: 'null' + case_uuid: + type: string + classification_id: + type: integer + reviewer_id: + type: 'null' + review_status_id: + type: 'null' + severity_id: + type: 'null' + modification_history: + type: object + note_directories: + type: array + items: + type: integer + evidences: + type: array + items: + type: object + properties: + filename: type: string - link: + date_added: + type: string + file_hash: + type: string + added_by: + type: string + custom_attributes: + type: 'null' + file_uuid: + type: string + id: + type: integer + file_size: + type: integer + required: + - filename + - date_added + - file_hash + - added_by + - custom_attributes + - file_uuid + - id + - file_size + timeline: + type: array + items: + type: object + properties: + event_id: + type: integer + event_title: + type: string + event_in_summary: + type: boolean + event_date: + type: string + event_tz: + type: string + event_date_wtz: + type: string + event_content: + type: string + event_tags: + type: string + event_source: + type: string + event_raw: + type: string + custom_attributes: + type: 'null' + category: + type: + - 'null' + - string + last_edited_by: + type: string + event_uuid: + type: string + event_in_graph: + type: boolean + event_color: + type: + - 'null' + - string + event_is_flagged: + type: boolean + assets: type: array items: type: object - properties: {} - ioc_links: + iocs: + type: array + items: + type: object + required: + - event_id + - event_title + - event_in_summary + - event_date + - event_tz + - event_date_wtz + - event_content + - event_tags + - event_source + - event_raw + - custom_attributes + - category + - last_edited_by + - event_uuid + - event_in_graph + - event_color + - event_is_flagged + - assets + - iocs + iocs: + type: array + items: + type: object + properties: + ioc_value: + type: string + type_name: + type: string + ioc_tags: + type: string + ioc_description: + type: string + custom_attributes: type: - - array - 'null' + - object + ioc_id: + type: integer + ioc_uuid: + type: string + tlp_name: + type: string + added_by: + type: string + required: + - ioc_value + - type_name + - ioc_tags + - ioc_description + - custom_attributes + - ioc_id + - ioc_uuid + - tlp_name + - added_by + assets: + type: array + items: + type: object + properties: + asset_id: + type: integer + asset_uuid: + type: string + asset_name: + type: string + asset_description: + type: string + asset_compromise_status_id: + type: integer + type: + type: string + analysis_status: + type: string + date_added: + type: string + asset_domain: + type: string + asset_ip: + type: string + asset_info: + type: string + asset_tags: + type: string + custom_attributes: + type: object + light_asset_description: + type: string + asset_ioc: + type: array items: type: object - properties: - ioc_id: - type: integer - ioc_value: - type: string - asset_id: - type: integer - state: - type: object - properties: - object_state: - type: integer - object_last_update: - type: string - x-examples: - Example 1: + asset_compromise_status: + type: string + required: + - asset_id + - asset_uuid + - asset_name + - asset_description + - asset_compromise_status_id + - type + - analysis_status + - date_added + - asset_domain + - asset_ip + - asset_info + - asset_tags + - custom_attributes + - light_asset_description + - asset_ioc + - asset_compromise_status + tasks: + type: array + items: + type: object + properties: + task_title: + type: string + task_status: + type: string + task_tags: + type: string + task_open_date: + type: string + task_close_date: + type: 'null' + task_last_update: + type: string + task_description: + type: string + custom_attributes: + type: object + task_uuid: + type: string + id: + type: integer + task_assignees: + type: array + items: + type: object + properties: + user: + type: string + name: + type: string + id: + type: integer + required: + - user + - name + - id + required: + - task_title + - task_status + - task_tags + - task_open_date + - task_close_date + - task_last_update + - task_description + - custom_attributes + - task_uuid + - id + - task_assignees + comments: + type: array + items: + type: object + notes: + type: array + items: + type: object + properties: + directory: + type: object + required: + - id + - name + - parent_id + - case_id + properties: + id: + type: integer + name: + type: string + parent_id: + type: 'null' + case_id: + type: integer + note_id: + type: integer + note_uuid: + type: string + note_title: + type: string + note_content: + type: string + note_user: + type: integer + note_creationdate: + type: string + note_lastupdate: + type: string + note_case_id: + type: integer + custom_attributes: + type: 'null' + directory_id: + type: integer + modification_history: + type: object + comments: + type: array + items: + type: object + required: + - directory + - note_id + - note_uuid + - note_title + - note_content + - note_user + - note_creationdate + - note_lastupdate + - note_case_id + - custom_attributes + - directory_id + - modification_history + - comments + export_date: + type: string + required: + - status + - message + - data + examples: + Example 1: + value: status: success message: '' data: + case: + name: '#1 - Initial Demo' + open_date: '2023-11-29' + description: Dummy description + soc_id: soc_id_demo + opened_by: administrator + for_customer: IrisInitialClient + close_date: null + custom_attributes: null + case_id: 1 + case_uuid: da80a133-d3c2-40bd-a0ba-8966ef7679a3 + status_id: 0 + status_name: unknown + evidences: + - filename: A super evidence + date_added: '2023-11-29T15:52:11.216704' + file_hash: dhjajhdkadqw + added_by: administrator + custom_attributes: {} + file_uuid: 6287ebbc-4332-4f37-b8d8-c9e70e238c08 + id: 1 + file_size: 0 + timeline: + - event_id: 2 + event_title: A second event + event_in_summary: true + event_date: '2023-11-03T23:03:00.003000' + event_tz: '+01:00' + event_date_wtz: '2023-11-04T00:03:00.003000' + event_content: Super event + event_tags: logs + event_source: MySource + event_raw: Raw event log + custom_attributes: {} + category: Command and Control + last_edited_by: administrator + event_uuid: 7c8a624f-6017-4ccd-a93f-7ef702cc24dd + event_in_graph: true + event_color: '#F2596199' + event_is_flagged: false + assets: + - LinuxServer (Linux - Server) + - main_router (Router) + iocs: + - ioc_id: 1 + ioc_value: root + ioc_description: '' + tlp_name: amber + type: account + - event_id: 3 + event_title: 'A third event ' + event_in_summary: true + event_date: '2023-11-03T23:03:00.003000' + event_tz: '+01:00' + event_date_wtz: '2023-11-04T00:03:00.003000' + event_content: Super event + event_tags: logs + event_source: MySource + event_raw: Raw event log + custom_attributes: {} + category: Command and Control + last_edited_by: administrator + event_uuid: 7c8a624f-6017-4ccd-a93f-7ef702cc24dd + event_in_graph: true + event_color: '#F2596199' + event_is_flagged: false + assets: + - LinuxServer (Linux - Server) + - main_router (Router) + iocs: + - ioc_id: 1 + ioc_value: root + ioc_description: '' + tlp_name: amber + type: account + - event_id: 1 + event_title: 'An event ' + event_in_summary: true + event_date: '2023-11-09T23:03:00.003000' + event_tz: '+01:00' + event_date_wtz: '2023-11-10T00:03:00.003000' + event_content: Super event + event_tags: logs + event_source: MySource + event_raw: Raw event log + custom_attributes: {} + category: Command and Control + last_edited_by: administrator + event_uuid: 7c8a624f-6017-4ccd-a93f-7ef702cc24dd + event_in_graph: true + event_color: '#48ABF799' + event_is_flagged: false + assets: + - LinuxServer (Linux - Server) + - main_router (Router) + iocs: + - ioc_id: 1 + ioc_value: root + ioc_description: '' + tlp_name: amber + type: account + iocs: + - ioc_value: root + type_name: account + ioc_tags: router + ioc_description: '' + custom_attributes: {} + ioc_id: 1 + ioc_uuid: 94188da2-ca10-4299-ad73-0689719a61c3 + tlp_name: amber + added_by: administrator assets: - - asset_id: 57 - asset_uuid: c6598fd0-836a-4fc4-87c1-6f03348eadeb - asset_name: FILESERVER1231 - asset_type: Windows - Server - asset_icon_compromised: ioc_windows_server.png - asset_icon_not_compromised: windows_server.png - asset_description: '' - asset_domain: '' - asset_compromise_status_id: 0 - asset_ip: '' - asset_type_id: 10 - analysis_status: Unspecified - analysis_status_id: 1 - asset_tags: '' - link: [] - ioc_links: null - - asset_id: 79 - asset_uuid: 0955016b-c1aa-44e1-a5c6-0b538eac7d9f - asset_name: Test_DFIR - asset_type: Account - asset_icon_compromised: ioc_user.png - asset_icon_not_compromised: user.png + - asset_id: 1 + asset_uuid: 4c8211fb-676e-4d84-9164-2c62d2c82558 + asset_name: LinuxServer + asset_description: 'The super service ' + asset_compromise_status_id: 2 + type: Linux - Server + analysis_status: Canceled + date_added: '2023-11-29T15:40:13.759084' + asset_domain: local.local + asset_ip: 127.0.0.1 + asset_info: '' + asset_tags: test + custom_attributes: {} + light_asset_description: 'The super service ' + asset_ioc: + - ioc_value: root + type_name: account + ioc_description: '' + asset_compromise_status: Not Compromised + - asset_id: 2 + asset_uuid: 7371f6fd-17dc-42d7-b21b-43824b71abb3 + asset_name: main_router asset_description: '' - asset_domain: example.com asset_compromise_status_id: 1 - asset_ip: 1.1.1.1 - asset_type_id: 1 - analysis_status: Started - analysis_status_id: 3 - asset_tags: '' + type: Router + analysis_status: To be done + date_added: '2023-11-29T15:40:41.128370' + asset_domain: local.local + asset_ip: 192.168.1.3 + asset_info: '' + asset_tags: router + custom_attributes: {} + light_asset_description: '' + asset_ioc: + - ioc_value: root + type_name: account + ioc_description: '' + asset_compromise_status: Compromised + tasks: + - task_title: A task + task_status: In progress + task_tags: task1 + task_open_date: '2023-11-29T15:48:49.811798' + task_close_date: null + task_last_update: '2023-11-29T15:48:49.811798' + task_description: 'Task description ' + custom_attributes: {} + task_uuid: 0693c71b-b4f7-41cd-a12a-0dcd24519e7f + id: 1 + task_assignees: + - user: administrator + name: administrator + id: 1 + - task_title: Another task + task_status: To do + task_tags: tas + task_open_date: '2023-11-29T15:49:09.053863' + task_close_date: null + task_last_update: '2023-11-29T15:49:09.053863' + task_description: Another task description + custom_attributes: {} + task_uuid: 6d27e7f2-3310-454e-aebf-00432ebbfb2d + id: 2 + task_assignees: + - user: administrator + name: administrator + id: 1 + comments: [] + notes: + - note_title: Something else + note_content: A nother note content + note_creationdate: '2023-11-29T15:39:02.056124' + note_lastupdate: '2023-11-29T15:39:30.039339' + custom_attributes: {} + note_id: 1 + note_uuid: 71a50086-2b11-4d80-8916-e94bd93ad28b + group_title: A note group A + group_id: 1 + group_user: 1 + - note_title: And another thing + note_content: A note content + note_creationdate: '2023-11-29T15:39:11.127181' + note_lastupdate: '2023-11-29T15:39:23.065014' + custom_attributes: {} + note_id: 2 + note_uuid: 641943a8-767a-4789-a02c-1475243cbb37 + group_title: A note group B + group_id: 2 + group_user: 1 + export_date: '2023-11-29T15:52:18.839881' + '': + description: A full export of the case without the files in the datastore + parameters: [] + /case/assets/list: + get: + summary: Get list of assets + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + x-examples: + Example 1: + status: success + message: '' + data: + assets: + - asset_id: 57 + asset_uuid: c6598fd0-836a-4fc4-87c1-6f03348eadeb + asset_name: FILESERVER1231 + asset_type: Windows - Server + asset_icon_compromised: ioc_windows_server.png + asset_icon_not_compromised: windows_server.png + asset_description: '' + asset_domain: '' + asset_compromise_status_id: 0 + asset_ip: '' + asset_type_id: 10 + analysis_status: Unspecified + analysis_status_id: 1 + asset_tags: '' + link: [] + ioc_links: null + - asset_id: 79 + asset_uuid: 0955016b-c1aa-44e1-a5c6-0b538eac7d9f + asset_name: Test_DFIR + asset_type: Account + asset_icon_compromised: ioc_user.png + asset_icon_not_compromised: user.png + asset_description: '' + asset_domain: example.com + asset_compromise_status_id: 1 + asset_ip: 1.1.1.1 + asset_type_id: 1 + analysis_status: Started + analysis_status_id: 3 + asset_tags: '' link: [] ioc_links: null - asset_id: 82 @@ -1464,6 +2317,105 @@ paths: state: object_state: 56 object_last_update: '2024-01-04T15:52:02.088544' + properties: + status: + type: string + message: + type: string + data: + type: object + required: + - assets + - state + properties: + assets: + type: array + items: + type: object + properties: + asset_id: + type: integer + asset_uuid: + type: string + asset_name: + type: string + asset_type: + type: string + asset_icon_compromised: + type: string + asset_icon_not_compromised: + type: string + asset_description: + type: string + asset_domain: + type: string + asset_compromise_status_id: + type: + - integer + - 'null' + asset_ip: + type: string + asset_type_id: + type: integer + analysis_status: + type: string + analysis_status_id: + type: integer + asset_tags: + type: string + link: + type: array + items: + type: object + ioc_links: + type: + - array + - 'null' + items: + type: object + properties: + ioc_id: + type: integer + ioc_value: + type: string + asset_id: + type: integer + required: + - ioc_id + - asset_id + required: + - asset_id + - asset_uuid + - asset_name + - asset_type + - asset_icon_compromised + - asset_icon_not_compromised + - asset_description + - asset_domain + - asset_compromise_status_id + - asset_ip + - asset_type_id + - analysis_status + - analysis_status_id + - asset_tags + - link + - ioc_links + state: + type: object + required: + - object_state + - object_last_update + properties: + object_state: + type: integer + description: 'An incremental ID of every change that occured in the assets of the case. It allows to know if a the assets of the case changed. ' + object_last_update: + type: string + description: Last datetime the object was modified in DB + required: + - status + - message + - data examples: example-1: value: @@ -1937,6 +2889,69 @@ paths: application/json: schema: type: object + x-examples: + Example 1: + status: success + message: '' + data: + asset_enrichment: + Another enrichment provider: + Another key: Another value + asset_type: + asset_icon_not_compromised: firewall.png + asset_icon_compromised: ioc_firewall.png + asset_description: WAF + asset_id: 15 + asset_name: WAF + asset_type_id: 15 + case_id: 1 + asset_description: Asset description + asset_id: 2548 + analysis_status_id: 1 + custom_attributes: + Analysis: + Has been analyzed: + type: input_checkbox + mandatory: false + value: false + Analysis note: + type: input_textfield + mandatory: false + value: '' + KAPE Status: + Collected: + type: input_checkbox + mandatory: false + value: false + Analyzed: + type: input_checkbox + mandatory: false + value: false + asset_info: '' + user_id: 4 + date_added: '2024-01-04T13:20:43.522581' + date_update: '2024-01-04T13:20:43.522598' + asset_name: WAF-301 + asset_ip: 1.1.1.1 + asset_tags: 'tag1,tag2' + asset_compromise_status_id: 2 + asset_uuid: 9d188714-5251-41f3-817b-3b1c8515de06 + asset_domain: '' + linked_ioc: + - ioc_id: 1135 + ioc_value: aunnrzg.co.uk + ioc_tags: 'tag1,tag2' + ioc_type_id: 22 + type_name: email + ioc_description: description_hey + ioc_tlp_id: 2 + - ioc_id: 349 + ioc_value: ufrsmrdxlqq.org + ioc_tags: 'tag1,tag2' + ioc_type_id: 22 + type_name: email + ioc_description: description_hey + ioc_tlp_id: 2 properties: status: type: string @@ -1944,17 +2959,37 @@ paths: type: string data: type: object - properties: + required: + - asset_enrichment + - asset_type + - asset_type_id + - case_id + - asset_description + - asset_id + - analysis_status_id + - custom_attributes + - asset_info + - user_id + - date_added + - date_update + - asset_name + - asset_ip + - asset_tags + - asset_compromise_status_id + - asset_uuid + - asset_domain + - linked_ioc + properties: asset_enrichment: type: object - properties: - Another enrichment provider: - type: object - properties: - Another key: - type: string asset_type: type: object + required: + - asset_icon_not_compromised + - asset_icon_compromised + - asset_description + - asset_id + - asset_name properties: asset_icon_not_compromised: type: string @@ -1978,49 +3013,6 @@ paths: type: integer custom_attributes: type: object - properties: - Analysis: - type: object - properties: - Has been analyzed: - type: object - properties: - type: - type: string - mandatory: - type: boolean - value: - type: boolean - Analysis note: - type: object - properties: - type: - type: string - mandatory: - type: boolean - value: - type: string - KAPE Status: - type: object - properties: - Collected: - type: object - properties: - type: - type: string - mandatory: - type: boolean - value: - type: boolean - Analyzed: - type: object - properties: - type: - type: string - mandatory: - type: boolean - value: - type: boolean asset_info: type: string user_id: @@ -2060,69 +3052,10 @@ paths: type: string ioc_tlp_id: type: integer - x-examples: - Example 1: - status: success - message: '' - data: - asset_enrichment: - Another enrichment provider: - Another key: Another value - asset_type: - asset_icon_not_compromised: firewall.png - asset_icon_compromised: ioc_firewall.png - asset_description: WAF - asset_id: 15 - asset_name: WAF - asset_type_id: 15 - case_id: 1 - asset_description: Asset description - asset_id: 2548 - analysis_status_id: 1 - custom_attributes: - Analysis: - Has been analyzed: - type: input_checkbox - mandatory: false - value: false - Analysis note: - type: input_textfield - mandatory: false - value: '' - KAPE Status: - Collected: - type: input_checkbox - mandatory: false - value: false - Analyzed: - type: input_checkbox - mandatory: false - value: false - asset_info: '' - user_id: 4 - date_added: '2024-01-04T13:20:43.522581' - date_update: '2024-01-04T13:20:43.522598' - asset_name: WAF-301 - asset_ip: 1.1.1.1 - asset_tags: 'tag1,tag2' - asset_compromise_status_id: 2 - asset_uuid: 9d188714-5251-41f3-817b-3b1c8515de06 - asset_domain: '' - linked_ioc: - - ioc_id: 1135 - ioc_value: aunnrzg.co.uk - ioc_tags: 'tag1,tag2' - ioc_type_id: 22 - type_name: email - ioc_description: description_hey - ioc_tlp_id: 2 - - ioc_id: 349 - ioc_value: ufrsmrdxlqq.org - ioc_tags: 'tag1,tag2' - ioc_type_id: 22 - type_name: email - ioc_description: description_hey - ioc_tlp_id: 2 + required: + - status + - message + - data examples: Example 1: value: @@ -2245,6 +3178,34 @@ paths: application/json: schema: type: object + x-examples: + Example 1: + status: success + message: Asset added + data: + asset_enrichment: null + asset_type: + asset_icon_not_compromised: windows_desktop.png + asset_icon_compromised: ioc_windows_desktop.png + asset_description: Standard Windows Computer + asset_id: 9 + asset_name: Windows - Computer + asset_type_id: 9 + case_id: 1 + asset_description: A host description + asset_id: 3912 + analysis_status_id: 3 + custom_attributes: {} + asset_info: '' + user_id: 1 + date_added: '2024-01-09T13:25:51.328503' + date_update: '2024-01-09T13:25:51.328506' + asset_name: admin_laptop + asset_ip: 127.0.0.1 + asset_tags: anewtag + asset_compromise_status_id: 1 + asset_uuid: 5914a960-d6d5-4e18-9665-613037d8f702 + asset_domain: iris.local properties: status: type: string @@ -2252,11 +3213,36 @@ paths: type: string data: type: object + required: + - asset_enrichment + - asset_type + - asset_type_id + - case_id + - asset_description + - asset_id + - analysis_status_id + - custom_attributes + - asset_info + - user_id + - date_added + - date_update + - asset_name + - asset_ip + - asset_tags + - asset_compromise_status_id + - asset_uuid + - asset_domain properties: asset_enrichment: type: 'null' asset_type: type: object + required: + - asset_icon_not_compromised + - asset_icon_compromised + - asset_description + - asset_id + - asset_name properties: asset_icon_not_compromised: type: string @@ -2280,7 +3266,6 @@ paths: type: integer custom_attributes: type: object - properties: {} asset_info: type: string user_id: @@ -2301,34 +3286,10 @@ paths: type: string asset_domain: type: string - x-examples: - Example 1: - status: success - message: Asset added - data: - asset_enrichment: null - asset_type: - asset_icon_not_compromised: windows_desktop.png - asset_icon_compromised: ioc_windows_desktop.png - asset_description: Standard Windows Computer - asset_id: 9 - asset_name: Windows - Computer - asset_type_id: 9 - case_id: 1 - asset_description: A host description - asset_id: 3912 - analysis_status_id: 3 - custom_attributes: {} - asset_info: '' - user_id: 1 - date_added: '2024-01-09T13:25:51.328503' - date_update: '2024-01-09T13:25:51.328506' - asset_name: admin_laptop - asset_ip: 127.0.0.1 - asset_tags: anewtag - asset_compromise_status_id: 1 - asset_uuid: 5914a960-d6d5-4e18-9665-613037d8f702 - asset_domain: iris.local + required: + - status + - message + - data examples: example-1: value: @@ -2487,6 +3448,38 @@ paths: application/json: schema: type: object + x-examples: + Example 1: + status: success + message: Updated asset admin_laptop + data: + asset_enrichment: + Another enrichment provider: + Another key: Another value + asset_type: + asset_icon_not_compromised: windows_desktop.png + asset_icon_compromised: ioc_windows_desktop.png + asset_description: Standard Windows Computer + asset_id: 9 + asset_name: Windows - Computer + asset_type_id: 9 + case_id: 1 + asset_description: A host description + asset_id: 2548 + analysis_status_id: 3 + custom_attributes: {} + asset_info: '' + user_id: 4 + date_added: '2024-01-04T13:20:43.522581' + date_update: '2024-01-04T13:20:43.522598' + asset_name: admin_laptop + ioc_links: + - 30 + asset_ip: 127.0.0.1 + asset_tags: anewtag + asset_compromise_status_id: 1 + asset_uuid: 9d188714-5251-41f3-817b-3b1c8515de06 + asset_domain: iris.local properties: status: type: string @@ -2494,17 +3487,37 @@ paths: type: string data: type: object + required: + - asset_enrichment + - asset_type + - asset_type_id + - case_id + - asset_description + - asset_id + - analysis_status_id + - custom_attributes + - asset_info + - user_id + - date_added + - date_update + - asset_name + - ioc_links + - asset_ip + - asset_tags + - asset_compromise_status_id + - asset_uuid + - asset_domain properties: asset_enrichment: type: object - properties: - Another enrichment provider: - type: object - properties: - Another key: - type: string asset_type: type: object + required: + - asset_icon_not_compromised + - asset_icon_compromised + - asset_description + - asset_id + - asset_name properties: asset_icon_not_compromised: type: string @@ -2528,7 +3541,6 @@ paths: type: integer custom_attributes: type: object - properties: {} asset_info: type: string user_id: @@ -2553,38 +3565,10 @@ paths: type: string asset_domain: type: string - x-examples: - Example 1: - status: success - message: Updated asset admin_laptop - data: - asset_enrichment: - Another enrichment provider: - Another key: Another value - asset_type: - asset_icon_not_compromised: windows_desktop.png - asset_icon_compromised: ioc_windows_desktop.png - asset_description: Standard Windows Computer - asset_id: 9 - asset_name: Windows - Computer - asset_type_id: 9 - case_id: 1 - asset_description: A host description - asset_id: 2548 - analysis_status_id: 3 - custom_attributes: {} - asset_info: '' - user_id: 4 - date_added: '2024-01-04T13:20:43.522581' - date_update: '2024-01-04T13:20:43.522598' - asset_name: admin_laptop - ioc_links: - - 30 - asset_ip: 127.0.0.1 - asset_tags: anewtag - asset_compromise_status_id: 1 - asset_uuid: 9d188714-5251-41f3-817b-3b1c8515de06 - asset_domain: iris.local + required: + - status + - message + - data examples: example-1: value: @@ -3746,7 +4730,7 @@ paths: object_state: 215 object_last_update: '2024-01-04T15:50:13.728362' operationId: get-case-notes-group - description: 'Get a list of the notes and groups. The content of the notes is not returned. ' + description: 'This endpoint is deprecated. Use `/case/notes/directories/filter`. ' security: - Bearer : [] parameters: @@ -3758,10 +4742,11 @@ paths: required: true tags: - Case notes + deprecated: true parameters: [] - '/case/notes/groups/{group_id}': + /case/notes/directories/filter: get: - summary: Fetch a notes group + summary: Get list of directories and notes responses: '200': description: OK @@ -3777,256 +4762,1143 @@ paths: data: type: object properties: - group_id: - type: integer - group_uuid: - type: string - group_title: - type: string - group_creationdate: - type: string - group_lastupdate: - type: string - notes: + groups: type: array items: type: object properties: - note_id: + group_id: type: integer - note_uuid: - type: string - note_title: - type: string - user: + group_uuid: type: string - note_lastupdate: + group_title: type: string + notes: + type: array + items: + type: object + properties: + note_id: + type: integer + note_uuid: + type: string + note_title: + type: string + user: + type: string + note_lastupdate: + type: string + state: + type: object + properties: + object_state: + type: integer + object_last_update: + type: string x-examples: Example 1: status: success message: '' data: - group_id: 186 - group_uuid: 3551ce9f-1446-4163-ab9e-78b9c4187cfd - group_title: Group 186 - group_creationdate: '2023-02-09T19:01:45.753049' - group_lastupdate: '2023-02-09T19:01:45.753049' - notes: - - note_id: 110 - note_uuid: 45df996f-f96d-4162-a5eb-2ddb66500d97 - note_title: Test Note - user: adm_1 - note_lastupdate: '2023-12-29T19:21:48.799248' - - note_id: 1620 - note_uuid: c47a232f-ccce-4883-ace2-b071c31ba009 - note_title: Untitled note - user: adm_3 - note_lastupdate: '2023-12-14T17:50:03.136531' - - note_id: 1733 - note_uuid: 56a0bea6-e65b-4ff9-9000-a3f34b162d83 - note_title: Untitled note - user: adm_1 - note_lastupdate: '2023-11-24T14:10:31.487938' - - note_id: 1834 - note_uuid: 9176ddd1-fb35-41f3-ba4e-e26f32fede8b - note_title: Untitled note - user: adm_3 - note_lastupdate: '2023-12-07T14:50:05.324440' - - note_id: 1953 - note_uuid: 6d34d408-df68-45c1-a92a-d7fb1e962993 - note_title: Untitled note - user: adm_1 - note_lastupdate: '2024-01-04T15:50:06.758144' - examples: - example-1: - value: - status: success - message: '' - data: - group_id: 186 - group_uuid: 3551ce9f-1446-4163-ab9e-78b9c4187cfd - group_title: Group 186 - group_creationdate: '2023-02-09T19:01:45.753049' - group_lastupdate: '2023-02-09T19:01:45.753049' - notes: - - note_id: 110 - note_uuid: 45df996f-f96d-4162-a5eb-2ddb66500d97 - note_title: Test Note - user: adm_1 - note_lastupdate: '2023-12-29T19:21:48.799248' - - note_id: 1620 - note_uuid: c47a232f-ccce-4883-ace2-b071c31ba009 - note_title: Untitled note - user: adm_3 - note_lastupdate: '2023-12-14T17:50:03.136531' - - note_id: 1733 - note_uuid: 56a0bea6-e65b-4ff9-9000-a3f34b162d83 - note_title: Untitled note - user: adm_1 - note_lastupdate: '2023-11-24T14:10:31.487938' - - note_id: 1834 - note_uuid: 9176ddd1-fb35-41f3-ba4e-e26f32fede8b - note_title: Untitled note - user: adm_3 - note_lastupdate: '2023-12-07T14:50:05.324440' - - note_id: 1953 - note_uuid: 6d34d408-df68-45c1-a92a-d7fb1e962993 - note_title: Untitled note - user: adm_1 - note_lastupdate: '2024-01-04T15:50:06.758144' - '400': - description: Bad Request - content: - application/json: - schema: - description: '' - type: object - properties: - data: - type: array - items: - properties: {} - message: - type: string - minLength: 1 - status: - type: string - minLength: 1 - required: - - data - - message - - status - x-examples: - example-1: - data: [] - message: Invalid group ID - status: error - examples: - Invalid group ID: - value: - data: [] - message: Invalid group ID - status: error - operationId: get-case-groups-fetch - description: Fetch a notes group - security: - - Bearer : [] - parameters: - - schema: - type: string - in: query - name: cid - description: ID Of the case - required: true - tags: - - Case notes - parameters: - - schema: - type: string - name: group_id - in: path - required: true - description: ID of the group to return - /case/notes/groups/add: - parameters: [] - post: - summary: Add a new notes group - operationId: post-case-notes-addgroup - responses: - '200': - description: 'Upon success, returns the new added group information' - content: - application/json: - schema: - type: object - properties: - status: - type: string - message: - type: string - data: - type: object - properties: - group_lastupdate: - type: string - group_uuid: - type: string - group_title: - type: string - group_creationdate: - type: string - group_id: - type: integer - x-examples: - Example 1: - status: success - message: Notes group added - data: - group_lastupdate: '2024-01-09T15:16:19.352384' - group_uuid: f337d1cb-216b-4d21-8051-cbcead9bcb4c - group_title: Test - group_creationdate: '2024-01-09T15:16:19.352384' - group_id: 1692 - examples: - Example: - value: - status: success - message: Notes group added - data: - group_lastupdate: '2024-01-09T15:16:19.352384' - group_uuid: f337d1cb-216b-4d21-8051-cbcead9bcb4c - group_title: Test - group_creationdate: '2024-01-09T15:16:19.352384' - group_id: 1692 - description: 'The created group is empty. ' - parameters: - - schema: - type: string - in: query - name: cid - description: Case ID - required: true - security: - - Bearer : [] - requestBody: - content: - application/json: - schema: - type: object - x-examples: - example-1: - group_title: Test - cid: 5 - properties: - group_title: - type: string - minLength: 1 - examples: - Add test group: - value: - group_title: Test - description: 'If the group title isn''t set, a default group name is set by the server. ' - tags: - - Case notes - '/case/notes/groups/update/{group_id}': - parameters: - - schema: - type: string - name: group_id - in: path - required: true - description: Group ID to update - post: - summary: Update a notes group - operationId: post-case-notes-update-group - responses: - '200': - description: 'Upon success, returns the new added group information' - content: - application/json: - schema: - type: object + groups: + - group_id: 186 + group_uuid: 3551ce9f-1446-4163-ab9e-78b9c4187cfd + group_title: Group 186 + notes: + - note_id: 110 + note_uuid: 45df996f-f96d-4162-a5eb-2ddb66500d97 + note_title: Test Note + user: adm_1 + note_lastupdate: '2023-12-29T19:21:48.799248' + - note_id: 1620 + note_uuid: c47a232f-ccce-4883-ace2-b071c31ba009 + note_title: Untitled note + user: adm_3 + note_lastupdate: '2023-12-14T17:50:03.136531' + - note_id: 1733 + note_uuid: 56a0bea6-e65b-4ff9-9000-a3f34b162d83 + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-11-24T14:10:31.487938' + - note_id: 1834 + note_uuid: 9176ddd1-fb35-41f3-ba4e-e26f32fede8b + note_title: Untitled note + user: adm_3 + note_lastupdate: '2023-12-07T14:50:05.324440' + - note_id: 1953 + note_uuid: 6d34d408-df68-45c1-a92a-d7fb1e962993 + note_title: Untitled note + user: adm_1 + note_lastupdate: '2024-01-04T15:50:06.758144' + - group_id: 192 + group_uuid: 39434f81-9b8f-4540-9818-96b3dae0a48e + group_title: Investigation + notes: + - note_id: 856 + note_uuid: bcd2f25c-e329-4ef0-b2fb-1b68ee4ef537 + note_title: IOC ? + user: adm_1 + note_lastupdate: '2023-12-08T02:23:07.030130' + - note_id: 1820 + note_uuid: 6d293b2c-06b7-422a-887b-284bf559636d + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-12-05T03:20:09.078152' + - note_id: 1934 + note_uuid: f3b28930-844e-4edb-936d-12d87231aeaf + note_title: Untitled note + user: adm_1 + note_lastupdate: '2024-01-02T06:44:34.079779' + - note_id: 1954 + note_uuid: 12b4a4a8-d0a9-49ff-9b97-3ad43c6aa86e + note_title: testing stuff for frodo on the one ring server + user: adm_1 + note_lastupdate: '2024-01-04T15:50:44.699016' + - group_id: 223 + group_uuid: 7538ceb3-e7c2-4ca8-911d-031a66f0f2fc + group_title: Group 223 + notes: + - note_id: 213 + note_uuid: 066e24c2-85ca-41a5-b982-91f44dd92ebe + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-03-31T22:35:43.435906' + - group_id: 229 + group_uuid: 3bec5c22-ae2e-415a-9eee-18b10ace47df + group_title: Group 229 + notes: + - note_id: 530 + note_uuid: b5a5403a-2bf6-4649-bf78-2a476d0b31da + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-06-06T07:18:08.899797' + - group_id: 230 + group_uuid: 80c4fb87-e939-42b5-863e-11be4c4c8991 + group_title: Group 230 + notes: + - note_id: 774 + note_uuid: 294ab835-cc02-4ae5-a04c-821cde72b623 + note_title: Untitled note + user: adm_3 + note_lastupdate: '2023-07-27T06:33:29.931800' + - group_id: 316 + group_uuid: ba1e558b-cc24-46ee-b192-a6fe2a3a03ec + group_title: Group 316 + notes: + - note_id: 1757 + note_uuid: 8f909d5a-07d7-4f81-afad-767c860253ba + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-11-29T22:28:49.316698' + - group_id: 317 + group_uuid: 46a1c5d4-8e18-42e0-89f4-906c1e0bd288 + group_title: Group 317 + notes: [] + - group_id: 318 + group_uuid: c64875de-5cdb-43b9-b49f-ba523e8b610d + group_title: Group 318 + notes: + - note_id: 1732 + note_uuid: b16a7bdb-698a-4c7a-be56-2deb64f4d949 + note_title: Untitled note + user: adm_3 + note_lastupdate: '2023-11-24T00:05:45.580907' + - group_id: 319 + group_uuid: ce1c592c-3df6-43ea-9cbd-894f30a56bf0 + group_title: Group 319 + notes: [] + - group_id: 320 + group_uuid: 970e0a0d-f28f-4192-8239-7831c4560367 + group_title: Group 320 + notes: + - note_id: 239 + note_uuid: a714b7a3-8344-4b15-ba24-d1722adcfe65 + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-04-12T13:14:48.811734' + - group_id: 351 + group_uuid: 71d555a9-4060-411a-be2f-f0d33793c647 + group_title: new group + notes: + - note_id: 276 + note_uuid: 5217a534-e236-4516-8d44-dfd0d6fcbdcb + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-04-27T09:27:18.650654' + - group_id: 385 + group_uuid: 8eb53b45-1226-4468-ace1-2d10f7831a6f + group_title: Group 385 + notes: [] + - group_id: 562 + group_uuid: 1dfe7ef3-7597-4d4b-9096-3e390e011b40 + group_title: Group 562 + notes: + - note_id: 1831 + note_uuid: c305d4e1-adcd-410d-8d56-d73364faff34 + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-12-07T10:20:18.227276' + - group_id: 563 + group_uuid: a5094fd7-02d0-44b0-beeb-c8b3d3e8f8e8 + group_title: Group 563 + notes: [] + - group_id: 565 + group_uuid: bcd7ac17-064f-49b9-941b-a5e01b82cfdb + group_title: Group 565 + notes: + - note_id: 696 + note_uuid: 5d45d634-f463-4400-840a-646423e9c152 + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-07-12T08:35:22.251498' + - group_id: 589 + group_uuid: c111f93c-622d-4954-9592-da4406109897 + group_title: Group 589 + notes: [] + - group_id: 590 + group_uuid: 2e38b22f-f3b8-4345-b110-a735d1afb228 + group_title: Group 590 + notes: + - note_id: 1789 + note_uuid: e8f3943a-778a-4850-be22-0fb9fca7eeed + note_title: Untitled note + user: adm_3 + note_lastupdate: '2023-12-01T16:06:25.564707' + - group_id: 615 + group_uuid: 1555f460-e29a-4a1e-a438-b02309b4e9ef + group_title: Group 615 + notes: [] + - group_id: 731 + group_uuid: 11e3e6d1-ab59-4c39-a478-420c865e7e69 + group_title: Group 731 + notes: + - note_id: 730 + note_uuid: 7e45074a-e828-45b6-95c3-1c2d50854d31 + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-07-20T07:08:09.733633' + - group_id: 748 + group_uuid: 2af357bf-9a8a-4a82-b047-6d2804b5de8b + group_title: Group 748 + notes: [] + - group_id: 766 + group_uuid: f55a2e9e-ab3e-4e89-9bcb-3a082c677e73 + group_title: New notes group + notes: + - note_id: 1276 + note_uuid: 17d9b1b2-7788-4588-9a8b-59a4cd014cce + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-09-22T08:28:12.315640' + - group_id: 767 + group_uuid: 04e13560-18c1-48fc-b8ff-31f49dd9f8fd + group_title: New notes group + notes: + - note_id: 798 + note_uuid: 947019ef-f587-417f-b2be-1f02cb083add + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-07-31T11:41:40.057720' + - group_id: 801 + group_uuid: b68617d8-a1c5-43a3-ac0f-490fb884f615 + group_title: New notes group + notes: [] + - group_id: 802 + group_uuid: 4443a8b5-08c7-432f-971c-48413073487d + group_title: New notes group + notes: [] + - group_id: 912 + group_uuid: cfde6d2d-5985-4276-8e5e-a7836df5a0b3 + group_title: New notes group + notes: [] + - group_id: 916 + group_uuid: ff8c3646-75ff-417a-81b5-8b6555be49ee + group_title: New notes group + notes: + - note_id: 1606 + note_uuid: e9358f9c-ef82-4754-b6df-12344b053a91 + note_title: Untitled note + user: adm_3 + note_lastupdate: '2023-11-06T02:32:11.434290' + - group_id: 984 + group_uuid: 31cc129c-f097-469b-a97b-ffde2c3e52da + group_title: New notes group + notes: [] + - group_id: 985 + group_uuid: 1f455c92-7985-4abe-bd45-b7412691a026 + group_title: New notes group + notes: + - note_id: 1933 + note_uuid: 60c88bb5-78bd-4f2e-8eb2-d77d7cbf2b2d + note_title: Untitled note + user: adm_1 + note_lastupdate: '2024-01-02T06:44:22.177576' + - group_id: 986 + group_uuid: baa949b7-7dc0-4b9c-bb91-58748d2d4914 + group_title: New notes group + notes: [] + - group_id: 1122 + group_uuid: 25bc6402-53f8-4165-82a6-7e098ad3dfce + group_title: New notes group + notes: [] + - group_id: 1141 + group_uuid: 78ed4c55-bd49-4cd9-8d59-0a3461063529 + group_title: New notes group + notes: [] + - group_id: 1142 + group_uuid: 3647e416-e782-47c6-bfc0-9ee42e835345 + group_title: New notes group + notes: [] + - group_id: 1169 + group_uuid: 536404d9-ceb1-4e52-bcdc-6a5fb1faa0dd + group_title: New notes group + notes: + - note_id: 1277 + note_uuid: dd310051-550c-40ff-b5fc-53fa5e022997 + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-09-22T08:28:23.443734' + - group_id: 1235 + group_uuid: 76924746-b2e2-4088-afad-b0e88161a756 + group_title: New notes group + notes: [] + - group_id: 1289 + group_uuid: aeb2e9b0-a0ee-4c09-9be8-60123ebc86ea + group_title: New notes group + notes: [] + - group_id: 1290 + group_uuid: 16114da7-40ed-4864-8c3c-f63b1b1c5b6e + group_title: New notes group + notes: + - note_id: 1919 + note_uuid: d72525a6-81c0-44ca-8ec5-76dea8ccd9df + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-12-27T16:15:24.956701' + - group_id: 1291 + group_uuid: 60b1fd6b-24a2-4f82-aeec-25d48858a1a7 + group_title: New notes group + notes: [] + - group_id: 1292 + group_uuid: c26094d8-5284-4270-b8e7-854e0306d378 + group_title: New notes group + notes: [] + - group_id: 1329 + group_uuid: 9a950733-4825-436f-b5d8-5b7be9fd130e + group_title: New notes group + notes: [] + - group_id: 1378 + group_uuid: c731447c-52d9-462e-b006-548cdba13fbe + group_title: New notes group + notes: [] + - group_id: 1384 + group_uuid: 07617992-8300-4023-99ae-933e7b3cd8ed + group_title: New notes group + notes: [] + - group_id: 1385 + group_uuid: 72e5a1a1-3853-42fc-a8b6-4765043ce12f + group_title: New notes group + notes: [] + - group_id: 1425 + group_uuid: 1b42b99b-8479-47bc-84dc-7992c2ddaab7 + group_title: New notes group + notes: [] + - group_id: 1442 + group_uuid: 47436e25-8bd9-4926-adab-3a74e5131a73 + group_title: New notes group + notes: [] + - group_id: 1498 + group_uuid: 7a0b754a-096b-4b94-a3d5-8cda257f42d5 + group_title: New notes group + notes: [] + - group_id: 1499 + group_uuid: 126968ba-cc9f-42fe-87d3-f48ce6cdf034 + group_title: New notes group + notes: [] + - group_id: 1505 + group_uuid: e417f7a3-9d61-416b-aa59-ecc2f623da6b + group_title: New notes group + notes: [] + - group_id: 1506 + group_uuid: 4afff67b-9eb9-42fa-ae37-b54cbc170e8e + group_title: New notes group + notes: [] + - group_id: 1507 + group_uuid: 40e12b26-3ae9-47aa-ae28-15e46a777ab9 + group_title: New notes group + notes: [] + - group_id: 1510 + group_uuid: 7247267b-3e14-4154-93a5-ba388c45b7e0 + group_title: New notes group + notes: [] + - group_id: 1511 + group_uuid: 87d73fcb-3dba-4fda-920e-9c315a5023eb + group_title: New notes group + notes: [] + - group_id: 1512 + group_uuid: dd28240f-0edf-484f-b904-c5e71de8ccac + group_title: New notes group + notes: [] + - group_id: 1526 + group_uuid: 20947604-dc3a-40f9-a68d-2c758ae05e8a + group_title: New notes group + notes: [] + - group_id: 1527 + group_uuid: a489154f-a436-4a29-97b0-0a2554eda575 + group_title: New notes group + notes: [] + - group_id: 1528 + group_uuid: 40f9fa9e-3895-4de2-9f73-c64dc398771d + group_title: New notes group + notes: [] + - group_id: 1530 + group_uuid: ec3ab46b-ae85-4734-8db7-2d4895f57bd0 + group_title: New notes group + notes: [] + - group_id: 1531 + group_uuid: 7db00392-05ac-489a-8de9-0a0fc93c761d + group_title: New notes group + notes: [] + - group_id: 1532 + group_uuid: 318a8ee3-b405-4381-9161-8e40af979e57 + group_title: New notes group + notes: [] + - group_id: 1545 + group_uuid: 485c039f-5baf-4b1c-a0a8-c20660ef8c5f + group_title: New notes group + notes: [] + - group_id: 1583 + group_uuid: c49962b4-39c8-4a21-82de-8eb659f2b106 + group_title: New notes group + notes: [] + - group_id: 1602 + group_uuid: ff1b79ed-12ed-475d-9ab7-4cfb1e073480 + group_title: New notes group + notes: [] + - group_id: 1639 + group_uuid: de3d38eb-9a5b-4f87-99d6-d6c610d32ac3 + group_title: New notes group + notes: [] + - group_id: 1657 + group_uuid: d07e3f4c-ba88-4586-94f8-1cc3d7239cad + group_title: New notes group + notes: [] + - group_id: 1665 + group_uuid: f3d66447-fad7-44f5-9831-5a25486f8408 + group_title: New notes group + notes: [] + - group_id: 1675 + group_uuid: b384e358-6cd3-4773-b6b8-8e47e963cc8d + group_title: New notes group + notes: [] + state: + object_state: 215 + object_last_update: '2024-01-04T15:50:13.728362' + examples: + Example 1: + value: + status: success + message: '' + data: + - id: 5 + name: Dummy title + note_count: 1 + subdirectories: [] + notes: + - id: 1 + title: New note + - id: 7 + name: Dummy title + note_count: 0 + subdirectories: [] + notes: [] + - id: 4 + name: New folder + note_count: 0 + subdirectories: [] + notes: [] + - id: 34 + name: Test + note_count: 0 + subdirectories: [] + notes: [] + - id: 33 + name: Test + note_count: 0 + subdirectories: [] + notes: [] + - id: 3 + name: ds + note_count: 0 + subdirectories: [] + notes: [] + - id: 1 + name: dsd + note_count: 0 + subdirectories: [] + notes: [] + - id: 2 + name: ss + note_count: 0 + subdirectories: + - id: 4 + name: New folder + note_count: 0 + subdirectories: [] + - id: 3 + name: ds + note_count: 0 + subdirectories: [] + notes: [] + '': + content: + application/json: + schema: + type: object + x-examples: + Example 1: + status: success + message: '' + data: + - id: 5 + name: Dummy title + note_count: 1 + subdirectories: [] + notes: + - id: 1 + title: New note + - id: 7 + name: Dummy title + note_count: 0 + subdirectories: [] + notes: [] + - id: 4 + name: New folder + note_count: 0 + subdirectories: [] + notes: [] + - id: 3 + name: ds + note_count: 0 + subdirectories: [] + notes: [] + - id: 1 + name: dsd + note_count: 0 + subdirectories: [] + notes: [] + - id: 2 + name: ss + note_count: 0 + subdirectories: + - id: 4 + name: New folder + note_count: 0 + subdirectories: [] + - id: 3 + name: ds + note_count: 0 + subdirectories: [] + notes: [] + properties: + status: + type: string + message: + type: string + data: + type: array + items: + type: object + properties: + id: + type: integer + name: + type: string + note_count: + type: integer + subdirectories: + type: array + items: + type: object + properties: + id: + type: integer + name: + type: string + note_count: + type: integer + subdirectories: + type: array + items: + type: object + notes: + type: array + items: + type: object + properties: + id: + type: integer + title: + type: string + required: + - id + - name + - note_count + - subdirectories + - notes + required: + - status + - message + - data + operationId: get-case-notes-directories + description: 'List the directories and notes associated to it. ' + security: + - Bearer : [] + parameters: + - schema: + type: integer + in: query + name: cid + description: Case ID + required: true + tags: + - Case notes + parameters: [] + '/case/notes/groups/{group_id}': + get: + summary: Fetch a notes group + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + status: + type: string + message: + type: string + data: + type: object + properties: + group_id: + type: integer + group_uuid: + type: string + group_title: + type: string + group_creationdate: + type: string + group_lastupdate: + type: string + notes: + type: array + items: + type: object + properties: + note_id: + type: integer + note_uuid: + type: string + note_title: + type: string + user: + type: string + note_lastupdate: + type: string + x-examples: + Example 1: + status: success + message: '' + data: + group_id: 186 + group_uuid: 3551ce9f-1446-4163-ab9e-78b9c4187cfd + group_title: Group 186 + group_creationdate: '2023-02-09T19:01:45.753049' + group_lastupdate: '2023-02-09T19:01:45.753049' + notes: + - note_id: 110 + note_uuid: 45df996f-f96d-4162-a5eb-2ddb66500d97 + note_title: Test Note + user: adm_1 + note_lastupdate: '2023-12-29T19:21:48.799248' + - note_id: 1620 + note_uuid: c47a232f-ccce-4883-ace2-b071c31ba009 + note_title: Untitled note + user: adm_3 + note_lastupdate: '2023-12-14T17:50:03.136531' + - note_id: 1733 + note_uuid: 56a0bea6-e65b-4ff9-9000-a3f34b162d83 + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-11-24T14:10:31.487938' + - note_id: 1834 + note_uuid: 9176ddd1-fb35-41f3-ba4e-e26f32fede8b + note_title: Untitled note + user: adm_3 + note_lastupdate: '2023-12-07T14:50:05.324440' + - note_id: 1953 + note_uuid: 6d34d408-df68-45c1-a92a-d7fb1e962993 + note_title: Untitled note + user: adm_1 + note_lastupdate: '2024-01-04T15:50:06.758144' + examples: + example-1: + value: + status: success + message: '' + data: + group_id: 186 + group_uuid: 3551ce9f-1446-4163-ab9e-78b9c4187cfd + group_title: Group 186 + group_creationdate: '2023-02-09T19:01:45.753049' + group_lastupdate: '2023-02-09T19:01:45.753049' + notes: + - note_id: 110 + note_uuid: 45df996f-f96d-4162-a5eb-2ddb66500d97 + note_title: Test Note + user: adm_1 + note_lastupdate: '2023-12-29T19:21:48.799248' + - note_id: 1620 + note_uuid: c47a232f-ccce-4883-ace2-b071c31ba009 + note_title: Untitled note + user: adm_3 + note_lastupdate: '2023-12-14T17:50:03.136531' + - note_id: 1733 + note_uuid: 56a0bea6-e65b-4ff9-9000-a3f34b162d83 + note_title: Untitled note + user: adm_1 + note_lastupdate: '2023-11-24T14:10:31.487938' + - note_id: 1834 + note_uuid: 9176ddd1-fb35-41f3-ba4e-e26f32fede8b + note_title: Untitled note + user: adm_3 + note_lastupdate: '2023-12-07T14:50:05.324440' + - note_id: 1953 + note_uuid: 6d34d408-df68-45c1-a92a-d7fb1e962993 + note_title: Untitled note + user: adm_1 + note_lastupdate: '2024-01-04T15:50:06.758144' + '400': + description: Bad Request + content: + application/json: + schema: + description: '' + type: object + properties: + data: + type: array + items: + properties: {} + message: + type: string + minLength: 1 + status: + type: string + minLength: 1 + required: + - data + - message + - status + x-examples: + example-1: + data: [] + message: Invalid group ID + status: error + examples: + Invalid group ID: + value: + data: [] + message: Invalid group ID + status: error + operationId: get-case-groups-fetch + description: 'This endpoint is deprecated and not replaced yet. ' + security: + - Bearer : [] + parameters: + - schema: + type: string + in: query + name: cid + description: ID Of the case + required: true + tags: + - Case notes + deprecated: true + parameters: + - schema: + type: string + name: group_id + in: path + required: true + description: ID of the group to return + '': + parameters: [] + /case/notes/groups/add: + parameters: [] + post: + summary: Add a new notes group + operationId: post-case-notes-addgroup + responses: + '200': + description: 'Upon success, returns the new added group information' + content: + application/json: + schema: + type: object + properties: + status: + type: string + message: + type: string + data: + type: object + properties: + group_lastupdate: + type: string + group_uuid: + type: string + group_title: + type: string + group_creationdate: + type: string + group_id: + type: integer + x-examples: + Example 1: + status: success + message: Notes group added + data: + group_lastupdate: '2024-01-09T15:16:19.352384' + group_uuid: f337d1cb-216b-4d21-8051-cbcead9bcb4c + group_title: Test + group_creationdate: '2024-01-09T15:16:19.352384' + group_id: 1692 + examples: + Example: + value: + status: success + message: Notes group added + data: + group_lastupdate: '2024-01-09T15:16:19.352384' + group_uuid: f337d1cb-216b-4d21-8051-cbcead9bcb4c + group_title: Test + group_creationdate: '2024-01-09T15:16:19.352384' + group_id: 1692 + description: 'This endpoint is deprecated. Use `/cases/notes/directories/add`. ' + parameters: + - schema: + type: string + in: query + name: cid + description: Case ID + required: true + security: + - Bearer : [] + requestBody: + content: + application/json: + schema: + type: object + x-examples: + example-1: + group_title: Test + cid: 5 + properties: + group_title: + type: string + minLength: 1 + examples: + Add test group: + value: + group_title: Test + description: 'If the group title isn''t set, a default group name is set by the server. ' + tags: + - Case notes + deprecated: true + /case/notes/directories/add: + parameters: [] + post: + summary: Add a new notes directory + operationId: post-case-notes-add-directory + responses: + '200': + description: 'Upon success, returns the new added group information' + content: + application/json: + schema: + type: object + properties: + status: + type: string + message: + type: string + data: + type: object + properties: + group_lastupdate: + type: string + group_uuid: + type: string + group_title: + type: string + group_creationdate: + type: string + group_id: + type: integer + x-examples: + Example 1: + status: success + message: Notes group added + data: + group_lastupdate: '2024-01-09T15:16:19.352384' + group_uuid: f337d1cb-216b-4d21-8051-cbcead9bcb4c + group_title: Test + group_creationdate: '2024-01-09T15:16:19.352384' + group_id: 1692 + examples: + Example: + value: + status: success + message: Notes group added + data: + group_lastupdate: '2024-01-09T15:16:19.352384' + group_uuid: f337d1cb-216b-4d21-8051-cbcead9bcb4c + group_title: Test + group_creationdate: '2024-01-09T15:16:19.352384' + group_id: 1692 + '': + content: + application/json: + schema: + type: object + x-examples: + Example 1: + status: success + message: Directory added + data: + id: 34 + name: Test + parent_id: null + case_id: 1 + properties: + status: + type: string + message: + type: string + data: + type: object + required: + - id + - name + - parent_id + - case_id + properties: + id: + type: integer + name: + type: string + parent_id: + type: 'null' + case_id: + type: integer + required: + - status + - message + - data + description: 'Create a new empty directory. ' + parameters: + - schema: + type: string + in: query + name: cid + description: Case ID + required: true + security: + - Bearer : [] + requestBody: + content: + application/json: + schema: + type: object + x-examples: + example-1: + group_title: Test + cid: 5 + properties: + name: + type: string + minLength: 1 + x-stoplight: + id: dx798bvpo9pnc + parent_id: + type: number + x-stoplight: + id: 4jz5qdrpoepow + description: 'An existing parent directory ID. To add at the root, do not set the field or set it to null. ' + required: + - name + examples: + Add test group: + value: + name: Test + parent_id: null + description: '' + tags: + - Case notes + '/case/notes/groups/update/{group_id}': + parameters: + - schema: + type: string + name: group_id + in: path + required: true + description: Group ID to update + post: + summary: Update a notes group + operationId: post-case-notes-update-group + responses: + '200': + description: 'Upon success, returns the new added group information' + content: + application/json: + schema: + type: object + properties: + status: + type: string + message: + type: string + data: + type: object + properties: + group_lastupdate: + type: string + group_uuid: + type: string + group_title: + type: string + group_creationdate: + type: string + group_id: + type: integer + x-examples: + Example 1: + status: success + message: Updated title of group ID 186 + data: + group_lastupdate: '2023-02-09T19:01:45.753049' + group_uuid: 3551ce9f-1446-4163-ab9e-78b9c4187cfd + group_title: Test + group_creationdate: '2023-02-09T19:01:45.753049' + group_id: 186 + examples: + Example: + value: + status: success + message: Updated title of group ID 186 + data: + group_lastupdate: '2023-02-09T19:01:45.753049' + group_uuid: 3551ce9f-1446-4163-ab9e-78b9c4187cfd + group_title: Test + group_creationdate: '2023-02-09T19:01:45.753049' + group_id: 186 + '400': + description: Bad Request + content: + application/json: + schema: + description: '' + type: object + x-examples: + example-1: + data: + note_tile: + - Unknown field. + note_title: + - Missing data for required field. + message: Data error + status: error + properties: + data: + type: object + message: + type: string + minLength: 1 + status: + type: string + minLength: 1 + required: + - data + - message + - status + examples: + example-1: + value: + data: [] + message: Group ID 3 not found + status: error + description: 'This endpoint is deprecated. Use `/case/notes/directories/update/{directory_id}`.' + parameters: + - schema: + type: string + in: query + name: cid + description: case ID + required: true + security: + - Bearer : [] + requestBody: + content: + application/json: + schema: + type: object + x-examples: + example-1: + group_title: Test + cid: 5 + properties: + group_title: + type: string + minLength: 1 + required: + - group_title + examples: + Add test group: + value: + group_title: Test + description: '' + tags: + - Case notes + deprecated: true + '/case/notes/directories/update/{directory_id}': + parameters: + - schema: + type: integer + name: directory_id + in: path + required: true + post: + summary: Update a notes directory + operationId: post-case-notes-update-directory + responses: + '200': + description: 'Upon success, returns the new added directory information' + content: + application/json: + schema: + type: object + x-examples: + Example 1: + status: success + message: Directory modified + data: + id: 1 + name: Test 1 + parent_id: null + case_id: 1 properties: status: type: string @@ -4034,38 +5906,34 @@ paths: type: string data: type: object + required: + - id + - name + - parent_id + - case_id properties: - group_lastupdate: - type: string - group_uuid: - type: string - group_title: - type: string - group_creationdate: + id: + type: integer + name: type: string - group_id: + parent_id: + type: 'null' + case_id: type: integer - x-examples: - Example 1: - status: success - message: Updated title of group ID 186 - data: - group_lastupdate: '2023-02-09T19:01:45.753049' - group_uuid: 3551ce9f-1446-4163-ab9e-78b9c4187cfd - group_title: Test - group_creationdate: '2023-02-09T19:01:45.753049' - group_id: 186 + required: + - status + - message + - data examples: Example: value: status: success - message: Updated title of group ID 186 + message: Directory modified data: - group_lastupdate: '2023-02-09T19:01:45.753049' - group_uuid: 3551ce9f-1446-4163-ab9e-78b9c4187cfd - group_title: Test - group_creationdate: '2023-02-09T19:01:45.753049' - group_id: 186 + id: 1 + name: Test 1 + parent_id: null + case_id: 1 '400': description: Bad Request content: @@ -4101,7 +5969,9 @@ paths: data: [] message: Group ID 3 not found status: error - description: 'Update the title of a note group ' + '': + description: '' + description: 'Update the parent and name of a notes directory. ' parameters: - schema: type: string @@ -4121,23 +5991,31 @@ paths: group_title: Test cid: 5 properties: - group_title: + name: type: string minLength: 1 + x-stoplight: + id: ytlrquknoevb0 + parent_id: + type: integer + x-stoplight: + id: k1j8tra4j3vzl + description: 'An existing parent directory ID. To add at the root, do not set the field or set it to null. ' required: - - group_title + - name examples: - Add test group: + Add test directory: value: - group_title: Test + name: Test 1 description: '' tags: - Case notes + deprecated: true '/case/notes/groups/delete/{group_id}': get: summary: Delete a group note operationId: delete-case-notes-group - description: 'This endpoint is deprecated. Use the POST equivalent. ' + description: 'This endpoint is deprecated. Use the POST `/case/notes/directories/delete/{directory_id}` equivalent. ' security: - Bearer : [] parameters: @@ -4156,7 +6034,6 @@ paths: name: group_id in: path required: true - description: ID of the group to delete post: summary: Delete notes group operationId: delete-case-notes-groups-delete @@ -4215,7 +6092,83 @@ paths: data: [] message: Invalid group ID status: error - description: Delete a case notes group + description: 'This endpoint is deprecated. Use the POST `/case/notes/directories/delete/{directory_id}` equivalent. ' + parameters: + - schema: + type: integer + in: query + name: cid + description: Case ID + required: true + tags: + - Case notes + deprecated: true + '/case/notes/directories/delete/{directory_id}': + parameters: + - schema: + type: integer + name: directory_id + in: path + required: true + post: + summary: Delete notes group + operationId: delete-case-notes-directories-delete + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + data: + type: array + items: + type: object + properties: {} + message: + type: string + status: + type: string + x-examples: + Example 1: + data: [] + message: Group ID 22 deleted + status: success + examples: + Example 1: + value: + status: success + message: Directory deleted + data: [] + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + data: + type: array + items: + type: object + properties: {} + message: + type: string + status: + type: string + x-examples: + Example 1: + data: [] + message: Invalid group ID + status: error + examples: + Example 1: + value: + data: [] + message: Invalid directory ID + status: error + description: 'Delete a directory and its content including the associated subdirectories and notes. ' parameters: - schema: type: integer @@ -4225,6 +6178,7 @@ paths: required: true tags: - Case notes + deprecated: true /case/notes/add: parameters: [] post: @@ -4242,18 +6196,26 @@ paths: status: success message: Note added data: - note_lastupdate: '2024-01-09T15:19:04.499780' + directory: + id: 2 + name: ss + parent_id: null + case_id: 1 + note_id: 16 + note_uuid: ecbbd74e-85fd-4268-a9a4-c069677e6677 note_title: Title of the note - note_id: 1963 - custom_attributes: - Notes Flags: - Flag 1: - type: input_checkbox - mandatory: false - value: false - note_creationdate: '2024-01-09T15:19:04.499780' - note_uuid: c8dd2401-12c4-4ab9-b420-14ae09aaad02 note_content: Content of the note + note_user: 1 + note_creationdate: '2024-03-27T18:14:21.245694' + note_lastupdate: '2024-03-27T18:14:21.245724' + note_case_id: 1 + custom_attributes: null + directory_id: 2 + modification_history: + '1711563261.268616': + user: administrator + user_id: 1 + action: created note properties: status: type: string @@ -4261,34 +6223,88 @@ paths: type: string data: type: object + required: + - directory + - note_id + - note_uuid + - note_title + - note_content + - note_user + - note_creationdate + - note_lastupdate + - note_case_id + - custom_attributes + - directory_id + - modification_history properties: - note_lastupdate: + directory: + type: object + required: + - id + - name + - parent_id + - case_id + properties: + id: + type: integer + name: + type: string + parent_id: + type: 'null' + case_id: + type: integer + note_id: + type: integer + note_uuid: type: string note_title: type: string - note_id: + note_content: + type: string + note_user: type: integer - custom_attributes: - type: object note_creationdate: type: string - note_uuid: - type: string - note_content: + note_lastupdate: type: string + note_case_id: + type: integer + custom_attributes: + type: 'null' + directory_id: + type: integer + modification_history: + type: object + required: + - status + - message + - data examples: Example 1: value: + status: success + message: Note added data: - custom_attributes: {} - note_content: Content of the note - note_creationdate: '2023-03-06T12:34:30.082824' - note_id: 11 - note_lastupdate: '2023-03-06T12:34:30.082824' + directory: + id: 2 + name: A dir + parent_id: null + case_id: 1 + note_id: 16 + note_uuid: ecbbd74e-85fd-4268-a9a4-c069677e6677 note_title: Title of the note - note_uuid: 5eb69374-c940-4159-8b32-43d814f17048 - message: Note added - status: success + note_content: Content of the note + note_user: 1 + note_creationdate: '2024-03-27T18:14:21.245694' + note_lastupdate: '2024-03-27T18:14:21.245724' + note_case_id: 1 + custom_attributes: null + directory_id: 2 + modification_history: + '1711563261.268616': + user: administrator + user_id: 1 + action: created note '400': description: Bad Request content: @@ -4356,18 +6372,20 @@ paths: note_content: type: string minLength: 1 - group_id: + directory_id: type: number + x-stoplight: + id: blmfc4nfxgzm2 required: - note_title - note_content - - group_id + - directory_id examples: example-1: value: note_title: Title of the note note_content: Content of the note - group_id: 36 + directory_id: 36 description: '' tags: - Case notes @@ -4381,6 +6399,43 @@ paths: application/json: schema: type: object + x-examples: + Example 1: + status: success + message: '' + data: + directory: + id: 5 + name: Dummy title + parent_id: null + case_id: 1 + note_id: 1 + note_uuid: b8391125-f446-40ec-b4cf-f610fefd0029 + note_title: New note + note_content: |- + Super note + + # hey hey + note_user: 1 + note_creationdate: '2024-03-18T08:35:22.999299' + note_lastupdate: '2024-03-18T08:35:22.999313' + note_case_id: 1 + custom_attributes: null + directory_id: 5 + modification_history: + '1711006761.106673': + user: administrator + user_id: 1 + action: updated note + '1711006771.146321': + user: administrator + user_id: 1 + action: updated note + '1711006776.007962': + user: administrator + user_id: 1 + action: updated note + comments: [] properties: status: type: string @@ -4388,71 +6443,105 @@ paths: type: string data: type: object + required: + - directory + - note_id + - note_uuid + - note_title + - note_content + - note_user + - note_creationdate + - note_lastupdate + - note_case_id + - custom_attributes + - directory_id + - modification_history + - comments properties: - group_uuid: - type: string - group_title: - type: string - note_lastupdate: - type: string - note_title: - type: string + directory: + type: object + required: + - id + - name + - parent_id + - case_id + properties: + id: + type: integer + name: + type: string + parent_id: + type: 'null' + case_id: + type: integer note_id: type: integer - custom_attributes: - type: object - properties: {} - note_creationdate: - type: string note_uuid: type: string + note_title: + type: string note_content: type: string - group_id: + note_user: type: integer - x-examples: - Example 1: - status: success - message: '' - data: - group_uuid: 39434f81-9b8f-4540-9818-96b3dae0a48e - group_title: Investigation - note_lastupdate: '2023-12-08T02:23:07.030130' - note_title: IOC ? - note_id: 856 - custom_attributes: {} - note_creationdate: '2023-08-10T05:57:58.335968' - note_uuid: bcd2f25c-e329-4ef0-b2fb-1b68ee4ef537 - note_content: |- - Notes - Notes - Notes - ```code``` - - [Screenshot](https://v200.beta.dfir-iris.org/datastore/file/view/3?cid=1) - group_id: 192 + note_creationdate: + type: string + note_lastupdate: + type: string + note_case_id: + type: integer + custom_attributes: + type: 'null' + directory_id: + type: integer + modification_history: + type: object + comments: + type: array + items: + type: object + required: + - status + - message + - data examples: Success 1: value: status: success message: '' data: - group_uuid: 39434f81-9b8f-4540-9818-96b3dae0a48e - group_title: Investigation - note_lastupdate: '2023-12-08T02:23:07.030130' - note_title: IOC ? - note_id: 856 - custom_attributes: {} - note_creationdate: '2023-08-10T05:57:58.335968' - note_uuid: bcd2f25c-e329-4ef0-b2fb-1b68ee4ef537 + directory: + id: 5 + name: Dummy title + parent_id: null + case_id: 1 + note_id: 1 + note_uuid: b8391125-f446-40ec-b4cf-f610fefd0029 + note_title: New note note_content: |- - Notes - Notes - Notes - ```code``` + Super note - [Screenshot](https://v200.beta.dfir-iris.org/datastore/file/view/3?cid=1) - group_id: 192 + # hey hey + note_user: 1 + note_creationdate: '2024-03-18T08:35:22.999299' + note_lastupdate: '2024-03-18T08:35:22.999313' + note_case_id: 1 + custom_attributes: null + directory_id: 5 + modification_history: + '1711006761.106673': + user: administrator + user_id: 1 + action: updated note + '1711006771.146321': + user: administrator + user_id: 1 + action: updated note + '1711006776.007962': + user: administrator + user_id: 1 + action: updated note + comments: [] '400': description: Bad Request content: @@ -4487,7 +6576,7 @@ paths: message: Invalid note ID status: error operationId: get-case-notes-fetch - description: Fetch the content and information of a note + description: 'Fetch the content and metadata of a note. ' security: - Bearer : [] parameters: @@ -4506,6 +6595,214 @@ paths: in: path required: true description: ID of the note to fetch + '/case/notes/update/{note_id}': + parameters: + - schema: + type: integer + name: note_id + in: path + required: true + description: ID of the note to save + post: + summary: Save a note + operationId: post-case-notes-save + responses: + '200': + description: 'Upon success, returns the new added note' + content: + application/json: + schema: + type: object + x-examples: + Example 1: + status: success + message: Note ID 16 saved + data: + directory: + id: 4 + name: New folder + parent_id: 2 + case_id: 1 + note_id: 16 + note_uuid: ecbbd74e-85fd-4268-a9a4-c069677e6677 + note_title: New title + note_content: New content + note_user: 1 + note_creationdate: '2024-03-27T18:14:21.245694' + note_lastupdate: '2024-03-27T18:14:21.245724' + note_case_id: 1 + custom_attributes: null + directory_id: 4 + modification_history: + '1711563261.268616': + user: administrator + user_id: 1 + action: created note + '1711563512.541373': + user: administrator + user_id: 1 + action: updated note + '1711563539.900177': + user: administrator + user_id: 1 + action: updated note + '1711563545.354224': + user: administrator + user_id: 1 + action: updated note + '1711563549.441697': + user: administrator + user_id: 1 + action: updated note + properties: + status: + type: string + message: + type: string + data: + type: object + required: + - directory + - note_id + - note_uuid + - note_title + - note_content + - note_user + - note_creationdate + - note_lastupdate + - note_case_id + - custom_attributes + - directory_id + - modification_history + properties: + directory: + type: object + required: + - id + - name + - parent_id + - case_id + properties: + id: + type: integer + name: + type: string + parent_id: + type: integer + case_id: + type: integer + note_id: + type: integer + note_uuid: + type: string + note_title: + type: string + note_content: + type: string + note_user: + type: integer + note_creationdate: + type: string + note_lastupdate: + type: string + note_case_id: + type: integer + custom_attributes: + type: 'null' + directory_id: + type: integer + modification_history: + type: object + required: + - status + - message + - data + examples: + Example: + value: + status: success + message: Note ID 16 saved + data: + directory: + id: 4 + name: New folder + parent_id: 2 + case_id: 1 + note_id: 16 + note_uuid: ecbbd74e-85fd-4268-a9a4-c069677e6677 + note_title: New title + note_content: New content + note_user: 1 + note_creationdate: '2024-03-27T18:14:21.245694' + note_lastupdate: '2024-03-27T18:14:21.245724' + note_case_id: 1 + custom_attributes: null + directory_id: 4 + modification_history: + '1711563261.268616': + user: administrator + user_id: 1 + action: created note + '1711563512.541373': + user: administrator + user_id: 1 + action: updated note + '1711563539.900177': + user: administrator + user_id: 1 + action: updated note + '1711563545.354224': + user: administrator + user_id: 1 + action: updated note + '1711563549.441697': + user: administrator + user_id: 1 + action: updated note + description: 'Update the content and metadata of a note. ' + parameters: + - schema: + type: integer + in: query + name: cid + description: Case ID + required: true + security: + - Bearer : [] + requestBody: + content: + application/json: + schema: + type: object + x-examples: + Example 1: + note_title: New title + note_content: New content + custom_attributes: {} + properties: + note_title: + type: string + note_content: + type: string + custom_attributes: + type: object + parent_id: + type: integer + x-stoplight: + id: 3ogiuabbz1wd5 + required: + - note_title + - note_content + examples: + Example: + value: + note_title: New title + note_content: New content + custom_attributes: {} + directory_id: 4 + description: '' + tags: + - Case notes '/case/notes/delete/{note_id}': post: summary: Delete a note @@ -4603,7 +6900,7 @@ paths: message: Invalid note ID for this case status: error operationId: post-case-delete-note - description: 'Deletes a note. ' + description: 'Delete a note. ' security: - Bearer : [] parameters: @@ -4624,103 +6921,12 @@ paths: description: ID of the note to delete get: summary: Delete note - operationId: get-case-notes-delete-note_id - responses: - '200': - description: OK - deprecated: true - description: 'This endpoint is deprecated. Use the POST equivalent. ' - tags: - - Case notes - '/case/notes/update/{note_id}': - parameters: - - schema: - type: string - name: note_id - in: path - required: true - description: ID of the note to save - post: - summary: Save a note - operationId: post-case-notes-save - responses: - '200': - description: 'Upon success, returns the new added note information' - content: - application/json: - schema: - type: object - properties: - status: - type: string - message: - type: string - data: - type: object - properties: - note_title: - type: string - note_id: - type: integer - custom_attributes: - type: object - properties: {} - note_content: - type: string - x-examples: - Example 1: - status: success - message: Note ID 1820 saved - data: - note_title: New title - note_id: 1820 - custom_attributes: {} - note_content: New content - examples: - Example: - value: - status: success - message: Note ID 1820 saved - data: - note_title: New title - note_id: 1820 - custom_attributes: {} - note_content: New content - description: 'Update the content of a note. ' - parameters: - - schema: - type: integer - in: query - name: cid - description: Case ID - required: true - security: - - Bearer : [] - requestBody: - content: - application/json: - schema: - type: object - properties: - note_title: - type: string - note_content: - type: string - custom_attributes: - type: object - properties: {} - x-examples: - Example 1: - note_title: New title - note_content: New content - custom_attributes: {} - examples: - Example: - value: - note_title: New title - note_content: New content - custom_attributes: {} - description: '' + operationId: get-case-notes-delete-note_id + responses: + '200': + description: OK + deprecated: true + description: 'This endpoint is deprecated. Use the POST equivalent. ' tags: - Case notes /case/notes/search: @@ -4772,7 +6978,7 @@ paths: note_title: Testing note siho - note_id: 88 note_title: Example note with code - description: 'Search in notes. The searched term is a wildcard. ' + description: 'This endpoint is deprecated. Use the `GET` equivalent. ' parameters: - schema: type: string @@ -4806,71 +7012,190 @@ paths: description: '' tags: - Case notes - /case/ioc/list: + deprecated: true get: - summary: Get list of IOCs + summary: '' + operationId: get-case-notes-search responses: '200': description: OK + '': content: application/json: schema: type: object + x-examples: + Example 1: + status: success + message: '' + data: + - directory: + id: 4 + name: New folder + parent_id: 2 + case_id: 1 + note_id: 16 + note_uuid: ecbbd74e-85fd-4268-a9a4-c069677e6677 + note_title: New title + note_content: New content + note_user: 1 + note_creationdate: '2024-03-27T18:14:21.245694' + note_lastupdate: '2024-03-27T18:14:21.245724' + note_case_id: 1 + custom_attributes: null + directory_id: 4 + modification_history: + '1711563261.268616': + user: administrator + user_id: 1 + action: created note + '1711563512.541373': + user: administrator + user_id: 1 + action: updated note + '1711563539.900177': + user: administrator + user_id: 1 + action: updated note + '1711563545.354224': + user: administrator + user_id: 1 + action: updated note + '1711563549.441697': + user: administrator + user_id: 1 + action: updated note properties: status: type: string message: type: string data: - type: object - properties: - ioc: - type: array - items: + type: array + items: + type: object + properties: + directory: type: object + required: + - id + - name + - parent_id + - case_id properties: - ioc_id: + id: type: integer - ioc_uuid: - type: string - ioc_value: + name: type: string - ioc_type_id: + parent_id: type: integer - ioc_type: - type: string - ioc_description: - type: string - ioc_tags: - type: string - ioc_misp: - type: 'null' - tlp_name: - type: string - tlp_bscolor: - type: string - ioc_tlp_id: + case_id: type: integer - link: - type: array - items: - type: object - properties: - case_id: - type: integer - case_name: - type: string - client_name: - type: string - misp_link: - type: 'null' - state: - type: object - properties: - object_state: - type: integer - object_last_update: - type: string + note_id: + type: integer + note_uuid: + type: string + note_title: + type: string + note_content: + type: string + note_user: + type: integer + note_creationdate: + type: string + note_lastupdate: + type: string + note_case_id: + type: integer + custom_attributes: + type: 'null' + directory_id: + type: integer + modification_history: + type: object + required: + - directory + - note_id + - note_uuid + - note_title + - note_content + - note_user + - note_creationdate + - note_lastupdate + - note_case_id + - custom_attributes + - directory_id + - modification_history + required: + - status + - message + - data + examples: + Example 1: + value: + status: success + message: '' + data: + - directory: + id: 4 + name: New folder + parent_id: 2 + case_id: 1 + note_id: 16 + note_uuid: ecbbd74e-85fd-4268-a9a4-c069677e6677 + note_title: New title + note_content: New content + note_user: 1 + note_creationdate: '2024-03-27T18:14:21.245694' + note_lastupdate: '2024-03-27T18:14:21.245724' + note_case_id: 1 + custom_attributes: null + directory_id: 4 + modification_history: + '1711563261.268616': + user: administrator + user_id: 1 + action: created note + '1711563512.541373': + user: administrator + user_id: 1 + action: updated note + '1711563539.900177': + user: administrator + user_id: 1 + action: updated note + '1711563545.354224': + user: administrator + user_id: 1 + action: updated note + '1711563549.441697': + user: administrator + user_id: 1 + action: updated note + description: 'Search across notes. ' + parameters: + - schema: + type: integer + in: query + name: cid + description: Case ID + required: true + - schema: + type: string + in: query + name: search_input + description: Search term. Use % as wildcard + required: true + /case/ioc/list: + get: + summary: Get list of IOCs + responses: + '200': + description: OK + content: + application/json: + schema: + type: object x-examples: Example 1: status: success @@ -5599,6 +7924,89 @@ paths: state: object_state: 55 object_last_update: '2024-01-05T05:21:41.718323' + properties: + status: + type: string + message: + type: string + data: + type: object + required: + - ioc + - state + properties: + ioc: + type: array + items: + type: object + properties: + ioc_id: + type: integer + ioc_uuid: + type: string + ioc_value: + type: string + ioc_type_id: + type: integer + ioc_type: + type: string + ioc_description: + type: string + ioc_tags: + type: string + ioc_misp: + type: 'null' + tlp_name: + type: string + tlp_bscolor: + type: string + ioc_tlp_id: + type: integer + link: + type: array + items: + type: object + properties: + case_id: + type: integer + case_name: + type: string + client_name: + type: string + required: + - case_id + - case_name + - client_name + misp_link: + type: 'null' + required: + - ioc_id + - ioc_uuid + - ioc_value + - ioc_type_id + - ioc_type + - ioc_description + - ioc_tags + - ioc_misp + - tlp_name + - tlp_bscolor + - ioc_tlp_id + - link + - misp_link + state: + type: object + required: + - object_state + - object_last_update + properties: + object_state: + type: integer + object_last_update: + type: string + required: + - status + - message + - data examples: example-1: value: @@ -5623,7 +8031,7 @@ paths: object_state: 1 object_last_update: '2023-01-16T10:02:05.271648' operationId: get-case-ioc-list - description: 'Returns a list of IOCs as well as any existing linked with other cases. ' + description: 'Returns a list of IOCs as well as any existing links with other cases. ' security: - Bearer : [] parameters: @@ -6595,174 +9003,574 @@ paths: description: OK content: application/json: - schema: - type: object - properties: - status: - type: string - message: - type: string - data: - type: object - properties: - timeline: - type: array - items: - type: object - properties: - event_id: - type: integer - event_uuid: - type: string - event_date: - type: string - event_date_wtz: - type: string - event_tz: - type: string - event_title: - type: string - event_color: - type: - - 'null' - - string - event_tags: - type: string - event_content: - type: string - event_in_summary: - type: boolean - event_in_graph: - type: boolean - event_is_flagged: - type: boolean - user: - type: string - event_added: - type: string - category_name: - type: string - assets: - type: array - items: - type: object - properties: - name: - type: string - ip: - type: string - description: - type: string - compromised: - type: boolean - iocs: - type: array - items: - type: object - properties: - name: - type: string - description: - type: string - state: - type: object - properties: - object_state: - type: integer - object_last_update: - type: string + schema: + type: object x-examples: Example 1: status: success message: ok data: timeline: - - event_id: 40 - event_uuid: a5f85030-4384-4781-97da-06037808d526 - event_date: '2023-01-29T00:00:00.000000' - event_date_wtz: '2023-01-29T00:00:00.000000' + - event_id: 35 + event_uuid: 274cd72b-e133-4d3f-999c-839321f649d6 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' event_tz: '+00:00' - event_title: Logged to - event_color: '#1572E899' - event_tags: '' - event_content: Test event in timeline - event_in_summary: false + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true event_in_graph: true event_is_flagged: false - user: adm_1 - event_added: '2023-01-30T07:17:24' - category_name: Execution + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:26:34' + category_name: null + assets: [] + iocs: [] + - event_id: 88 + event_uuid: 96730e40-0de9-4bb4-97df-954e2e5f079f + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-23T08:34:29' + category_name: Unspecified assets: - - name: EndpointDevice1 (Windows - Computer) - ip: '' - description: '' - compromised: false - - name: User1_FRZ (Firewall) - ip: '' - description: '' + - name: admin_laptop (Windows - Computer) + ip: 127.0.0.1 + description: A host description compromised: true iocs: - - name: 8.8.8.8 - description: None - - name: 2amsports.com - description: '' - - event_id: 93 - event_uuid: 8370ae48-5936-45b7-b2b9-f7bba6b4c155 - event_date: '2023-03-22T00:00:00.000000' - event_date_wtz: '2023-03-22T00:00:00.000000' + - name: 88BC9EF6F07F0FAE922AB25EB226906542F8BA0DC1A221F3EA7273CBCB5DB0D4 + description: SHA256 of dummy file. Imported from datastore. + - event_id: 69 + event_uuid: 969551ea-7910-439a-8110-2da7a36c8944 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' event_tz: '+00:00' - event_title: test 2 + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:33:11' + category_name: null + assets: [] + iocs: [] + - event_id: 16 + event_uuid: a9025fba-354f-4865-8890-932f73fa0a41 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:24:00' + category_name: null + assets: [] + iocs: [] + - event_id: 53 + event_uuid: ecd0f42d-53a6-43ed-87da-1bc731a695be + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:32:14' + category_name: null + assets: [] + iocs: [] + - event_id: 70 + event_uuid: 0d36e81b-1fbe-464c-968c-f6019e7e920c + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:33:11' + category_name: null + assets: [] + iocs: [] + - event_id: 105 + event_uuid: 548ad69f-7f82-4a88-9415-32b974fe9b96 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-24T07:49:16' + category_name: null + assets: [] + iocs: [] + - event_id: 87 + event_uuid: 44dc9b10-2d30-43bd-bb5f-7aec439c844a + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-23T08:34:29' + category_name: null + assets: [] + iocs: [] + - event_id: 106 + event_uuid: fd2232bc-6188-429b-992d-f3fde7a1bae2 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-24T07:49:17' + category_name: null + assets: [] + iocs: [] + - event_id: 17 + event_uuid: bdb78e95-d6bf-4075-ac38-7d843a92f8d4 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:24:00' + category_name: null + assets: [] + iocs: [] + - event_id: 89 + event_uuid: a912ac40-6d72-4e37-9d13-35da374e8ec1 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-23T08:34:29' + category_name: null + assets: [] + iocs: [] + - event_id: 33 + event_uuid: 29073f55-cb89-4939-83b9-f08cc2a1fe84 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:26:34' + category_name: null + assets: [] + iocs: [] + - event_id: 34 + event_uuid: c502b95a-0413-485b-8e80-6f3e101de7c3 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:26:34' + category_name: null + assets: [] + iocs: [] + - event_id: 71 + event_uuid: 82565abe-7584-4475-977e-62c92cc8cf8c + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:33:11' + category_name: null + assets: [] + iocs: [] + - event_id: 15 + event_uuid: 47e3f07b-1569-45e2-bc69-daa2bff418ff + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:23:59' + category_name: null + assets: [] + iocs: [] + - event_id: 107 + event_uuid: f14ce7fc-7919-4b77-81e4-99ea18178407 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-24T07:49:17' + category_name: null + assets: [] + iocs: [] + - event_id: 52 + event_uuid: 24af1c39-8995-4f72-bda4-24a484ed9d36 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:32:14' + category_name: null + assets: [] + iocs: [] + - event_id: 51 + event_uuid: f92f599d-105a-4f2c-a7b2-0a6cc7078341 + event_date: '2023-03-26T03:00:30.000000' + event_date_wtz: '2023-03-26T03:00:30.000000' + event_tz: '+00:00' + event_title: '[ALERT] Super alert 5' + event_color: null + event_tags: defender + event_content: This is a test alert + event_in_summary: true + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:32:14' + category_name: null + assets: [] + iocs: [] + - event_id: 1 + event_uuid: 1b1185f6-7c30-4c63-b22b-20c94d95ac7f + event_date: '2024-03-06T03:33:00.000000' + event_date_wtz: '2024-03-06T03:33:00.000000' + event_tz: '+00:00' + event_title: dsaasd event_color: null event_tags: '' event_content: '' event_in_summary: false event_in_graph: true event_is_flagged: false - user: adm_1 - event_added: '2023-03-22T12:39:41' - category_name: Lateral Movement - assets: - - name: DC01 (Windows - DC) - ip: 10.0.0.8 - description: '' - compromised: false - - name: EndpointDevice1 (Windows - Computer) - ip: '' - description: '' - compromised: false - - name: DC02 (Windows - DC) - ip: '123' - description: adadsasd - compromised: false - iocs: - - name: 2.2.2.2 - description: test IP Malicious - - event_id: 173 - event_uuid: 57134ce2-e8d9-4469-befe-63b5787d2c95 - event_date: '2023-05-15T00:00:00.000000' - event_date_wtz: '2023-05-15T00:00:00.000000' + parent_event_id: null + user: administrator + event_added: '2024-03-18T08:36:09' + category_name: Unspecified + assets: [] + iocs: [] + - event_id: 3 + event_uuid: 2dd3d539-921d-427f-b285-c0141aaaaefd + event_date: '2024-03-21T09:12:59.776385' + event_date_wtz: '2024-03-21T09:12:59.776385' event_tz: '+00:00' - event_title: IPC - event_color: '#FFAD4699' + event_title: dummy event + event_color: '' event_tags: '' - event_content: 'test:101010' - event_in_summary: true + event_content: '' + event_in_summary: false event_in_graph: true - event_is_flagged: true - user: adm_1 - event_added: '2023-05-15T10:30:21' - category_name: Collection - assets: - - name: EndpointDevice1 (Windows - Computer) - ip: '' - description: '' - compromised: false - iocs: - - name: 2.2.2.2 - description: test IP Malicious + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:12:59' + category_name: Unspecified + assets: [] + iocs: [] + - event_id: 5 + event_uuid: 432e4ec4-39a5-4cce-b568-93941fc45674 + event_date: '2024-03-21T09:15:00.411243' + event_date_wtz: '2024-03-21T09:15:00.411243' + event_tz: '+00:00' + event_title: dummy event + event_color: '' + event_tags: '' + event_content: '' + event_in_summary: false + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:15:00' + category_name: Unspecified + assets: [] + iocs: [] + - event_id: 7 + event_uuid: 79b777a9-2644-4b3d-9846-6b8023c1ab50 + event_date: '2024-03-21T09:19:38.409298' + event_date_wtz: '2024-03-21T09:19:38.409298' + event_tz: '+00:00' + event_title: dummy event + event_color: '' + event_tags: '' + event_content: '' + event_in_summary: false + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:19:38' + category_name: Unspecified + assets: [] + iocs: [] + - event_id: 9 + event_uuid: 4577fb9f-da3d-4e9b-a446-04934674d1b4 + event_date: '2024-03-21T09:20:31.274028' + event_date_wtz: '2024-03-21T09:20:31.274028' + event_tz: '+00:00' + event_title: dummy event + event_color: '' + event_tags: '' + event_content: '' + event_in_summary: false + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:20:31' + category_name: Unspecified + assets: [] + iocs: [] + - event_id: 11 + event_uuid: 16fbb9e4-65da-4dfc-a398-7b4ae7b0f6f8 + event_date: '2024-03-21T09:21:43.551325' + event_date_wtz: '2024-03-21T09:21:43.551325' + event_tz: '+00:00' + event_title: dummy event + event_color: '' + event_tags: '' + event_content: '' + event_in_summary: false + event_in_graph: true + event_is_flagged: false + parent_event_id: null + user: administrator + event_added: '2024-03-21T08:21:43' + category_name: Unspecified + assets: [] + iocs: [] + state: + object_state: 231 + object_last_update: '2024-03-27T18:28:21.623728' + properties: + status: + type: string + message: + type: string + data: + type: object + required: + - timeline + - state + properties: + timeline: + type: array + items: + type: object + properties: + event_id: + type: integer + event_uuid: + type: string + event_date: + type: string + event_date_wtz: + type: string + event_tz: + type: string + event_title: + type: string + event_color: + type: + - 'null' + - string + event_tags: + type: string + event_content: + type: string + event_in_summary: + type: boolean + event_in_graph: + type: boolean + event_is_flagged: + type: boolean + parent_event_id: + type: 'null' + user: + type: string + event_added: + type: string + category_name: + type: + - 'null' + - string + assets: + type: array + items: + type: object + properties: + name: + type: string + x-stoplight: + id: xnr69hv51haqh + ip: + type: string + x-stoplight: + id: xnr69hv51haqh + description: + type: string + x-stoplight: + id: xnr69hv51haqh + compromised: + type: string + x-stoplight: + id: xnr69hv51haqh + iocs: + type: array + items: + type: object + properties: + name: + type: string + x-stoplight: + id: jzjnh39nbim6j + description: + type: string + x-stoplight: + id: jzjnh39nbim6j + required: + - event_id + - event_uuid + - event_date + - event_date_wtz + - event_tz + - event_title + - event_color + - event_tags + - event_content + - event_in_summary + - event_in_graph + - event_is_flagged + - parent_event_id + - user + - event_added + - category_name + - assets + - iocs state: - object_state: 74 - object_last_update: '2024-01-04T13:20:43.549933' + type: object + required: + - object_state + - object_last_update + properties: + object_state: + type: integer + object_last_update: + type: string + required: + - status + - message + - data examples: example-1: value: @@ -7209,6 +10017,32 @@ paths: type: string event_id: type: integer + parent_event_id: + type: integer + x-stoplight: + id: g75f8vb5tht3g + required: + - event_tags + - case_id + - event_in_summary + - modification_history + - event_date + - event_title + - custom_attributes + - user_id + - event_color + - event_added + - event_in_graph + - event_tz + - event_content + - event_source + - event_category_id + - event_uuid + - event_is_flagged + - event_raw + - event_date_wtz + - event_id + - parent_event_id examples: Example 1: value: @@ -7300,6 +10134,14 @@ paths: type: string custom_attributes: type: object + parent_event_id: + type: integer + x-stoplight: + id: bmy262lzqq4me + required: + - event_title + - event_date + - event_tz examples: example-1: value: @@ -7319,6 +10161,7 @@ paths: event_tags: tag event_tz: '+00:00' event_content: My description + parent_event_id: null custom_attributes: {} parameters: - schema: @@ -7329,8 +10172,240 @@ paths: required: true security: - Bearer : [] - tags: - - Case timeline + tags: + - Case timeline + '/case/timeline/events/{event_id}': + get: + summary: Fetch an event + tags: + - Case timeline + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + x-examples: + Example 1: + status: success + message: '' + data: + event_tags: tag + case_id: 1 + event_in_summary: true + modification_history: + '1704815238.257724': + user: administrator + action: created + user_id: 1 + event_date: '2023-03-08T03:02:00.000000' + event_title: An event + custom_attributes: {} + user_id: 1 + event_color: '#1572E899' + event_added: '2024-01-09T15:47:18.257680' + event_in_graph: true + event_tz: '+00:00' + event_content: My description + event_source: My source + event_uuid: eedceb90-def7-4707-a478-5c5a218f0116 + event_is_flagged: false + event_raw: My event raw data + event_date_wtz: '2023-03-08T03:02:00.000000' + event_id: 664 + event_assets: [] + event_iocs: [] + event_category_id: 5 + event_comments_map: [] + properties: + status: + type: string + message: + type: string + data: + type: object + required: + - event_tags + - case_id + - event_in_summary + - modification_history + - event_date + - event_title + - custom_attributes + - user_id + - event_color + - event_added + - event_in_graph + - event_tz + - event_content + - event_source + - event_uuid + - event_is_flagged + - event_raw + - event_date_wtz + - event_id + - event_assets + - event_iocs + - event_category_id + - event_comments_map + - parent_event_id + properties: + event_tags: + type: string + case_id: + type: integer + event_in_summary: + type: boolean + modification_history: + type: object + event_date: + type: string + event_title: + type: string + custom_attributes: + type: object + user_id: + type: integer + event_color: + type: string + event_added: + type: string + event_in_graph: + type: boolean + event_tz: + type: string + event_content: + type: string + event_source: + type: string + event_uuid: + type: string + event_is_flagged: + type: boolean + event_raw: + type: string + event_date_wtz: + type: string + event_id: + type: integer + event_assets: + type: array + items: + type: object + event_iocs: + type: array + items: + type: object + event_category_id: + type: integer + event_comments_map: + type: array + items: + type: object + properties: + comment_event_id: + type: integer + x-stoplight: + id: uwulgr5zw647r + comment_id: + type: integer + x-stoplight: + id: texvs3htn4r95 + required: + - comment_event_id + - comment_id + parent_event_id: + type: integer + x-stoplight: + id: 4ll8d4iukbdsg + required: + - status + - message + - data + examples: + example-1: + value: + status: success + message: '' + data: + event_tags: tag + case_id: 1 + event_in_summary: true + modification_history: + '1704815238.257724': + user: administrator + action: created + user_id: 1 + event_date: '2023-03-08T03:02:00.000000' + event_title: An event + custom_attributes: {} + user_id: 1 + event_color: '#1572E899' + event_added: '2024-01-09T15:47:18.257680' + event_in_graph: true + event_tz: '+00:00' + event_content: My description + event_source: My source + event_uuid: eedceb90-def7-4707-a478-5c5a218f0116 + event_is_flagged: false + event_raw: My event raw data + event_date_wtz: '2023-03-08T03:02:00.000000' + event_id: 664 + event_assets: [] + event_iocs: [] + event_category_id: 5 + event_comments_map: [] + '400': + description: Bad Request + content: + application/json: + schema: + description: '' + type: object + properties: + data: + type: array + items: + properties: {} + message: + type: string + minLength: 1 + status: + type: string + minLength: 1 + required: + - data + - message + - status + x-examples: + example-1: + data: [] + message: Invalid event ID for this case + status: error + examples: + Invalid event ID: + value: + data: [] + message: Invalid event ID for this case + status: error + operationId: get-case-timeline-get-event + description: Return information of an event of the timeline + parameters: + - schema: + type: integer + in: query + name: cid + description: Case ID + required: true + security: + - Bearer : [] + parameters: + - schema: + type: integer + name: event_id + in: path + required: true '/case/timeline/events/update/{event_id}': parameters: - schema: @@ -7393,6 +10468,31 @@ paths: type: string data: type: object + required: + - event_tags + - case_id + - event_in_summary + - modification_history + - event_date + - event_title + - custom_attributes + - user_id + - event_color + - event_added + - event_in_graph + - event_tz + - event_assets + - event_content + - event_sync_iocs_assets + - event_source + - event_category_id + - event_uuid + - event_is_flagged + - event_raw + - event_date_wtz + - event_id + - event_iocs + - parent_event_id properties: event_tags: type: string @@ -7444,6 +10544,14 @@ paths: type: array items: type: integer + parent_event_id: + type: integer + x-stoplight: + id: qhlh1a58b5glf + required: + - status + - message + - data examples: Example: value: @@ -7577,12 +10685,21 @@ paths: type: string custom_attributes: type: object + parent_event_id: + type: string + x-stoplight: + id: 9pocmo29g0j3g + required: + - event_title + - event_date + - event_tz examples: Example: value: event_title: An event event_raw: My event raw data event_source: Source + parent_event_id: 122 event_assets: - 45 event_iocs: @@ -7680,224 +10797,13 @@ paths: message: Not a valid event ID for this case status: error operationId: post-case-timeline-delete - description: Delete an event from the timeline - parameters: - - schema: - type: string - in: query - name: cid - description: Case ID - security: - - Bearer : [] - parameters: - - schema: - type: integer - name: event_id - in: path - required: true - get: - summary: Delete an event - operationId: get-case-timeline-events-delete-event_id - responses: - '200': - description: OK - deprecated: true - description: 'This endpoint is deprecated. Use the POST equivalent. ' - tags: - - Case timeline - '/case/timeline/events/{event_id}': - get: - summary: Fetch an event - tags: - - Case timeline - responses: - '200': - description: OK - content: - application/json: - schema: - type: object - properties: - status: - type: string - message: - type: string - data: - type: object - properties: - event_tags: - type: string - case_id: - type: integer - event_in_summary: - type: boolean - modification_history: - type: object - properties: - '1704815238.257724': - type: object - properties: - user: - type: string - action: - type: string - user_id: - type: integer - event_date: - type: string - event_title: - type: string - custom_attributes: - type: object - properties: {} - user_id: - type: integer - event_color: - type: string - event_added: - type: string - event_in_graph: - type: boolean - event_tz: - type: string - event_content: - type: string - event_source: - type: string - event_uuid: - type: string - event_is_flagged: - type: boolean - event_raw: - type: string - event_date_wtz: - type: string - event_id: - type: integer - event_assets: - type: array - items: - type: object - properties: {} - event_iocs: - type: array - items: - type: object - properties: {} - event_category_id: - type: integer - event_comments_map: - type: array - items: - type: object - properties: {} - x-examples: - Example 1: - status: success - message: '' - data: - event_tags: tag - case_id: 1 - event_in_summary: true - modification_history: - '1704815238.257724': - user: administrator - action: created - user_id: 1 - event_date: '2023-03-08T03:02:00.000000' - event_title: An event - custom_attributes: {} - user_id: 1 - event_color: '#1572E899' - event_added: '2024-01-09T15:47:18.257680' - event_in_graph: true - event_tz: '+00:00' - event_content: My description - event_source: My source - event_uuid: eedceb90-def7-4707-a478-5c5a218f0116 - event_is_flagged: false - event_raw: My event raw data - event_date_wtz: '2023-03-08T03:02:00.000000' - event_id: 664 - event_assets: [] - event_iocs: [] - event_category_id: 5 - event_comments_map: [] - examples: - example-1: - value: - status: success - message: '' - data: - event_tags: tag - case_id: 1 - event_in_summary: true - modification_history: - '1704815238.257724': - user: administrator - action: created - user_id: 1 - event_date: '2023-03-08T03:02:00.000000' - event_title: An event - custom_attributes: {} - user_id: 1 - event_color: '#1572E899' - event_added: '2024-01-09T15:47:18.257680' - event_in_graph: true - event_tz: '+00:00' - event_content: My description - event_source: My source - event_uuid: eedceb90-def7-4707-a478-5c5a218f0116 - event_is_flagged: false - event_raw: My event raw data - event_date_wtz: '2023-03-08T03:02:00.000000' - event_id: 664 - event_assets: [] - event_iocs: [] - event_category_id: 5 - event_comments_map: [] - '400': - description: Bad Request - content: - application/json: - schema: - description: '' - type: object - properties: - data: - type: array - items: - properties: {} - message: - type: string - minLength: 1 - status: - type: string - minLength: 1 - required: - - data - - message - - status - x-examples: - example-1: - data: [] - message: Invalid event ID for this case - status: error - examples: - Invalid event ID: - value: - data: [] - message: Invalid event ID for this case - status: error - operationId: get-case-timeline-get-event - description: Return information of an event of the timeline + description: 'Delete an event from the timeline. If the event has a child, the child event is not deleted and become a parent itself. ' parameters: - schema: - type: integer + type: string in: query name: cid description: Case ID - required: true security: - Bearer : [] parameters: @@ -7906,6 +10812,16 @@ paths: name: event_id in: path required: true + get: + summary: Delete an event + operationId: get-case-timeline-events-delete-event_id + responses: + '200': + description: OK + deprecated: true + description: 'This endpoint is deprecated. Use the POST equivalent. ' + tags: + - Case timeline /case/tasks/list: get: summary: Get case tasks @@ -8322,9 +11238,9 @@ paths: description: Case ID required: true parameters: [] - '/case/tasks/delete/{task_id}': - post: - summary: Delete a case task + '/case/tasks/{task_id}': + get: + summary: Get a case task tags: - Case tasks responses: @@ -8333,35 +11249,131 @@ paths: content: application/json: schema: - description: '' type: object x-examples: - example-1: - data: [] - message: Task deleted + Example 1: status: success + message: '' + data: + task_open_date: '2023-08-30T14:41:13.725553' + task_userid_close: null + task_last_update: '2023-09-07T14:38:12.784169' + task_userid_update: 11 + task_title: This is a title + task_uuid: 7a6c2b66-2956-4c7a-8904-757656f98f5d + task_tags: '' + id: 705 + task_description: IDEK? + task_userid_open: 12 + custom_attributes: {} + task_status_id: 1 + task_assignees: + - user: adm_2 + name: Adm 2 + id: 12 + task_close_date: null + task_case_id: 1 properties: - data: - type: array - items: {} - message: - type: string - minLength: 1 status: type: string - minLength: 1 + message: + type: string + data: + type: object + required: + - task_open_date + - task_userid_close + - task_last_update + - task_userid_update + - task_title + - task_uuid + - task_tags + - id + - task_description + - task_userid_open + - custom_attributes + - task_status_id + - task_assignees + - task_close_date + - task_case_id + - modification_history + properties: + task_open_date: + type: string + task_userid_close: + type: 'null' + task_last_update: + type: string + task_userid_update: + type: integer + task_title: + type: string + task_uuid: + type: string + task_tags: + type: string + id: + type: integer + task_description: + type: string + task_userid_open: + type: integer + custom_attributes: + type: object + task_status_id: + type: integer + task_assignees: + type: array + items: + type: object + properties: + user: + type: string + name: + type: string + id: + type: integer + task_close_date: + type: 'null' + task_case_id: + type: integer + modification_history: + type: + - object + - 'null' + x-stoplight: + id: xss0xrnzt7t3x required: - - message - status + - message + - data examples: example-1: value: - data: [] - message: Task deleted status: success + message: '' + data: + task_title: dummy title + task_status_id: 1 + task_assignees: + - user: administrator + name: administrator + id: 1 + id: 45 + task_uuid: 9dfe50ea-8c5e-4deb-a670-6b705e59ee3c + task_description: '' + task_tags: '' + task_open_date: '2024-03-21T09:33:20.792768' + task_close_date: null + task_last_update: '2024-03-26T06:01:45.022397' + task_userid_open: 1 + task_userid_close: null + task_userid_update: 1 + task_case_id: 1 + custom_attributes: {} + modification_history: null '400': description: Bad Request - headers: {} content: application/json: schema: @@ -8392,8 +11404,8 @@ paths: data: [] message: Invalid task ID for this case status: error - operationId: get-case-tasks-delete - description: 'Delete a case task. ' + operationId: get-case-tasks-fetch + description: Fetch a task security: - Bearer : [] parameters: @@ -8409,19 +11421,10 @@ paths: name: task_id in: path required: true - description: Task ID to delete - get: + description: Task ID to fetch + '/case/tasks/delete/{task_id}': + post: summary: Delete a case task - operationId: get-case-tasks-delete-task_id - responses: - '200': - description: OK - tags: - - Case tasks - description: 'This endpoint is deprecated. Use the POST equivalent. ' - '/case/tasks/{task_id}': - get: - summary: Fetch a case task tags: - Case tasks responses: @@ -8430,104 +11433,35 @@ paths: content: application/json: schema: + description: '' type: object + x-examples: + example-1: + data: [] + message: Task deleted + status: success properties: - status: - type: string + data: + type: array + items: {} message: type: string - data: - type: object - properties: - task_open_date: - type: string - task_userid_close: - type: 'null' - task_last_update: - type: string - task_userid_update: - type: integer - task_title: - type: string - task_uuid: - type: string - task_tags: - type: string - id: - type: integer - task_description: - type: string - task_userid_open: - type: integer - custom_attributes: - type: object - properties: {} - task_status_id: - type: integer - task_assignees: - type: array - items: - type: object - properties: - user: - type: string - name: - type: string - id: - type: integer - task_close_date: - type: 'null' - task_case_id: - type: integer - x-examples: - Example 1: - status: success - message: '' - data: - task_open_date: '2023-08-30T14:41:13.725553' - task_userid_close: null - task_last_update: '2023-09-07T14:38:12.784169' - task_userid_update: 11 - task_title: This is a title - task_uuid: 7a6c2b66-2956-4c7a-8904-757656f98f5d - task_tags: '' - id: 705 - task_description: IDEK? - task_userid_open: 12 - custom_attributes: {} - task_status_id: 1 - task_assignees: - - user: adm_2 - name: Adm 2 - id: 12 - task_close_date: null - task_case_id: 1 + minLength: 1 + status: + type: string + minLength: 1 + required: + - message + - status examples: example-1: value: + data: [] + message: Task deleted status: success - message: '' - data: - task_open_date: '2023-08-30T14:41:13.725553' - task_userid_close: null - task_last_update: '2023-09-07T14:38:12.784169' - task_userid_update: 11 - task_title: This is a title - task_uuid: 7a6c2b66-2956-4c7a-8904-757656f98f5d - task_tags: '' - id: 705 - task_description: IDEK? - task_userid_open: 12 - custom_attributes: {} - task_status_id: 1 - task_assignees: - - user: adm_2 - name: Adm 2 - id: 12 - task_close_date: null - task_case_id: 1 '400': description: Bad Request + headers: {} content: application/json: schema: @@ -8558,8 +11492,8 @@ paths: data: [] message: Invalid task ID for this case status: error - operationId: get-case-tasks-fetch - description: 'Return information of a specific task ' + operationId: get-case-tasks-delete + description: 'Delete a case task. ' security: - Bearer : [] parameters: @@ -8576,6 +11510,16 @@ paths: in: path required: true description: Task ID to delete + get: + summary: Delete a case task + operationId: get-case-tasks-delete-task_id + responses: + '200': + description: OK + tags: + - Case tasks + description: 'This endpoint is deprecated. Use the POST equivalent. ' + deprecated: true /case/tasks/add: parameters: [] post: @@ -8588,6 +11532,26 @@ paths: application/json: schema: type: object + x-examples: + Example 1: + status: success + message: Task 'dummy title' added + data: + task_title: dummy title + task_status_id: 1 + id: 75 + task_uuid: 6ea2b056-48e6-4c34-8817-d3dbe4cc2720 + task_description: '' + task_tags: '' + task_open_date: '2024-03-27T20:04:07.898757' + task_close_date: null + task_last_update: '2024-03-27T20:04:07.898757' + task_userid_open: 1 + task_userid_close: null + task_userid_update: 1 + task_case_id: 1 + custom_attributes: {} + modification_history: null properties: status: type: string @@ -8595,55 +11559,57 @@ paths: type: string data: type: object + required: + - task_title + - task_status_id + - id + - task_uuid + - task_description + - task_tags + - task_open_date + - task_close_date + - task_last_update + - task_userid_open + - task_userid_close + - task_userid_update + - task_case_id + - custom_attributes + - modification_history properties: - task_open_date: - type: string - task_userid_close: - type: 'null' - task_last_update: - type: string - task_userid_update: - type: integer task_title: type: string + task_status_id: + type: integer + id: + type: integer task_uuid: type: string + task_description: + type: string task_tags: type: string - id: - type: integer - task_description: + task_open_date: + type: string + task_close_date: + type: 'null' + task_last_update: type: string task_userid_open: type: integer - custom_attributes: - type: object - properties: {} - task_status_id: - type: integer - task_close_date: + task_userid_close: type: 'null' + task_userid_update: + type: integer task_case_id: type: integer - x-examples: - Example 1: - status: success - message: Task 'dummy title' added - data: - task_open_date: '2024-01-09T16:03:54.304325' - task_userid_close: null - task_last_update: '2024-01-09T16:03:54.304325' - task_userid_update: 1 - task_title: dummy title - task_uuid: 34eb785f-0551-454a-9a7c-7759eb68d4fe - task_tags: '' - id: 1702 - task_description: '' - task_userid_open: 1 - custom_attributes: {} - task_status_id: 1 - task_close_date: null - task_case_id: 1 + custom_attributes: + type: object + modification_history: + type: 'null' + required: + - status + - message + - data examples: example-1: value: @@ -8722,6 +11688,10 @@ paths: type: string custom_attributes: type: object + required: + - task_assignees_id + - task_status_id + - task_title examples: example-1: value: @@ -8761,6 +11731,29 @@ paths: application/json: schema: type: object + x-examples: + Example 1: + status: success + message: Task 'New title' updated + data: + task_open_date: '2024-01-09T16:03:54.304325' + task_userid_close: null + task_last_update: '2024-01-09T16:04:35.212216' + task_userid_update: 1 + task_title: New title + task_uuid: 34eb785f-0551-454a-9a7c-7759eb68d4fe + task_tags: new tags + id: 1702 + task_description: new content + task_userid_open: 1 + custom_attributes: {} + task_status_id: 1 + task_assignees: + - user: administrator + name: administrator + id: 1 + task_close_date: null + task_case_id: 1 properties: status: type: string @@ -8768,6 +11761,22 @@ paths: type: string data: type: object + required: + - task_open_date + - task_userid_close + - task_last_update + - task_userid_update + - task_title + - task_uuid + - task_tags + - id + - task_description + - task_userid_open + - custom_attributes + - task_status_id + - task_assignees + - task_close_date + - task_case_id properties: task_open_date: type: string @@ -8791,7 +11800,6 @@ paths: type: integer custom_attributes: type: object - properties: {} task_status_id: type: integer task_assignees: @@ -8805,33 +11813,18 @@ paths: type: string id: type: integer + required: + - user + - name + - id task_close_date: type: 'null' task_case_id: type: integer - x-examples: - Example 1: - status: success - message: Task 'New title' updated - data: - task_open_date: '2024-01-09T16:03:54.304325' - task_userid_close: null - task_last_update: '2024-01-09T16:04:35.212216' - task_userid_update: 1 - task_title: New title - task_uuid: 34eb785f-0551-454a-9a7c-7759eb68d4fe - task_tags: new tags - id: 1702 - task_description: new content - task_userid_open: 1 - custom_attributes: {} - task_status_id: 1 - task_assignees: - - user: administrator - name: administrator - id: 1 - task_close_date: null - task_case_id: 1 + required: + - status + - message + - data examples: example-1: value: @@ -8889,6 +11882,15 @@ paths: application/json: schema: type: object + x-examples: + Example 1: + task_assignees_id: + - 1 + task_status_id: 1 + task_title: New title + task_description: new content + task_tags: new tags + custom_attributes: {} properties: task_assignees_id: type: array @@ -8904,16 +11906,10 @@ paths: type: string custom_attributes: type: object - properties: {} - x-examples: - Example 1: - task_assignees_id: - - 1 - task_status_id: 1 - task_title: New title - task_description: new content - task_tags: new tags - custom_attributes: {} + required: + - task_assignees_id + - task_status_id + - task_title examples: example-1: value: @@ -8946,86 +11942,7 @@ paths: content: application/json: schema: - type: object - properties: - status: - type: string - message: - type: string - data: - type: object - properties: - evidences: - type: array - items: - type: object - properties: - chain_of_custody: - type: 'null' - case_id: - type: integer - type_id: - type: - - integer - - 'null' - id: - type: integer - file_hash: - type: string - filename: - type: string - start_date: - type: 'null' - type: - type: - - 'null' - - object - properties: - name: - type: string - description: - type: string - creation_date: - type: string - id: - type: integer - acquisition_date: - type: 'null' - case: - type: integer - file_uuid: - type: string - user_id: - type: integer - custom_attributes: - type: object - properties: {} - date_added: - type: string - user: - type: object - properties: - id: - type: integer - user_name: - type: string - user_login: - type: string - user_email: - type: string - file_size: - type: integer - end_date: - type: 'null' - file_description: - type: string - state: - type: object - properties: - object_state: - type: integer - object_last_update: - type: string + type: object x-examples: Example 1: status: success @@ -9127,6 +12044,118 @@ paths: state: object_state: 20 object_last_update: '2024-01-07T13:40:47.236614' + properties: + status: + type: string + message: + type: string + data: + type: object + required: + - evidences + - state + properties: + evidences: + type: array + items: + type: object + properties: + chain_of_custody: + type: 'null' + case_id: + type: integer + type_id: + type: + - integer + - 'null' + id: + type: integer + file_hash: + type: string + filename: + type: string + start_date: + type: 'null' + type: + type: + - 'null' + - object + properties: + name: + type: string + description: + type: string + creation_date: + type: string + id: + type: integer + acquisition_date: + type: 'null' + case: + type: integer + file_uuid: + type: string + user_id: + type: integer + custom_attributes: + type: object + date_added: + type: string + user: + type: object + required: + - id + - user_name + - user_login + - user_email + properties: + id: + type: integer + user_name: + type: string + user_login: + type: string + user_email: + type: string + file_size: + type: integer + end_date: + type: 'null' + file_description: + type: string + required: + - chain_of_custody + - case_id + - type_id + - id + - file_hash + - filename + - start_date + - type + - acquisition_date + - case + - file_uuid + - user_id + - custom_attributes + - date_added + - user + - file_size + - end_date + - file_description + state: + type: object + required: + - object_state + - object_last_update + properties: + object_state: + type: integer + object_last_update: + type: string + required: + - status + - message + - data examples: Example 1: value: @@ -9240,6 +12269,213 @@ paths: required: true security: - Bearer : [] + /case/evidences/add: + post: + summary: Add an evidence + operationId: post-case-add-evidence + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + x-examples: + Example 1: + status: success + message: Evidence added + data: + chain_of_custody: null + case_id: 1 + type_id: null + id: 117 + file_hash: string + filename: string + start_date: null + type: null + acquisition_date: null + case: 1 + file_uuid: 88a4dd55-132a-4acf-9daf-f05303782131 + user_id: 1 + custom_attributes: {} + date_added: '2024-01-09T16:19:38.620717' + user: + id: 1 + user_name: administrator + user_login: administrator + user_email: administrator@iris.local + file_size: 0 + end_date: null + file_description: string + properties: + status: + type: string + message: + type: string + data: + type: object + required: + - chain_of_custody + - case_id + - type_id + - id + - file_hash + - filename + - start_date + - type + - acquisition_date + - case + - file_uuid + - user_id + - custom_attributes + - date_added + - user + - file_size + - end_date + - file_description + properties: + chain_of_custody: + type: 'null' + case_id: + type: integer + type_id: + type: 'null' + id: + type: integer + file_hash: + type: string + filename: + type: string + start_date: + type: 'null' + type: + type: 'null' + acquisition_date: + type: 'null' + case: + type: integer + file_uuid: + type: string + user_id: + type: integer + custom_attributes: + type: object + date_added: + type: string + user: + type: object + required: + - id + - user_name + - user_login + - user_email + properties: + id: + type: integer + user_name: + type: string + user_login: + type: string + user_email: + type: string + file_size: + type: integer + end_date: + type: 'null' + file_description: + type: string + required: + - status + - message + - data + examples: + example-1: + value: + status: success + message: Evidence added + data: + chain_of_custody: null + case_id: 1 + type_id: null + id: 119 + file_hash: string + filename: string + start_date: null + type: null + acquisition_date: null + case: 1 + file_uuid: 2c322eb0-53be-45c7-b71c-ae5bc4c3bd0a + user_id: 1 + custom_attributes: {} + date_added: '2024-01-11T07:39:11.211407' + user: + id: 1 + user_name: administrator + user_login: administrator + user_email: administrator@iris.local + file_size: 0 + end_date: null + file_description: string + description: Add a new evidence to the case. + parameters: + - schema: + type: integer + in: query + name: cid + description: Case ID + required: true + security: + - Bearer : [] + requestBody: + content: + application/json: + schema: + type: object + x-examples: + Example 1: + filename: dummy file + file_size: '77108' + file_hash: 88BC9EF6F07F0FAE922AB25EB226906542F8BA0DC1A221F3EA7273CBCB5DB0D4 + csrf_token: IjAzZTc1OTRiNTg0NTkwZWIzMzRmMzk3OGE0Yzg1NzNkMDBhNWNlMDgi.ZgqYbA.x5ixUW6bQFaRaSULIx8UP7wQAtg + type_id: '2' + start_date: '2024-04-13T03:02:00.000' + end_date: '2024-04-04T00:00:00.000' + custom_attributes: {} + file_description: Dummy description + properties: + filename: + type: string + file_size: + type: string + file_hash: + type: string + type_id: + type: string + start_date: + type: string + end_date: + type: string + custom_attributes: + type: object + file_description: + type: string + required: + - filename + examples: + example-1: + value: + filename: dummy file + file_size: '77108' + file_hash: 88BC9EF6F07F0FAE922AB25EB226906542F8BA0DC1A221F3EA7273CBCB5DB0D4 + type_id: '2' + start_date: '2024-04-13T03:02:00.000' + end_date: '2024-04-04T00:00:00.000' + custom_attributes: {} + file_description: Dummy description + description: '' + tags: + - Case evidences + parameters: [] '/case/evidences/{evidence_id}': get: summary: Get an evidence @@ -9251,6 +12487,37 @@ paths: application/json: schema: type: object + x-examples: + Example 1: + status: success + message: '' + data: + chain_of_custody: null + case_id: 1 + type_id: 2 + id: 116 + file_hash: 77077087ee0f61f174a996bbcb7ef09c + filename: pat.txt + start_date: null + type: + name: HDD image - Generic + description: Generic copy of an hard drive + creation_date: '2023-11-29T10:28:30.764707' + id: 2 + acquisition_date: null + case: 1 + file_uuid: e6d5e920-0849-4b7c-ae62-e9455feaf25a + user_id: 3 + custom_attributes: {} + date_added: '2024-01-07T13:40:47.232707' + user: + id: 3 + user_name: User Std 2 + user_login: user_std_2 + user_email: user_std_2@iris.local + file_size: 52 + end_date: null + file_description: '' properties: status: type: string @@ -9258,6 +12525,25 @@ paths: type: string data: type: object + required: + - chain_of_custody + - case_id + - type_id + - id + - file_hash + - filename + - start_date + - type + - acquisition_date + - case + - file_uuid + - user_id + - custom_attributes + - date_added + - user + - file_size + - end_date + - file_description properties: chain_of_custody: type: 'null' @@ -9275,6 +12561,11 @@ paths: type: 'null' type: type: object + required: + - name + - description + - creation_date + - id properties: name: type: string @@ -9294,11 +12585,15 @@ paths: type: integer custom_attributes: type: object - properties: {} date_added: type: string user: type: object + required: + - id + - user_name + - user_login + - user_email properties: id: type: integer @@ -9314,37 +12609,10 @@ paths: type: 'null' file_description: type: string - x-examples: - Example 1: - status: success - message: '' - data: - chain_of_custody: null - case_id: 1 - type_id: 2 - id: 116 - file_hash: 77077087ee0f61f174a996bbcb7ef09c - filename: pat.txt - start_date: null - type: - name: HDD image - Generic - description: Generic copy of an hard drive - creation_date: '2023-11-29T10:28:30.764707' - id: 2 - acquisition_date: null - case: 1 - file_uuid: e6d5e920-0849-4b7c-ae62-e9455feaf25a - user_id: 3 - custom_attributes: {} - date_added: '2024-01-07T13:40:47.232707' - user: - id: 3 - user_name: User Std 2 - user_login: user_std_2 - user_email: user_std_2@iris.local - file_size: 52 - end_date: null - file_description: '' + required: + - status + - message + - data examples: example-1: value: @@ -9386,7 +12654,7 @@ paths: data: [] message: Invalid evidence ID for this case status: error - description: Returns information of a specific evidence + description: 'Returns an evidence metadata. ' security: - Bearer : [] parameters: @@ -9440,152 +12708,6 @@ paths: status: success operationId: post-case-evidences-delete description: 'Remove an evidence from the case. ' - parameters: - - schema: - type: string - in: query - name: cid - description: Case ID - required: true - security: - - Bearer : [] - parameters: - - schema: - type: integer - name: evidence_id - in: path - required: true - description: Evidence ID - get: - summary: Delete an evidence - operationId: get-case-evidences-delete-evidence_id - responses: - '200': - description: OK - tags: - - Case evidences - description: This endpoint is depreacted. Please use the POST equivalent. - '/case/evidences/update/{evidence_id}': - post: - summary: Update an evidence - operationId: post-case-evidences-update - responses: - '200': - description: OK - content: - application/json: - schema: - type: object - properties: - status: - type: string - message: - type: string - data: - type: object - properties: - chain_of_custody: - type: 'null' - case_id: - type: integer - type_id: - type: 'null' - id: - type: integer - file_hash: - type: string - filename: - type: string - start_date: - type: 'null' - type: - type: 'null' - acquisition_date: - type: 'null' - case: - type: integer - file_uuid: - type: string - user_id: - type: integer - custom_attributes: - type: object - properties: {} - date_added: - type: string - user: - type: object - properties: - id: - type: integer - user_name: - type: string - user_login: - type: string - user_email: - type: string - file_size: - type: integer - end_date: - type: 'null' - file_description: - type: string - x-examples: - Example 1: - status: success - message: Evidence string updated - data: - chain_of_custody: null - case_id: 1 - type_id: null - id: 117 - file_hash: string - filename: string - start_date: null - type: null - acquisition_date: null - case: 1 - file_uuid: 88a4dd55-132a-4acf-9daf-f05303782131 - user_id: 1 - custom_attributes: {} - date_added: '2024-01-09T16:19:38.620717' - user: - id: 1 - user_name: administrator - user_login: administrator - user_email: administrator@iris.local - file_size: 0 - end_date: null - file_description: string - examples: - example-1: - value: - status: success - message: Evidence string updated - data: - chain_of_custody: null - case_id: 1 - type_id: null - id: 117 - file_hash: string - filename: string - start_date: null - type: null - acquisition_date: null - case: 1 - file_uuid: 88a4dd55-132a-4acf-9daf-f05303782131 - user_id: 1 - custom_attributes: {} - date_added: '2024-01-09T16:19:38.620717' - user: - id: 1 - user_name: administrator - user_login: administrator - user_email: administrator@iris.local - file_size: 0 - end_date: null - file_description: string - description: 'Update an evidence. ' parameters: - schema: type: integer @@ -9595,48 +12717,6 @@ paths: required: true security: - Bearer : [] - requestBody: - content: - application/json: - schema: - type: object - x-examples: - example-1: - filename: ss - file_size: '165' - file_hash: ds - file_description: ds - csrf_token: ImQzZjhlMDlhOTA1ZjI5ZGFlOWQ5MWNiOTJkMzMyNTlhODNjNDgxZTQi.YXkx1w.JWVKeYVAMn1MjyKoKkCa3uAzTTE - properties: - filename: - type: string - minLength: 1 - file_size: - type: integer - file_hash: - type: string - minLength: 1 - file_description: - type: string - minLength: 1 - custom_attributes: - type: object - required: - - filename - - file_size - - file_hash - - file_description - - custom_attributes - examples: - example-1: - value: - filename: string - file_size: 0 - file_hash: string - file_description: string - custom_attributes: {} - tags: - - Case evidences parameters: - schema: type: integer @@ -9644,10 +12724,19 @@ paths: in: path required: true description: Evidence ID - /case/evidences/add: + get: + summary: Delete an evidence + operationId: get-case-evidences-delete-evidence_id + responses: + '200': + description: OK + tags: + - Case evidences + description: This endpoint is depreacted. Please use the POST equivalent. + '/case/evidences/update/{evidence_id}': post: - summary: Add an evidence - operationId: post-case-add-evidence + summary: Update an evidence + operationId: post-case-evidences-update responses: '200': description: OK @@ -9655,6 +12744,33 @@ paths: application/json: schema: type: object + x-examples: + Example 1: + status: success + message: Evidence string updated + data: + chain_of_custody: null + case_id: 1 + type_id: null + id: 117 + file_hash: string + filename: string + start_date: null + type: null + acquisition_date: null + case: 1 + file_uuid: 88a4dd55-132a-4acf-9daf-f05303782131 + user_id: 1 + custom_attributes: {} + date_added: '2024-01-09T16:19:38.620717' + user: + id: 1 + user_name: administrator + user_login: administrator + user_email: administrator@iris.local + file_size: 0 + end_date: null + file_description: string properties: status: type: string @@ -9662,6 +12778,25 @@ paths: type: string data: type: object + required: + - chain_of_custody + - case_id + - type_id + - id + - file_hash + - filename + - start_date + - type + - acquisition_date + - case + - file_uuid + - user_id + - custom_attributes + - date_added + - user + - file_size + - end_date + - file_description properties: chain_of_custody: type: 'null' @@ -9689,11 +12824,15 @@ paths: type: integer custom_attributes: type: object - properties: {} date_added: type: string user: type: object + required: + - id + - user_name + - user_login + - user_email properties: id: type: integer @@ -9709,53 +12848,30 @@ paths: type: 'null' file_description: type: string - x-examples: - Example 1: - status: success - message: Evidence added - data: - chain_of_custody: null - case_id: 1 - type_id: null - id: 117 - file_hash: string - filename: string - start_date: null - type: null - acquisition_date: null - case: 1 - file_uuid: 88a4dd55-132a-4acf-9daf-f05303782131 - user_id: 1 - custom_attributes: {} - date_added: '2024-01-09T16:19:38.620717' - user: - id: 1 - user_name: administrator - user_login: administrator - user_email: administrator@iris.local - file_size: 0 - end_date: null - file_description: string + required: + - status + - message + - data examples: example-1: value: status: success - message: Evidence added + message: Evidence string updated data: chain_of_custody: null case_id: 1 type_id: null - id: 119 + id: 117 file_hash: string filename: string start_date: null type: null acquisition_date: null case: 1 - file_uuid: 2c322eb0-53be-45c7-b71c-ae5bc4c3bd0a + file_uuid: 88a4dd55-132a-4acf-9daf-f05303782131 user_id: 1 custom_attributes: {} - date_added: '2024-01-11T07:39:11.211407' + date_added: '2024-01-09T16:19:38.620717' user: id: 1 user_name: administrator @@ -9764,7 +12880,7 @@ paths: file_size: 0 end_date: null file_description: string - description: Add a new evidence to the case. + description: 'Update an evidence. ' parameters: - schema: type: integer @@ -9779,37 +12895,56 @@ paths: application/json: schema: type: object + x-examples: + Example 1: + filename: dummy file + file_size: '77108' + file_hash: 88BC9EF6F07F0FAE922AB25EB226906542F8BA0DC1A221F3EA7273CBCB5DB0D4 + csrf_token: IjAzZTc1OTRiNTg0NTkwZWIzMzRmMzk3OGE0Yzg1NzNkMDBhNWNlMDgi.ZgqYbA.x5ixUW6bQFaRaSULIx8UP7wQAtg + type_id: '2' + start_date: '2024-04-13T03:02:00.000' + end_date: '2024-04-04T00:00:00.000' + custom_attributes: {} + file_description: Dummy description properties: filename: type: string file_size: - type: integer + type: string file_hash: type: string - file_description: + type_id: + type: string + start_date: + type: string + end_date: type: string custom_attributes: type: object - properties: {} - x-examples: - Example 1: - filename: string - file_size: 0 - file_hash: string - file_description: string - custom_attributes: {} + file_description: + type: string + required: + - filename examples: example-1: value: - filename: string - file_size: 0 - file_hash: string - file_description: string + filename: dummy file + file_size: '77108' + file_hash: 88BC9EF6F07F0FAE922AB25EB226906542F8BA0DC1A221F3EA7273CBCB5DB0D4 + type_id: '2' + start_date: '2024-04-13T03:02:00.000' + end_date: '2024-04-04T00:00:00.000' custom_attributes: {} - description: '' + file_description: Dummy description tags: - Case evidences - parameters: [] + parameters: + - schema: + type: integer + name: evidence_id + in: path + required: true + description: Evidence ID '/alerts/{alert_id}': parameters: - schema: @@ -16072,90 +19207,1564 @@ paths: description: 'Filter alerts. This endpoint uses paging. Each response contains a `total`, `last_page`, `current_page` and `next_page` information to fetch the next results. ' tags: - Alerts - parameters: - - schema: - type: string - in: query - name: alert_title - - schema: - type: string - in: query - name: alert_description - - schema: - type: string - in: query - name: alert_source - - schema: - type: string - in: query - name: alert_tags - description: Comma separated list of tags - - schema: - type: integer - in: query - name: alert_status_id - - schema: - type: integer - in: query - name: alert_severity_id - - schema: - type: integer - in: query - name: alert_classification_id - - schema: - type: integer - in: query - name: alert_customer_id - - schema: - type: string - in: query - name: alert_start_date - - schema: - type: string - in: query - name: alert_end_date - - schema: - type: string - in: query - name: alert_assets - description: Comma separated list of assets - - schema: - type: string - in: query - name: alert_iocs - description: Comma separated list of IOCs - - schema: - type: string - in: query - name: alert_ids - description: Comma separated list of IDs - - schema: - type: integer - in: query - name: case_id - - schema: - type: integer - in: query - name: alert_owner_id - - schema: - type: integer - in: query - name: page - description: Page to fetch - - schema: - type: integer - in: query - name: per_page - description: Number of results per page - - schema: - type: string - in: query - name: sort - description: '`desc` or `asc`, based on the source alert time ' - /alerts/add: + parameters: + - schema: + type: string + in: query + name: alert_title + - schema: + type: string + in: query + name: alert_description + - schema: + type: string + in: query + name: alert_source + - schema: + type: string + in: query + name: alert_tags + description: Comma separated list of tags + - schema: + type: integer + in: query + name: alert_status_id + - schema: + type: integer + in: query + name: alert_severity_id + - schema: + type: integer + in: query + name: alert_classification_id + - schema: + type: integer + in: query + name: alert_customer_id + - schema: + type: string + in: query + name: alert_start_date + - schema: + type: string + in: query + name: alert_end_date + - schema: + type: string + in: query + name: alert_assets + description: Comma separated list of assets + - schema: + type: string + in: query + name: alert_iocs + description: Comma separated list of IOCs + - schema: + type: string + in: query + name: alert_ids + description: Comma separated list of IDs + - schema: + type: integer + in: query + name: case_id + - schema: + type: integer + in: query + name: alert_owner_id + - schema: + type: integer + in: query + name: page + description: Page to fetch + - schema: + type: integer + in: query + name: per_page + description: Number of results per page + - schema: + type: string + in: query + name: sort + description: '`desc` or `asc`, based on the source alert time ' + /alerts/add: + post: + summary: Add an alert + operationId: post-case-add-alert + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + x-examples: + Example 1: + status: success + message: '' + data: + owner: null + alert_note: A note on + alert_source: Test Source + alert_title: Low-reputation arbitrary code executed by signed executable + modification_history: + '1683900374.955318': + user: administrator + user_id: 1 + action: Alert created + assets: + - asset_enrichment: + enrich1: + A key: A value + asset_ip: 1.1.1.1 + user_id: null + asset_uuid: ddf4c674-3853-4cc6-914a-f43f03f426d5 + asset_description: Asset description + asset_type: + asset_name: Account + asset_description: Generic Account + asset_icon_not_compromised: user.png + asset_icon_compromised: ioc_user.png + asset_id: 1 + asset_id: 7650 + case_id: null + asset_name: My super asset + analysis_status_id: null + date_added: null + asset_domain: '' + custom_attributes: null + asset_type_id: 1 + asset_info: null + date_update: null + asset_tags: 'tag1,tag2' + asset_compromise_status_id: null + classification: + name: 'abusive-content:spam' + name_expanded: 'Abusive-Content: spam' + creation_date: '2023-05-11T16:37:28.571756' + description: 'Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content.' + id: 1 + alert_id: 3826 + alert_source_link: 'https://source_link.com' + severity: + severity_name: Medium + severity_id: 4 + severity_description: Medium + iocs: + - ioc_tlp_id: 1 + ioc_type_id: 2 + user_id: null + ioc_id: 7651 + ioc_misp: null + ioc_value: tarzan5 + ioc_uuid: 1c055831-67bb-4c1b-9e49-c1c0e42301b8 + ioc_description: description of Tarzan + ioc_enrichment: + provider_1: + data: 2 + new_data: 3 + provider_3: + enric: 'true' + custom_attributes: null + ioc_type: + type_name: aba-rtn + type_validation_regex: null + type_id: 2 + type_description: ABA routing transit number + type_validation_expect: null + type_taxonomy: null + ioc_tags: 'tag1,tag2' + - ioc_tlp_id: 2 + ioc_type_id: 4 + user_id: null + ioc_id: 7652 + ioc_misp: null + ioc_value: tarzan2 + ioc_uuid: 06c0073e-1336-4daa-8321-995116484dd2 + ioc_description: description_hey + ioc_enrichment: + provider_1: + data: |- + a very long + blablablabdjsjofiasofiasjdxaisjhfaiosxhd bla + ddijwedoijwedw + dhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas + new_data: 3 + provider_3: + enric: 'true' + custom_attributes: null + ioc_type: + type_name: anonymised + type_validation_regex: null + type_id: 4 + type_description: Anonymised value - described with the anonymisation object via a relationship + type_validation_expect: null + type_taxonomy: null + ioc_tags: 'tag1,tag2' + alert_context: + context_key: context_value + alert_classification_id: 1 + alert_source_content: + _id: 603f704aaf7417985bbf3b22 + contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 + description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) + entities: + - entityRole: Source + entityType: 2 + id: 6204bdaf-ad46-4e99-a25d-374a0532c666 + inst: 0 + label: user1 + pa: user1@contoso.com + saas: 11161 + type: account + - entityRole: Related + id: 55017817-27af-49a7-93d6-8af6c5030fdb + label: DC3 + type: device + - id: 20940 + label: Active Directory + type: service + - entityRole: Related + id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 + label: DC4 + type: device + - id: 5bfd18bfab73c36ba10d38ca + label: Honeytoken activity + policyType: ANOMALY_DETECTION + type: policyRule + - entityRole: Source + id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 + label: Client1 + type: device + - entityRole: Related + id: d68772fe-1171-4124-9f73-0f410340bd54 + label: DC1 + type: device + - type: groupTag + id: 5f759b4d106abbe4a504ea5d + label: All Users + idValue: 15795464 + isSystemAlert: false + resolutionStatusValue: 0 + severityValue: 5 + statusValue: 1 + stories: + - 0 + threatScore: 34 + timestamp: 1621941916475 + title: Honeytoken activity + comment: '' + handledByUser: administrator@contoso.com + resolveTime: '2021-05-13T14:02:34.904Z' + URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' + alert_tags: 'defender,anothertag' + alert_severity_id: 4 + alert_source_ref: Test-123 + alert_status_id: 3 + customer: + customer_name: IrisInitialClient + client_uuid: a3d0f1e2-05dd-4439-a6d8-83cee72bb9ec + customer_sla: null + last_update_date: '2023-05-11T16:37:29.709361' + customer_id: 1 + customer_description: null + custom_attributes: null + creation_date: '2023-05-11T16:37:29.709361' + alert_owner_id: null + alert_description: 'This is a test alert, courtesy of MS' + alert_creation_time: '2023-05-12T14:06:14.930955' + cases: [] + alert_source_event_time: '2023-03-26T03:00:30' + alert_customer_id: 1 + status: + status_id: 3 + status_name: Assigned + status_description: Alert is assigned to a user and pending investigation + comments: [] + alert_uuid: 98ab0a1f-06fd-4b26-8b4c-9441e3f46b79 + properties: + status: + type: string + message: + type: string + data: + type: object + properties: + owner: + nullable: true + alert_note: + type: string + alert_source: + type: string + alert_title: + type: string + modification_history: + type: object + assets: + type: array + items: + type: object + properties: + asset_enrichment: + type: object + properties: + enrich1: + type: object + properties: + A key: + type: string + asset_ip: + type: string + user_id: + nullable: true + asset_uuid: + type: string + asset_description: + type: string + asset_type: + type: object + properties: + asset_name: + type: string + asset_description: + type: string + asset_icon_not_compromised: + type: string + asset_icon_compromised: + type: string + asset_id: + type: integer + asset_id: + type: integer + case_id: + nullable: true + asset_name: + type: string + analysis_status_id: + nullable: true + date_added: + nullable: true + asset_domain: + type: string + custom_attributes: + nullable: true + asset_type_id: + type: integer + asset_info: + nullable: true + date_update: + nullable: true + asset_tags: + type: string + asset_compromise_status_id: + nullable: true + classification: + type: object + properties: + name: + type: string + name_expanded: + type: string + creation_date: + type: string + description: + type: string + id: + type: integer + alert_id: + type: integer + alert_source_link: + type: string + severity: + type: object + properties: + severity_name: + type: string + severity_id: + type: integer + severity_description: + type: string + iocs: + type: array + items: + type: object + properties: + ioc_tlp_id: + type: integer + ioc_type_id: + type: integer + user_id: + nullable: true + ioc_id: + type: integer + ioc_misp: + nullable: true + ioc_value: + type: string + ioc_uuid: + type: string + ioc_description: + type: string + ioc_enrichment: + type: object + custom_attributes: + nullable: true + ioc_type: + type: object + properties: + type_name: + type: string + type_validation_regex: + nullable: true + type_id: + type: integer + type_description: + type: string + type_validation_expect: + nullable: true + type_taxonomy: + nullable: true + ioc_tags: + type: string + alert_context: + type: object + properties: + context_key: + type: string + alert_classification_id: + type: integer + alert_tags: + type: string + alert_severity_id: + type: integer + alert_source_ref: + type: string + alert_status_id: + type: integer + customer: + type: object + properties: + customer_name: + type: string + client_uuid: + type: string + customer_sla: + nullable: true + last_update_date: + type: string + customer_id: + type: integer + customer_description: + nullable: true + custom_attributes: + nullable: true + creation_date: + type: string + alert_owner_id: + nullable: true + alert_description: + type: string + alert_creation_time: + type: string + cases: + type: array + items: + type: object + alert_source_event_time: + type: string + alert_customer_id: + type: integer + status: + type: object + properties: + status_id: + type: integer + status_name: + type: string + status_description: + type: string + comments: + type: array + items: + type: object + alert_uuid: + type: string + alert_source_content: + type: object + examples: + Example 1: + value: + status: success + message: '' + data: + owner: null + alert_note: A note on the alert + alert_source: Test Source + alert_title: Low-reputation arbitrary code executed by signed executable + modification_history: + '1683900374.955318': + user: administrator + user_id: 1 + action: Alert created + assets: + - asset_enrichment: + enrich1: + A key: A value + asset_ip: 1.1.1.1 + user_id: null + asset_uuid: ddf4c674-3853-4cc6-914a-f43f03f426d5 + asset_description: Asset description + asset_type: + asset_name: Account + asset_description: Generic Account + asset_icon_not_compromised: user.png + asset_icon_compromised: ioc_user.png + asset_id: 1 + asset_id: 7650 + case_id: null + asset_name: My super asset + analysis_status_id: null + date_added: null + asset_domain: '' + custom_attributes: null + asset_type_id: 1 + asset_info: null + date_update: null + asset_tags: 'tag1,tag2' + asset_compromise_status_id: null + classification: + name: 'abusive-content:spam' + name_expanded: 'Abusive-Content: spam' + creation_date: '2023-05-11T16:37:28.571756' + description: 'Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content.' + id: 1 + alert_id: 3826 + alert_source_link: 'https://source_link.com' + severity: + severity_name: Medium + severity_id: 4 + severity_description: Medium + iocs: + - ioc_tlp_id: 1 + ioc_type_id: 2 + user_id: null + ioc_id: 7651 + ioc_misp: null + ioc_value: tarzan5 + ioc_uuid: 1c055831-67bb-4c1b-9e49-c1c0e42301b8 + ioc_description: description of Tarzan + ioc_enrichment: + provider_1: + data: 2 + new_data: 3 + provider_3: + enric: 'true' + custom_attributes: null + ioc_type: + type_name: aba-rtn + type_validation_regex: null + type_id: 2 + type_description: ABA routing transit number + type_validation_expect: null + type_taxonomy: null + ioc_tags: 'tag1,tag2' + - ioc_tlp_id: 2 + ioc_type_id: 4 + user_id: null + ioc_id: 7652 + ioc_misp: null + ioc_value: tarzan2 + ioc_uuid: 06c0073e-1336-4daa-8321-995116484dd2 + ioc_description: description_hey + ioc_enrichment: + provider_1: + data: |- + a very long + blablablabdjsjofiasofiasjdxaisjhfaiosxhd bla + ddijwedoijwedw + dhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas + new_data: 3 + provider_3: + enric: 'true' + custom_attributes: null + ioc_type: + type_name: anonymised + type_validation_regex: null + type_id: 4 + type_description: Anonymised value - described with the anonymisation object via a relationship + type_validation_expect: null + type_taxonomy: null + ioc_tags: 'tag1,tag2' + alert_context: + context_key: context_value + alert_classification_id: 1 + alert_source_content: + _id: 603f704aaf7417985bbf3b22 + contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 + description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) + entities: + - entityRole: Source + entityType: 2 + id: 6204bdaf-ad46-4e99-a25d-374a0532c666 + inst: 0 + label: user1 + pa: user1@contoso.com + saas: 11161 + type: account + - entityRole: Related + id: 55017817-27af-49a7-93d6-8af6c5030fdb + label: DC3 + type: device + - id: 20940 + label: Active Directory + type: service + - entityRole: Related + id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 + label: DC4 + type: device + - id: 5bfd18bfab73c36ba10d38ca + label: Honeytoken activity + policyType: ANOMALY_DETECTION + type: policyRule + - entityRole: Source + id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 + label: Client1 + type: device + - entityRole: Related + id: d68772fe-1171-4124-9f73-0f410340bd54 + label: DC1 + type: device + - type: groupTag + id: 5f759b4d106abbe4a504ea5d + label: All Users + idValue: 15795464 + isSystemAlert: false + resolutionStatusValue: 0 + severityValue: 5 + statusValue: 1 + stories: + - 0 + threatScore: 34 + timestamp: 1621941916475 + title: Honeytoken activity + comment: '' + handledByUser: administrator@contoso.com + resolveTime: '2021-05-13T14:02:34.904Z' + URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' + alert_tags: 'defender,anothertag' + alert_severity_id: 4 + alert_source_ref: Test-123 + alert_status_id: 3 + customer: + customer_name: IrisInitialClient + client_uuid: a3d0f1e2-05dd-4439-a6d8-83cee72bb9ec + customer_sla: null + last_update_date: '2023-05-11T16:37:29.709361' + customer_id: 1 + customer_description: null + custom_attributes: null + creation_date: '2023-05-11T16:37:29.709361' + alert_owner_id: null + alert_description: 'This is a test alert, courtesy of MS' + alert_creation_time: '2023-05-12T14:06:14.930955' + cases: [] + alert_source_event_time: '2023-03-26T03:00:30' + alert_customer_id: 1 + status: + status_id: 3 + status_name: Assigned + status_description: Alert is assigned to a user and pending investigation + comments: [] + alert_uuid: 98ab0a1f-06fd-4b26-8b4c-9441e3f46b79 + '': + content: + application/json: + schema: + type: object + x-examples: + Example 1: + status: success + message: '' + data: + modification_history: + '1683098542.11236': + user: administrator + user_id: 1 + action: Alert created + owner: null + customer: + customer_description: fsadfsadf + customer_name: irisinitialclient98i oaisjdoasifosif jafija ofijasodfi jaofdij aofdijasd + custom_attributes: {} + customer_id: 1 + customer_sla: fsdafasd as + client_uuid: a7d03ac4-224e-424f-a9f9-9fdb11a59375 + creation_date: '2023-04-28T11:30:01.792023' + last_update_date: '2023-04-28T11:30:01.792023' + alert_source: Test Source + alert_context: + context_key: context_value + alert_source_event_time: '2023-03-26T03:00:30' + alert_customer_id: 1 + classification: + id: 1 + name_expanded: 'Abusive-Content: spam' + name: 'abusive-content:spam' + creation_date: '2023-04-28T11:30:00.649012' + description: 'Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content.' + alert_source_link: 'https://source_link.com' + comments: [] + alert_owner_id: null + alert_severity_id: 4 + iocs: + - ioc_enrichment: + provider_1: + data: 2 + new_data: 3 + provider_3: + enric: 'true' + ioc_tlp_id: 1 + ioc_description: description of Tarzan + ioc_type_id: 2 + ioc_value: tarzan5 + ioc_type: + type_validation_regex: null + type_name: aba-rtn + type_id: 2 + type_taxonomy: null + type_description: ABA routing transit number + type_validation_expect: null + custom_attributes: null + ioc_misp: null + ioc_tags: 'tag1,tag2' + ioc_uuid: 76ce4060-0ad7-4c44-943d-4648f6bc597c + ioc_id: 1721 + user_id: null + - ioc_enrichment: + provider_1: + data: |- + a very long + blablablabdjsjofiasofiasjdxaisjhfaiosxhd bla + ddijwedoijwedw + dhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas + new_data: 3 + provider_3: + enric: 'true' + ioc_tlp_id: 2 + ioc_description: description_hey + ioc_type_id: 4 + ioc_value: tarzan2 + ioc_type: + type_validation_regex: null + type_name: anonymised + type_id: 4 + type_taxonomy: null + type_description: Anonymised value - described with the anonymisation object via a relationship + type_validation_expect: null + custom_attributes: null + ioc_misp: null + ioc_tags: 'tag1,tag2' + ioc_uuid: 1f870d2b-b9e3-4e0f-a64d-7032a88287b0 + ioc_id: 1722 + user_id: null + alert_source_ref: Test-123 + status: + status_id: 3 + status_description: Alert is assigned to a user and pending investigation + status_name: Assigned + assets: + - asset_id: 1775 + asset_uuid: 5aecf165-4ecc-48dc-b562-f0955a26fa3e + date_update: null + asset_enrichment: + enrich1: + A key: A value + asset_ip: 1.1.1.1 + case_id: null + asset_tags: 'tag1,tag2' + asset_type: + asset_description: Generic Account + asset_icon_not_compromised: user.png + asset_name: Account + asset_id: 1 + asset_icon_compromised: ioc_user.png + asset_compromise_status_id: null + custom_attributes: null + analysis_status_id: null + date_added: null + user_id: null + asset_description: Asset description + asset_name: My super asset + asset_domain: '' + asset_type_id: 1 + asset_info: null + alert_tags: 'defender,anothertag' + cases: [] + alert_creation_time: '2023-05-03T07:22:22.072786' + alert_note: A note on + alert_classification_id: 1 + alert_source_content: + _id: 603f704aaf7417985bbf3b22 + contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 + description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) + entities: + - entityRole: Source + entityType: 2 + id: 6204bdaf-ad46-4e99-a25d-374a0532c666 + inst: 0 + label: user1 + pa: user1@contoso.com + saas: 11161 + type: account + - entityRole: Related + id: 55017817-27af-49a7-93d6-8af6c5030fdb + label: DC3 + type: device + - id: 20940 + label: Active Directory + type: service + - entityRole: Related + id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 + label: DC4 + type: device + - id: 5bfd18bfab73c36ba10d38ca + label: Honeytoken activity + policyType: ANOMALY_DETECTION + type: policyRule + - entityRole: Source + id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 + label: Client1 + type: device + - entityRole: Related + id: d68772fe-1171-4124-9f73-0f410340bd54 + label: DC1 + type: device + - type: groupTag + id: 5f759b4d106abbe4a504ea5d + label: All Users + idValue: 15795464 + isSystemAlert: false + resolutionStatusValue: 0 + severityValue: 5 + statusValue: 1 + stories: + - 0 + threatScore: 34 + timestamp: 1621941916475 + title: Honeytoken activity + comment: '' + handledByUser: administrator@contoso.com + resolveTime: '2021-05-13T14:02:34.904Z' + URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' + severity: + severity_id: 4 + severity_description: Medium + severity_name: Medium + alert_description: 'This is a test alert, courtesy of MS' + alert_title: Low-reputation arbitrary code executed by signed executable + alert_uuid: b38266dd-3698-480f-ba99-61854acbc652 + alert_id: 796 + alert_status_id: 3 + properties: + status: + type: string + message: + type: string + data: + type: object + properties: + modification_history: + type: object + properties: + '1683098542.11236': + type: object + properties: + user: + type: string + user_id: + type: integer + action: + type: string + owner: + nullable: true + customer: + type: object + properties: + customer_description: + type: string + customer_name: + type: string + custom_attributes: + type: object + customer_id: + type: integer + customer_sla: + type: string + client_uuid: + type: string + creation_date: + type: string + last_update_date: + type: string + alert_source: + type: string + alert_context: + type: object + properties: + context_key: + type: string + alert_source_event_time: + type: string + alert_customer_id: + type: integer + classification: + type: object + properties: + id: + type: integer + name_expanded: + type: string + name: + type: string + creation_date: + type: string + description: + type: string + alert_source_link: + type: string + comments: + type: array + items: + type: object + alert_owner_id: + nullable: true + alert_severity_id: + type: integer + iocs: + type: array + items: + type: object + properties: + ioc_enrichment: + type: object + ioc_tlp_id: + type: integer + ioc_description: + type: string + ioc_type_id: + type: integer + ioc_value: + type: string + ioc_type: + type: object + properties: + type_validation_regex: + nullable: true + type_name: + type: string + type_id: + type: integer + type_taxonomy: + nullable: true + type_description: + type: string + type_validation_expect: + nullable: true + custom_attributes: + nullable: true + ioc_misp: + nullable: true + ioc_tags: + type: string + ioc_uuid: + type: string + ioc_id: + type: integer + user_id: + nullable: true + alert_source_ref: + type: string + status: + type: object + properties: + status_id: + type: integer + status_description: + type: string + status_name: + type: string + assets: + type: array + items: + type: object + properties: + asset_id: + type: integer + asset_uuid: + type: string + date_update: + nullable: true + asset_enrichment: + type: object + asset_ip: + type: string + case_id: + nullable: true + asset_tags: + type: string + asset_type: + type: object + properties: + asset_description: + type: string + asset_icon_not_compromised: + type: string + asset_name: + type: string + asset_id: + type: integer + asset_icon_compromised: + type: string + asset_compromise_status_id: + nullable: true + custom_attributes: + nullable: true + analysis_status_id: + nullable: true + date_added: + nullable: true + user_id: + nullable: true + asset_description: + type: string + asset_name: + type: string + asset_domain: + type: string + asset_type_id: + type: integer + asset_info: + nullable: true + alert_tags: + type: string + cases: + type: array + items: + type: object + alert_creation_time: + type: string + alert_note: + type: string + alert_classification_id: + type: integer + severity: + type: object + properties: + severity_id: + type: integer + severity_description: + type: string + severity_name: + type: string + alert_description: + type: string + alert_title: + type: string + alert_uuid: + type: string + alert_id: + type: integer + alert_status_id: + type: integer + alert_source_content: + type: object + examples: + Example 1: + value: + status: success + message: '' + data: + modification_history: + '1683098542.11236': + user: administrator + user_id: 1 + action: Alert created + owner: null + customer: + customer_description: Description + customer_name: irisinitialclient + custom_attributes: {} + customer_id: 1 + customer_sla: nop + client_uuid: a7d03ac4-224e-424f-a9f9-9fdb11a59375 + creation_date: '2023-04-28T11:30:01.792023' + last_update_date: '2023-04-28T11:30:01.792023' + alert_source: Test Source + alert_context: + context_key: context_value + alert_source_event_time: '2023-03-26T03:00:30' + alert_customer_id: 1 + classification: + id: 1 + name_expanded: 'Abusive-Content: spam' + name: 'abusive-content:spam' + creation_date: '2023-04-28T11:30:00.649012' + description: 'Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content.' + alert_source_link: 'https://source_link.com' + comments: [] + alert_owner_id: null + alert_severity_id: 4 + iocs: + - ioc_enrichment: + provider_1: + data: 2 + new_data: 3 + provider_3: + enric: 'true' + ioc_tlp_id: 1 + ioc_description: description of Tarzan + ioc_type_id: 2 + ioc_value: tarzan5 + ioc_type: + type_validation_regex: null + type_name: aba-rtn + type_id: 2 + type_taxonomy: null + type_description: ABA routing transit number + type_validation_expect: null + custom_attributes: null + ioc_misp: null + ioc_tags: 'tag1,tag2' + ioc_uuid: 76ce4060-0ad7-4c44-943d-4648f6bc597c + ioc_id: 1721 + user_id: null + - ioc_enrichment: + provider_1: + data: |- + a very long + blablablabdjsjofiasofiasjdxaisjhfaiosxhd bla + ddijwedoijwedw + dhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas + new_data: 3 + provider_3: + enric: 'true' + ioc_tlp_id: 2 + ioc_description: description_hey + ioc_type_id: 4 + ioc_value: tarzan2 + ioc_type: + type_validation_regex: null + type_name: anonymised + type_id: 4 + type_taxonomy: null + type_description: Anonymised value - described with the anonymisation object via a relationship + type_validation_expect: null + custom_attributes: null + ioc_misp: null + ioc_tags: 'tag1,tag2' + ioc_uuid: 1f870d2b-b9e3-4e0f-a64d-7032a88287b0 + ioc_id: 1722 + user_id: null + alert_source_ref: Test-123 + status: + status_id: 3 + status_description: Alert is assigned to a user and pending investigation + status_name: Assigned + assets: + - asset_id: 1775 + asset_uuid: 5aecf165-4ecc-48dc-b562-f0955a26fa3e + date_update: null + asset_enrichment: + enrich1: + A key: A value + asset_ip: 1.1.1.1 + case_id: null + asset_tags: 'tag1,tag2' + asset_type: + asset_description: Generic Account + asset_icon_not_compromised: user.png + asset_name: Account + asset_id: 1 + asset_icon_compromised: ioc_user.png + asset_compromise_status_id: null + custom_attributes: null + analysis_status_id: null + date_added: null + user_id: null + asset_description: Asset description + asset_name: My super asset + asset_domain: '' + asset_type_id: 1 + asset_info: null + alert_tags: 'defender,anothertag' + cases: [] + alert_creation_time: '2023-05-03T07:22:22.072786' + alert_note: A note on + alert_classification_id: 1 + alert_source_content: + _id: 603f704aaf7417985bbf3b22 + contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 + description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) + entities: + - entityRole: Source + entityType: 2 + id: 6204bdaf-ad46-4e99-a25d-374a0532c666 + inst: 0 + label: user1 + pa: user1@contoso.com + saas: 11161 + type: account + - entityRole: Related + id: 55017817-27af-49a7-93d6-8af6c5030fdb + label: DC3 + type: device + - id: 20940 + label: Active Directory + type: service + - entityRole: Related + id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 + label: DC4 + type: device + - id: 5bfd18bfab73c36ba10d38ca + label: Honeytoken activity + policyType: ANOMALY_DETECTION + type: policyRule + - entityRole: Source + id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 + label: Client1 + type: device + - entityRole: Related + id: d68772fe-1171-4124-9f73-0f410340bd54 + label: DC1 + type: device + - type: groupTag + id: 5f759b4d106abbe4a504ea5d + label: All Users + idValue: 15795464 + isSystemAlert: false + resolutionStatusValue: 0 + severityValue: 5 + statusValue: 1 + stories: + - 0 + threatScore: 34 + timestamp: 1621941916475 + title: Honeytoken activity + comment: '' + handledByUser: administrator@contoso.com + resolveTime: '2021-05-13T14:02:34.904Z' + URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' + severity: + severity_id: 4 + severity_description: Medium + severity_name: Medium + alert_description: 'This is a test alert, courtesy of MS' + alert_title: Low-reputation arbitrary code executed by signed executable + alert_uuid: b38266dd-3698-480f-ba99-61854acbc652 + alert_id: 796 + alert_status_id: 3 + description: 'Add a new alert. ' + parameters: [] + security: + - Bearer : [] + requestBody: + content: + application/json: + schema: + type: object + x-examples: + Example 1: + alert_title: Super alert 5 + alert_description: This is a test alert + alert_source: Test Source + alert_source_ref: Test-123 + alert_source_link: 'https://source_link.com' + alert_source_content: + _id: 603f704aaf7417985bbf3b22 + contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 + description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) + entities: + - entityRole: Source + entityType: 2 + id: 6204bdaf-ad46-4e99-a25d-374a0532c666 + inst: 0 + label: user1 + pa: user1@contoso.com + saas: 11161 + type: account + - entityRole: Related + id: 55017817-27af-49a7-93d6-8af6c5030fdb + label: DC3 + type: device + - id: 20940 + label: Active Directory + type: service + - entityRole: Related + id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 + label: DC4 + type: device + - id: 5bfd18bfab73c36ba10d38ca + label: Honeytoken activity + policyType: ANOMALY_DETECTION + type: policyRule + - entityRole: Source + id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 + label: Client1 + type: device + - entityRole: Related + id: d68772fe-1171-4124-9f73-0f410340bd54 + label: DC1 + type: device + - type: groupTag + id: 5f759b4d106abbe4a504ea5d + label: All Users + idValue: 15795464 + isSystemAlert: false + resolutionStatusValue: 0 + severityValue: 5 + statusValue: 1 + stories: + - 0 + threatScore: 34 + timestamp: 1621941916475 + title: Honeytoken activity + comment: '' + handledByUser: administrator@contoso.com + resolveTime: '2021-05-13T14:02:34.904Z' + URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' + alert_severity_id: 4 + alert_status_id: 3 + alert_context: + context_key: context_value + alert_source_event_time: '2023-03-26T03:00:30' + alert_note: Test note + alert_tags: defender + alert_iocs: + - ioc_value: tarzan5 + ioc_description: description kwekwe + ioc_tlp_id: 1 + ioc_type_id: 2 + ioc_tags: 'tag1,tag2' + ioc_enrichment: + provider_1: + data: 2 + new_data: 3 + provider_3: + enric: 'true' + - ioc_value: tarzan2 + ioc_description: description_hey + ioc_tlp_id: 2 + ioc_type_id: 4 + ioc_tags: 'tag1,tag2' + ioc_enrichment: + provider_1: + data: |- + a very long + blablablabdjsjofiasofiasjdxaisjhfaiosxhd bla + ddijwedoijwedw + dhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas + new_data: 3 + provider_3: + enric: 'true' + alert_assets: + - asset_name: My super nop + asset_description: Asset description + asset_type_id: 1 + asset_ip: 1.1.1.1 + asset_domain: '' + asset_tags: 'tag1,tag2' + asset_enrichment: + provider_1: + key_a: value_a + alert_customer_id: 1 + alert_classification_id: 1 + properties: + alert_title: + type: string + alert_description: + type: string + alert_source: + type: string + alert_source_ref: + type: string + alert_source_link: + type: string + alert_severity_id: + type: integer + alert_status_id: + type: integer + alert_context: + type: object + description: Key-value JSON + properties: + context_key: + type: string + alert_source_event_time: + type: string + alert_note: + type: string + alert_tags: + type: string + alert_iocs: + type: array + items: + type: object + properties: + ioc_value: + type: string + ioc_description: + type: string + ioc_tlp_id: + type: integer + ioc_type_id: + type: integer + ioc_tags: + type: string + ioc_enrichment: + type: object + description: 'Free structured JSON that will be rendered as is in the UI. ' + alert_assets: + type: array + items: + type: object + properties: + asset_name: + type: string + asset_description: + type: string + asset_type_id: + type: integer + asset_ip: + type: string + asset_domain: + type: string + asset_tags: + type: string + asset_enrichment: + type: object + description: 'Free structured JSON that will be rendered as is in the UI. ' + alert_customer_id: + type: integer + alert_classification_id: + type: integer + alert_source_content: + type: object + description: Free JSON representing the source alert + examples: + example-1: + value: + alert_title: Low-reputation arbitrary code executed by signed executable + alert_description: 'This is a test alert, courtesy of MS' + alert_source: Test Source + alert_source_ref: Test-123 + alert_source_link: 'https://source_link.com' + alert_source_content: + _id: 603f704aaf7417985bbf3b22 + contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 + description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) + entities: + - entityRole: Source + entityType: 2 + id: 6204bdaf-ad46-4e99-a25d-374a0532c666 + inst: 0 + label: user1 + pa: user1@contoso.com + saas: 11161 + type: account + - entityRole: Related + id: 55017817-27af-49a7-93d6-8af6c5030fdb + label: DC3 + type: device + - id: 20940 + label: Active Directory + type: service + - entityRole: Related + id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 + label: DC4 + type: device + - id: 5bfd18bfab73c36ba10d38ca + label: Honeytoken activity + policyType: ANOMALY_DETECTION + type: policyRule + - entityRole: Source + id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 + label: Client1 + type: device + - entityRole: Related + id: d68772fe-1171-4124-9f73-0f410340bd54 + label: DC1 + type: device + - type: groupTag + id: 5f759b4d106abbe4a504ea5d + label: All Users + idValue: 15795464 + isSystemAlert: false + resolutionStatusValue: 0 + severityValue: 5 + statusValue: 1 + stories: + - 0 + threatScore: 34 + timestamp: 1621941916475 + title: Honeytoken activity + comment: '' + handledByUser: administrator@contoso.com + resolveTime: '2021-05-13T14:02:34.904Z' + URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' + alert_severity_id: 4 + alert_status_id: 3 + alert_context: + context_key: context_value + alert_source_event_time: '2023-03-26T03:00:30' + alert_note: A note on + alert_tags: 'defender,anothertag' + alert_iocs: + - ioc_value: tarzan5 + ioc_description: description of Tarzan + ioc_tlp_id: 1 + ioc_type_id: 2 + ioc_tags: 'tag1,tag2' + ioc_enrichment: + provider_1: + data: 2 + new_data: 3 + provider_3: + enric: 'true' + - ioc_value: tarzan2 + ioc_description: description_hey + ioc_tlp_id: 2 + ioc_type_id: 4 + ioc_tags: 'tag1,tag2' + ioc_enrichment: + provider_1: + data: |- + a very long + blablablabdjsjofiasofiasjdxaisjhfaiosxhd bla + ddijwedoijwedw + dhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas + new_data: 3 + provider_3: + enric: 'true' + alert_assets: + - asset_name: My super asset + asset_description: Asset description + asset_type_id: 1 + asset_ip: 1.1.1.1 + asset_domain: '' + asset_tags: 'tag1,tag2' + asset_enrichment: + enrich1: + A key: A value + alert_customer_id: 1 + alert_classification_id: 1 + description: '' + tags: + - Alerts + parameters: [] + '/alerts/update/{alert_id}': post: - summary: Add an alert - operationId: post-case-add-alert + summary: Update an alert + operationId: post-case-update-alert responses: '200': description: OK @@ -16163,90 +20772,65 @@ paths: application/json: schema: type: object - x-examples: - Example 1: - status: success - message: '' - data: - owner: null - alert_note: A note on - alert_source: Test Source - alert_title: Low-reputation arbitrary code executed by signed executable - modification_history: - '1683900374.955318': - user: administrator - user_id: 1 - action: Alert created - assets: - - asset_enrichment: - enrich1: - A key: A value - asset_ip: 1.1.1.1 - user_id: null - asset_uuid: ddf4c674-3853-4cc6-914a-f43f03f426d5 - asset_description: Asset description - asset_type: - asset_name: Account - asset_description: Generic Account - asset_icon_not_compromised: user.png - asset_icon_compromised: ioc_user.png - asset_id: 1 - asset_id: 7650 - case_id: null - asset_name: My super asset - analysis_status_id: null - date_added: null - asset_domain: '' - custom_attributes: null - asset_type_id: 1 - asset_info: null - date_update: null - asset_tags: 'tag1,tag2' - asset_compromise_status_id: null + x-examples: + Example 1: + status: success + message: '' + data: + severity: + severity_id: 4 + severity_name: Low + severity_description: Low + status: + status_id: 3 + status_name: Assigned + status_description: Alert is assigned to a user and pending investigation + customer: + customer_name: irisinitialclient300 + customer_description: null + customer_sla: null + customer_id: 1 + client_uuid: be6bb7a3-ba21-4946-8992-45213de680ad + creation_date: '2024-03-18T08:34:33.855919' + last_update_date: '2024-03-18T08:34:33.855919' + custom_attributes: null classification: name: 'abusive-content:spam' name_expanded: 'Abusive-Content: spam' - creation_date: '2023-05-11T16:37:28.571756' description: 'Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content.' id: 1 - alert_id: 3826 - alert_source_link: 'https://source_link.com' - severity: - severity_name: Medium - severity_id: 4 - severity_description: Medium + creation_date: '2024-03-18T08:34:32.554597' + owner: + id: 1 + user_name: administrator + user_login: administrator + user_email: administrator@localhost iocs: - - ioc_tlp_id: 1 - ioc_type_id: 2 - user_id: null - ioc_id: 7651 - ioc_misp: null - ioc_value: tarzan5 - ioc_uuid: 1c055831-67bb-4c1b-9e49-c1c0e42301b8 - ioc_description: description of Tarzan + - ioc_value: tarzan5 ioc_enrichment: provider_1: data: 2 new_data: 3 provider_3: enric: 'true' - custom_attributes: null ioc_type: type_name: aba-rtn - type_validation_regex: null - type_id: 2 type_description: ABA routing transit number - type_validation_expect: null type_taxonomy: null + type_validation_regex: null + type_validation_expect: null + type_id: 2 + ioc_id: 9 + ioc_uuid: 62414353-a840-4613-ba7c-e5d71023e734 + ioc_type_id: 2 + ioc_description: description kwekwe ioc_tags: 'tag1,tag2' - - ioc_tlp_id: 2 - ioc_type_id: 4 user_id: null - ioc_id: 7652 ioc_misp: null - ioc_value: tarzan2 - ioc_uuid: 06c0073e-1336-4daa-8321-995116484dd2 - ioc_description: description_hey + ioc_tlp_id: 1 + custom_attributes: null + modification_history: null + - ioc_value: tarzan2 ioc_enrichment: provider_1: data: |- @@ -16257,18 +20841,64 @@ paths: new_data: 3 provider_3: enric: 'true' - custom_attributes: null ioc_type: type_name: anonymised - type_validation_regex: null - type_id: 4 type_description: Anonymised value - described with the anonymisation object via a relationship - type_validation_expect: null type_taxonomy: null + type_validation_regex: null + type_validation_expect: null + type_id: 4 + ioc_id: 10 + ioc_uuid: cb689f85-43a6-4f39-a320-625c27b8975d + ioc_type_id: 4 + ioc_description: description_hey ioc_tags: 'tag1,tag2' - alert_context: - context_key: context_value - alert_classification_id: 1 + user_id: null + ioc_misp: null + ioc_tlp_id: 2 + custom_attributes: null + modification_history: null + assets: + - asset_name: My super nop + asset_enrichment: + enrich: + enrich2: super_enrich + asset_type: + asset_name: Account + asset_description: Generic Account + asset_icon_compromised: ioc_user.png + asset_icon_not_compromised: user.png + asset_id: 1 + asset_id: 4 + asset_uuid: 9420306a-bfd4-481a-9fb7-36cb38d8c187 + asset_description: Asset description + asset_domain: '' + asset_ip: 1.1.1.1 + asset_info: null + asset_compromise_status_id: null + asset_type_id: 1 + asset_tags: 'tag1,tag2' + case_id: null + date_added: null + date_update: null + user_id: null + analysis_status_id: null + custom_attributes: null + modification_history: null + resolution_status: + resolution_status_id: 1 + resolution_status_name: False Positive + resolution_status_description: The alert was a false positive + cases: + - 2 + comments: [] + alert_id: 5 + alert_uuid: 07719f0b-0dba-4277-b050-b750004ec35f + alert_title: Low-reputation arbitrary code executed by signed executable + alert_description: 'This is a test alert, courtesy of MS' + alert_source: Test Source + alert_source_ref: Test-123 + alert_source_link: 'https://source_link.com' alert_source_content: _id: 603f704aaf7417985bbf3b22 contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 @@ -16322,31 +20952,31 @@ paths: handledByUser: administrator@contoso.com resolveTime: '2021-05-13T14:02:34.904Z' URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' - alert_tags: 'defender,anothertag' alert_severity_id: 4 - alert_source_ref: Test-123 alert_status_id: 3 - customer: - customer_name: IrisInitialClient - client_uuid: a3d0f1e2-05dd-4439-a6d8-83cee72bb9ec - customer_sla: null - last_update_date: '2023-05-11T16:37:29.709361' - customer_id: 1 - customer_description: null - custom_attributes: null - creation_date: '2023-05-11T16:37:29.709361' - alert_owner_id: null - alert_description: 'This is a test alert, courtesy of MS' - alert_creation_time: '2023-05-12T14:06:14.930955' - cases: [] + alert_context: + context_key: context_value alert_source_event_time: '2023-03-26T03:00:30' + alert_creation_time: '2024-03-21T08:23:58.133478' + alert_note: A note on + alert_tags: 'defender,anothertag' + alert_owner_id: 1 + modification_history: + '1711009438.141667': + user: administrator + user_id: 1 + action: Alert created + '1711970872.267379': + user: administrator + user_id: 1 + action: 'updated alerts: "alert_note","alert_tags","alert_resolution_status_id","alert_status_id"' + '1711971195.490083': + user: administrator + user_id: 1 + action: 'updated alert: "alert_title","alert_description","alert_source_content","alert_status_id","alert_source_event_time","alert_note","alert_tags"' alert_customer_id: 1 - status: - status_id: 3 - status_name: Assigned - status_description: Alert is assigned to a user and pending investigation - comments: [] - alert_uuid: 98ab0a1f-06fd-4b26-8b4c-9441e3f46b79 + alert_classification_id: 1 + alert_resolution_status_id: 1 properties: status: type: string @@ -16355,37 +20985,141 @@ paths: data: type: object properties: + severity: + type: object + properties: + severity_id: + type: integer + severity_name: + type: string + severity_description: + type: string + status: + type: object + properties: + status_id: + type: integer + status_name: + type: string + status_description: + type: string + customer: + type: object + properties: + customer_name: + type: string + customer_description: + type: 'null' + customer_sla: + type: 'null' + customer_id: + type: integer + client_uuid: + type: string + creation_date: + type: string + last_update_date: + type: string + custom_attributes: + type: 'null' + classification: + type: object + properties: + name: + type: string + name_expanded: + type: string + description: + type: string + id: + type: integer + creation_date: + type: string owner: - nullable: true - alert_note: - type: string - alert_source: - type: string - alert_title: - type: string - modification_history: type: object - assets: + properties: + id: + type: integer + user_name: + type: string + user_login: + type: string + user_email: + type: string + iocs: type: array items: type: object properties: - asset_enrichment: + ioc_value: + type: string + ioc_enrichment: type: object properties: - enrich1: + provider_1: type: object properties: - A key: + data: + type: + - integer + - string + new_data: + type: integer + provider_3: + type: object + properties: + enric: type: string - asset_ip: + ioc_type: + type: object + properties: + type_name: + type: string + type_description: + type: string + type_taxonomy: + type: 'null' + type_validation_regex: + type: 'null' + type_validation_expect: + type: 'null' + type_id: + type: integer + ioc_id: + type: integer + ioc_uuid: type: string - user_id: - nullable: true - asset_uuid: + ioc_type_id: + type: integer + ioc_description: type: string - asset_description: + ioc_tags: + type: string + user_id: + type: 'null' + ioc_misp: + type: 'null' + ioc_tlp_id: + type: integer + custom_attributes: + type: 'null' + modification_history: + type: 'null' + assets: + type: array + items: + type: object + properties: + asset_name: type: string + asset_enrichment: + type: object + properties: + enrich: + type: object + properties: + enrich2: + type: string asset_type: type: object properties: @@ -16393,254 +21127,254 @@ paths: type: string asset_description: type: string - asset_icon_not_compromised: - type: string asset_icon_compromised: type: string + asset_icon_not_compromised: + type: string asset_id: type: integer asset_id: type: integer - case_id: - nullable: true - asset_name: + asset_uuid: + type: string + asset_description: type: string - analysis_status_id: - nullable: true - date_added: - nullable: true asset_domain: type: string - custom_attributes: - nullable: true + asset_ip: + type: string + asset_info: + type: 'null' + asset_compromise_status_id: + type: 'null' asset_type_id: type: integer - asset_info: - nullable: true - date_update: - nullable: true asset_tags: type: string - asset_compromise_status_id: - nullable: true - classification: + case_id: + type: 'null' + date_added: + type: 'null' + date_update: + type: 'null' + user_id: + type: 'null' + analysis_status_id: + type: 'null' + custom_attributes: + type: 'null' + modification_history: + type: 'null' + resolution_status: type: object properties: - name: - type: string - name_expanded: - type: string - creation_date: + resolution_status_id: + type: integer + resolution_status_name: type: string - description: + resolution_status_description: type: string - id: - type: integer + cases: + type: array + items: + type: integer + comments: + type: array + items: + type: object alert_id: type: integer + alert_uuid: + type: string + alert_title: + type: string + alert_description: + type: string + alert_source: + type: string + alert_source_ref: + type: string alert_source_link: type: string - severity: + alert_source_content: type: object + required: + - _id + - contextId + - description + - entities + - idValue + - isSystemAlert + - resolutionStatusValue + - severityValue + - statusValue + - stories + - threatScore + - timestamp + - title + - comment + - handledByUser + - resolveTime + - URL properties: - severity_name: + _id: type: string - severity_id: - type: integer - severity_description: + contextId: type: string - iocs: - type: array - items: - type: object - properties: - ioc_tlp_id: - type: integer - ioc_type_id: - type: integer - user_id: - nullable: true - ioc_id: - type: integer - ioc_misp: - nullable: true - ioc_value: - type: string - ioc_uuid: - type: string - ioc_description: - type: string - ioc_enrichment: - type: object - custom_attributes: - nullable: true - ioc_type: + description: + type: string + entities: + type: array + items: type: object properties: - type_name: + entityRole: type: string - type_validation_regex: - nullable: true - type_id: + entityType: type: integer - type_description: + id: type: string - type_validation_expect: - nullable: true - type_taxonomy: - nullable: true - ioc_tags: - type: string - alert_context: - type: object - properties: - context_key: + inst: + type: integer + label: + type: string + pa: + type: string + saas: + type: integer + type: + type: string + policyType: + type: string + required: + - entityRole + - entityType + - id + - inst + - label + - pa + - saas + - type + - policyType + idValue: + type: integer + isSystemAlert: + type: boolean + resolutionStatusValue: + type: integer + severityValue: + type: integer + statusValue: + type: integer + stories: + type: array + items: + type: integer + threatScore: + type: integer + timestamp: + type: integer + title: + type: string + comment: + type: string + handledByUser: + type: string + resolveTime: + type: string + URL: type: string - alert_classification_id: - type: integer - alert_tags: - type: string alert_severity_id: type: integer - alert_source_ref: - type: string alert_status_id: type: integer - customer: + alert_context: type: object + required: + - context_key properties: - customer_name: - type: string - client_uuid: - type: string - customer_sla: - nullable: true - last_update_date: - type: string - customer_id: - type: integer - customer_description: - nullable: true - custom_attributes: - nullable: true - creation_date: + context_key: type: string - alert_owner_id: - nullable: true - alert_description: + alert_source_event_time: type: string alert_creation_time: type: string - cases: - type: array - items: - type: object - alert_source_event_time: + alert_note: type: string - alert_customer_id: - type: integer - status: - type: object - properties: - status_id: - type: integer - status_name: - type: string - status_description: - type: string - comments: - type: array - items: - type: object - alert_uuid: + alert_tags: type: string - alert_source_content: - type: object - examples: - Example 1: - value: - status: success - message: '' - data: - owner: null - alert_note: A note on the alert - alert_source: Test Source - alert_title: Low-reputation arbitrary code executed by signed executable + alert_owner_id: + type: integer modification_history: - '1683900374.955318': - user: administrator - user_id: 1 - action: Alert created - assets: - - asset_enrichment: - enrich1: - A key: A value - asset_ip: 1.1.1.1 - user_id: null - asset_uuid: ddf4c674-3853-4cc6-914a-f43f03f426d5 - asset_description: Asset description - asset_type: - asset_name: Account - asset_description: Generic Account - asset_icon_not_compromised: user.png - asset_icon_compromised: ioc_user.png - asset_id: 1 - asset_id: 7650 - case_id: null - asset_name: My super asset - analysis_status_id: null - date_added: null - asset_domain: '' - custom_attributes: null - asset_type_id: 1 - asset_info: null - date_update: null - asset_tags: 'tag1,tag2' - asset_compromise_status_id: null + type: object + alert_customer_id: + type: integer + alert_classification_id: + type: integer + alert_resolution_status_id: + type: integer + required: + - all + examples: + example-1: + value: + status: success + message: '' + data: + severity: + severity_id: 4 + severity_name: Low + severity_description: Low + status: + status_id: 3 + status_name: Assigned + status_description: Alert is assigned to a user and pending investigation + customer: + customer_name: irisinitialclient300 + customer_description: null + customer_sla: null + customer_id: 1 + client_uuid: be6bb7a3-ba21-4946-8992-45213de680ad + creation_date: '2024-03-18T08:34:33.855919' + last_update_date: '2024-03-18T08:34:33.855919' + custom_attributes: null classification: name: 'abusive-content:spam' name_expanded: 'Abusive-Content: spam' - creation_date: '2023-05-11T16:37:28.571756' description: 'Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content.' id: 1 - alert_id: 3826 - alert_source_link: 'https://source_link.com' - severity: - severity_name: Medium - severity_id: 4 - severity_description: Medium + creation_date: '2024-03-18T08:34:32.554597' + owner: + id: 1 + user_name: administrator + user_login: administrator + user_email: administrator@localhost iocs: - - ioc_tlp_id: 1 - ioc_type_id: 2 - user_id: null - ioc_id: 7651 - ioc_misp: null - ioc_value: tarzan5 - ioc_uuid: 1c055831-67bb-4c1b-9e49-c1c0e42301b8 - ioc_description: description of Tarzan + - ioc_value: tarzan5 ioc_enrichment: provider_1: data: 2 new_data: 3 provider_3: enric: 'true' - custom_attributes: null ioc_type: type_name: aba-rtn - type_validation_regex: null - type_id: 2 type_description: ABA routing transit number - type_validation_expect: null type_taxonomy: null + type_validation_regex: null + type_validation_expect: null + type_id: 2 + ioc_id: 9 + ioc_uuid: 62414353-a840-4613-ba7c-e5d71023e734 + ioc_type_id: 2 + ioc_description: description kwekwe ioc_tags: 'tag1,tag2' - - ioc_tlp_id: 2 - ioc_type_id: 4 user_id: null - ioc_id: 7652 ioc_misp: null - ioc_value: tarzan2 - ioc_uuid: 06c0073e-1336-4daa-8321-995116484dd2 - ioc_description: description_hey + ioc_tlp_id: 1 + custom_attributes: null + modification_history: null + - ioc_value: tarzan2 ioc_enrichment: provider_1: data: |- @@ -16651,223 +21385,64 @@ paths: new_data: 3 provider_3: enric: 'true' - custom_attributes: null ioc_type: type_name: anonymised - type_validation_regex: null - type_id: 4 type_description: Anonymised value - described with the anonymisation object via a relationship - type_validation_expect: null type_taxonomy: null - ioc_tags: 'tag1,tag2' - alert_context: - context_key: context_value - alert_classification_id: 1 - alert_source_content: - _id: 603f704aaf7417985bbf3b22 - contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 - description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) - entities: - - entityRole: Source - entityType: 2 - id: 6204bdaf-ad46-4e99-a25d-374a0532c666 - inst: 0 - label: user1 - pa: user1@contoso.com - saas: 11161 - type: account - - entityRole: Related - id: 55017817-27af-49a7-93d6-8af6c5030fdb - label: DC3 - type: device - - id: 20940 - label: Active Directory - type: service - - entityRole: Related - id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 - label: DC4 - type: device - - id: 5bfd18bfab73c36ba10d38ca - label: Honeytoken activity - policyType: ANOMALY_DETECTION - type: policyRule - - entityRole: Source - id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 - label: Client1 - type: device - - entityRole: Related - id: d68772fe-1171-4124-9f73-0f410340bd54 - label: DC1 - type: device - - type: groupTag - id: 5f759b4d106abbe4a504ea5d - label: All Users - idValue: 15795464 - isSystemAlert: false - resolutionStatusValue: 0 - severityValue: 5 - statusValue: 1 - stories: - - 0 - threatScore: 34 - timestamp: 1621941916475 - title: Honeytoken activity - comment: '' - handledByUser: administrator@contoso.com - resolveTime: '2021-05-13T14:02:34.904Z' - URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' - alert_tags: 'defender,anothertag' - alert_severity_id: 4 - alert_source_ref: Test-123 - alert_status_id: 3 - customer: - customer_name: IrisInitialClient - client_uuid: a3d0f1e2-05dd-4439-a6d8-83cee72bb9ec - customer_sla: null - last_update_date: '2023-05-11T16:37:29.709361' - customer_id: 1 - customer_description: null - custom_attributes: null - creation_date: '2023-05-11T16:37:29.709361' - alert_owner_id: null - alert_description: 'This is a test alert, courtesy of MS' - alert_creation_time: '2023-05-12T14:06:14.930955' - cases: [] - alert_source_event_time: '2023-03-26T03:00:30' - alert_customer_id: 1 - status: - status_id: 3 - status_name: Assigned - status_description: Alert is assigned to a user and pending investigation - comments: [] - alert_uuid: 98ab0a1f-06fd-4b26-8b4c-9441e3f46b79 - '': - content: - application/json: - schema: - type: object - x-examples: - Example 1: - status: success - message: '' - data: - modification_history: - '1683098542.11236': - user: administrator - user_id: 1 - action: Alert created - owner: null - customer: - customer_description: fsadfsadf - customer_name: irisinitialclient98i oaisjdoasifosif jafija ofijasodfi jaofdij aofdijasd - custom_attributes: {} - customer_id: 1 - customer_sla: fsdafasd as - client_uuid: a7d03ac4-224e-424f-a9f9-9fdb11a59375 - creation_date: '2023-04-28T11:30:01.792023' - last_update_date: '2023-04-28T11:30:01.792023' - alert_source: Test Source - alert_context: - context_key: context_value - alert_source_event_time: '2023-03-26T03:00:30' - alert_customer_id: 1 - classification: - id: 1 - name_expanded: 'Abusive-Content: spam' - name: 'abusive-content:spam' - creation_date: '2023-04-28T11:30:00.649012' - description: 'Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content.' - alert_source_link: 'https://source_link.com' - comments: [] - alert_owner_id: null - alert_severity_id: 4 - iocs: - - ioc_enrichment: - provider_1: - data: 2 - new_data: 3 - provider_3: - enric: 'true' - ioc_tlp_id: 1 - ioc_description: description of Tarzan - ioc_type_id: 2 - ioc_value: tarzan5 - ioc_type: type_validation_regex: null - type_name: aba-rtn - type_id: 2 - type_taxonomy: null - type_description: ABA routing transit number type_validation_expect: null - custom_attributes: null - ioc_misp: null + type_id: 4 + ioc_id: 10 + ioc_uuid: cb689f85-43a6-4f39-a320-625c27b8975d + ioc_type_id: 4 + ioc_description: description_hey ioc_tags: 'tag1,tag2' - ioc_uuid: 76ce4060-0ad7-4c44-943d-4648f6bc597c - ioc_id: 1721 user_id: null - - ioc_enrichment: - provider_1: - data: |- - a very long - blablablabdjsjofiasofiasjdxaisjhfaiosxhd bla - ddijwedoijwedw - dhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas - new_data: 3 - provider_3: - enric: 'true' + ioc_misp: null ioc_tlp_id: 2 - ioc_description: description_hey - ioc_type_id: 4 - ioc_value: tarzan2 - ioc_type: - type_validation_regex: null - type_name: anonymised - type_id: 4 - type_taxonomy: null - type_description: Anonymised value - described with the anonymisation object via a relationship - type_validation_expect: null custom_attributes: null - ioc_misp: null - ioc_tags: 'tag1,tag2' - ioc_uuid: 1f870d2b-b9e3-4e0f-a64d-7032a88287b0 - ioc_id: 1722 - user_id: null - alert_source_ref: Test-123 - status: - status_id: 3 - status_description: Alert is assigned to a user and pending investigation - status_name: Assigned + modification_history: null assets: - - asset_id: 1775 - asset_uuid: 5aecf165-4ecc-48dc-b562-f0955a26fa3e - date_update: null + - asset_name: My super nop asset_enrichment: - enrich1: - A key: A value - asset_ip: 1.1.1.1 - case_id: null - asset_tags: 'tag1,tag2' + enrich: + enrich2: super_enrich asset_type: + asset_name: Account asset_description: Generic Account + asset_icon_compromised: ioc_user.png asset_icon_not_compromised: user.png - asset_name: Account asset_id: 1 - asset_icon_compromised: ioc_user.png + asset_id: 4 + asset_uuid: 9420306a-bfd4-481a-9fb7-36cb38d8c187 + asset_description: Asset description + asset_domain: '' + asset_ip: 1.1.1.1 + asset_info: null asset_compromise_status_id: null - custom_attributes: null - analysis_status_id: null + asset_type_id: 1 + asset_tags: 'tag1,tag2' + case_id: null date_added: null + date_update: null user_id: null - asset_description: Asset description - asset_name: My super asset - asset_domain: '' - asset_type_id: 1 - asset_info: null - alert_tags: 'defender,anothertag' - cases: [] - alert_creation_time: '2023-05-03T07:22:22.072786' - alert_note: A note on - alert_classification_id: 1 + analysis_status_id: null + custom_attributes: null + modification_history: null + resolution_status: + resolution_status_id: 1 + resolution_status_name: False Positive + resolution_status_description: The alert was a false positive + cases: + - 2 + comments: [] + alert_id: 5 + alert_uuid: 07719f0b-0dba-4277-b050-b750004ec35f + alert_title: Low-reputation arbitrary code executed by signed executable + alert_description: 'This is a test alert, courtesy of MS' + alert_source: Test Source + alert_source_ref: Test-123 + alert_source_link: 'https://source_link.com' alert_source_content: _id: 603f704aaf7417985bbf3b22 contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 @@ -16921,231 +21496,38 @@ paths: handledByUser: administrator@contoso.com resolveTime: '2021-05-13T14:02:34.904Z' URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' - severity: - severity_id: 4 - severity_description: Medium - severity_name: Medium - alert_description: 'This is a test alert, courtesy of MS' - alert_title: Low-reputation arbitrary code executed by signed executable - alert_uuid: b38266dd-3698-480f-ba99-61854acbc652 - alert_id: 796 + alert_severity_id: 4 alert_status_id: 3 - properties: - status: - type: string - message: - type: string - data: - type: object - properties: - modification_history: - type: object - properties: - '1683098542.11236': - type: object - properties: - user: - type: string - user_id: - type: integer - action: - type: string - owner: - nullable: true - customer: - type: object - properties: - customer_description: - type: string - customer_name: - type: string - custom_attributes: - type: object - customer_id: - type: integer - customer_sla: - type: string - client_uuid: - type: string - creation_date: - type: string - last_update_date: - type: string - alert_source: - type: string alert_context: - type: object - properties: - context_key: - type: string - alert_source_event_time: - type: string - alert_customer_id: - type: integer - classification: - type: object - properties: - id: - type: integer - name_expanded: - type: string - name: - type: string - creation_date: - type: string - description: - type: string - alert_source_link: - type: string - comments: - type: array - items: - type: object - alert_owner_id: - nullable: true - alert_severity_id: - type: integer - iocs: - type: array - items: - type: object - properties: - ioc_enrichment: - type: object - ioc_tlp_id: - type: integer - ioc_description: - type: string - ioc_type_id: - type: integer - ioc_value: - type: string - ioc_type: - type: object - properties: - type_validation_regex: - nullable: true - type_name: - type: string - type_id: - type: integer - type_taxonomy: - nullable: true - type_description: - type: string - type_validation_expect: - nullable: true - custom_attributes: - nullable: true - ioc_misp: - nullable: true - ioc_tags: - type: string - ioc_uuid: - type: string - ioc_id: - type: integer - user_id: - nullable: true - alert_source_ref: - type: string - status: - type: object - properties: - status_id: - type: integer - status_description: - type: string - status_name: - type: string - assets: - type: array - items: - type: object - properties: - asset_id: - type: integer - asset_uuid: - type: string - date_update: - nullable: true - asset_enrichment: - type: object - asset_ip: - type: string - case_id: - nullable: true - asset_tags: - type: string - asset_type: - type: object - properties: - asset_description: - type: string - asset_icon_not_compromised: - type: string - asset_name: - type: string - asset_id: - type: integer - asset_icon_compromised: - type: string - asset_compromise_status_id: - nullable: true - custom_attributes: - nullable: true - analysis_status_id: - nullable: true - date_added: - nullable: true - user_id: - nullable: true - asset_description: - type: string - asset_name: - type: string - asset_domain: - type: string - asset_type_id: - type: integer - asset_info: - nullable: true - alert_tags: - type: string - cases: - type: array - items: - type: object - alert_creation_time: - type: string - alert_note: - type: string - alert_classification_id: - type: integer - severity: - type: object - properties: - severity_id: - type: integer - severity_description: - type: string - severity_name: - type: string - alert_description: - type: string - alert_title: - type: string - alert_uuid: - type: string - alert_id: - type: integer - alert_status_id: - type: integer - alert_source_content: - type: object - examples: - Example 1: - value: + context_key: context_value + alert_source_event_time: '2023-03-26T03:00:30' + alert_creation_time: '2024-03-21T08:23:58.133478' + alert_note: A note on + alert_tags: 'defender,anothertag' + alert_owner_id: 1 + modification_history: + '1711009438.141667': + user: administrator + user_id: 1 + action: Alert created + '1711970872.267379': + user: administrator + user_id: 1 + action: 'updated alerts: "alert_note","alert_tags","alert_resolution_status_id","alert_status_id"' + '1711971195.490083': + user: administrator + user_id: 1 + action: 'updated alert: "alert_title","alert_description","alert_source_content","alert_status_id","alert_source_event_time","alert_note","alert_tags"' + alert_customer_id: 1 + alert_classification_id: 1 + alert_resolution_status_id: 1 + '': + content: + application/json: + schema: + type: object + x-examples: + Example 1: status: success message: '' data: @@ -17156,11 +21538,11 @@ paths: action: Alert created owner: null customer: - customer_description: Description - customer_name: irisinitialclient + customer_description: fsadfsadf + customer_name: irisinitialclient98i oaisjdoasifosif jafija ofijasodfi jaofdij aofdijasd custom_attributes: {} customer_id: 1 - customer_sla: nop + customer_sla: fsdafasd as client_uuid: a7d03ac4-224e-424f-a9f9-9fdb11a59375 creation_date: '2023-04-28T11:30:01.792023' last_update_date: '2023-04-28T11:30:01.792023' @@ -17328,340 +21710,237 @@ paths: alert_uuid: b38266dd-3698-480f-ba99-61854acbc652 alert_id: 796 alert_status_id: 3 - description: 'Add a new alert. ' - parameters: [] - security: - - Bearer : [] - requestBody: - content: - application/json: - schema: - type: object - x-examples: - Example 1: - alert_title: Super alert 5 - alert_description: This is a test alert - alert_source: Test Source - alert_source_ref: Test-123 - alert_source_link: 'https://source_link.com' - alert_source_content: - _id: 603f704aaf7417985bbf3b22 - contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 - description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) - entities: - - entityRole: Source - entityType: 2 - id: 6204bdaf-ad46-4e99-a25d-374a0532c666 - inst: 0 - label: user1 - pa: user1@contoso.com - saas: 11161 - type: account - - entityRole: Related - id: 55017817-27af-49a7-93d6-8af6c5030fdb - label: DC3 - type: device - - id: 20940 - label: Active Directory - type: service - - entityRole: Related - id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 - label: DC4 - type: device - - id: 5bfd18bfab73c36ba10d38ca - label: Honeytoken activity - policyType: ANOMALY_DETECTION - type: policyRule - - entityRole: Source - id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 - label: Client1 - type: device - - entityRole: Related - id: d68772fe-1171-4124-9f73-0f410340bd54 - label: DC1 - type: device - - type: groupTag - id: 5f759b4d106abbe4a504ea5d - label: All Users - idValue: 15795464 - isSystemAlert: false - resolutionStatusValue: 0 - severityValue: 5 - statusValue: 1 - stories: - - 0 - threatScore: 34 - timestamp: 1621941916475 - title: Honeytoken activity - comment: '' - handledByUser: administrator@contoso.com - resolveTime: '2021-05-13T14:02:34.904Z' - URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' - alert_severity_id: 4 - alert_status_id: 3 - alert_context: - context_key: context_value - alert_source_event_time: '2023-03-26T03:00:30' - alert_note: Test note - alert_tags: defender - alert_iocs: - - ioc_value: tarzan5 - ioc_description: description kwekwe - ioc_tlp_id: 1 - ioc_type_id: 2 - ioc_tags: 'tag1,tag2' - ioc_enrichment: - provider_1: - data: 2 - new_data: 3 - provider_3: - enric: 'true' - - ioc_value: tarzan2 - ioc_description: description_hey - ioc_tlp_id: 2 - ioc_type_id: 4 - ioc_tags: 'tag1,tag2' - ioc_enrichment: - provider_1: - data: |- - a very long - blablablabdjsjofiasofiasjdxaisjhfaiosxhd bla - ddijwedoijwedw - dhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas - new_data: 3 - provider_3: - enric: 'true' - alert_assets: - - asset_name: My super nop - asset_description: Asset description - asset_type_id: 1 - asset_ip: 1.1.1.1 - asset_domain: '' - asset_tags: 'tag1,tag2' - asset_enrichment: - provider_1: - key_a: value_a - alert_customer_id: 1 - alert_classification_id: 1 - properties: - alert_title: - type: string - alert_description: - type: string - alert_source: - type: string - alert_source_ref: - type: string - alert_source_link: - type: string - alert_severity_id: - type: integer - alert_status_id: - type: integer - alert_context: - type: object - description: Key-value JSON - properties: - context_key: - type: string - alert_source_event_time: - type: string - alert_note: - type: string - alert_tags: - type: string - alert_iocs: - type: array - items: + properties: + status: + type: string + message: + type: string + data: type: object properties: - ioc_value: + modification_history: + type: object + properties: + '1683098542.11236': + type: object + properties: + user: + type: string + user_id: + type: integer + action: + type: string + owner: + nullable: true + customer: + type: object + properties: + customer_description: + type: string + customer_name: + type: string + custom_attributes: + type: object + customer_id: + type: integer + customer_sla: + type: string + client_uuid: + type: string + creation_date: + type: string + last_update_date: + type: string + alert_source: type: string - ioc_description: + alert_context: + type: object + properties: + context_key: + type: string + alert_source_event_time: type: string - ioc_tlp_id: + alert_customer_id: type: integer - ioc_type_id: + classification: + type: object + properties: + id: + type: integer + name_expanded: + type: string + name: + type: string + creation_date: + type: string + description: + type: string + alert_source_link: + type: string + comments: + type: array + items: + type: object + alert_owner_id: + nullable: true + alert_severity_id: type: integer - ioc_tags: + iocs: + type: array + items: + type: object + properties: + ioc_enrichment: + type: object + ioc_tlp_id: + type: integer + ioc_description: + type: string + ioc_type_id: + type: integer + ioc_value: + type: string + ioc_type: + type: object + properties: + type_validation_regex: + nullable: true + type_name: + type: string + type_id: + type: integer + type_taxonomy: + nullable: true + type_description: + type: string + type_validation_expect: + nullable: true + custom_attributes: + nullable: true + ioc_misp: + nullable: true + ioc_tags: + type: string + ioc_uuid: + type: string + ioc_id: + type: integer + user_id: + nullable: true + alert_source_ref: type: string - ioc_enrichment: + status: type: object - description: 'Free structured JSON that will be rendered as is in the UI. ' - alert_assets: - type: array - items: - type: object - properties: - asset_name: + properties: + status_id: + type: integer + status_description: + type: string + status_name: + type: string + assets: + type: array + items: + type: object + properties: + asset_id: + type: integer + asset_uuid: + type: string + date_update: + nullable: true + asset_enrichment: + type: object + asset_ip: + type: string + case_id: + nullable: true + asset_tags: + type: string + asset_type: + type: object + properties: + asset_description: + type: string + asset_icon_not_compromised: + type: string + asset_name: + type: string + asset_id: + type: integer + asset_icon_compromised: + type: string + asset_compromise_status_id: + nullable: true + custom_attributes: + nullable: true + analysis_status_id: + nullable: true + date_added: + nullable: true + user_id: + nullable: true + asset_description: + type: string + asset_name: + type: string + asset_domain: + type: string + asset_type_id: + type: integer + asset_info: + nullable: true + alert_tags: type: string - asset_description: + cases: + type: array + items: + type: object + alert_creation_time: type: string - asset_type_id: + alert_note: + type: string + alert_classification_id: type: integer - asset_ip: + severity: + type: object + properties: + severity_id: + type: integer + severity_description: + type: string + severity_name: + type: string + alert_description: type: string - asset_domain: + alert_title: type: string - asset_tags: + alert_uuid: type: string - asset_enrichment: - type: object - description: 'Free structured JSON that will be rendered as is in the UI. ' - alert_customer_id: - type: integer - alert_classification_id: - type: integer - alert_source_content: - type: object - description: Free JSON representing the source alert - examples: - example-1: - value: - alert_title: Low-reputation arbitrary code executed by signed executable - alert_description: 'This is a test alert, courtesy of MS' - alert_source: Test Source - alert_source_ref: Test-123 - alert_source_link: 'https://source_link.com' - alert_source_content: - _id: 603f704aaf7417985bbf3b22 - contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 - description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) - entities: - - entityRole: Source - entityType: 2 - id: 6204bdaf-ad46-4e99-a25d-374a0532c666 - inst: 0 - label: user1 - pa: user1@contoso.com - saas: 11161 - type: account - - entityRole: Related - id: 55017817-27af-49a7-93d6-8af6c5030fdb - label: DC3 - type: device - - id: 20940 - label: Active Directory - type: service - - entityRole: Related - id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 - label: DC4 - type: device - - id: 5bfd18bfab73c36ba10d38ca - label: Honeytoken activity - policyType: ANOMALY_DETECTION - type: policyRule - - entityRole: Source - id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 - label: Client1 - type: device - - entityRole: Related - id: d68772fe-1171-4124-9f73-0f410340bd54 - label: DC1 - type: device - - type: groupTag - id: 5f759b4d106abbe4a504ea5d - label: All Users - idValue: 15795464 - isSystemAlert: false - resolutionStatusValue: 0 - severityValue: 5 - statusValue: 1 - stories: - - 0 - threatScore: 34 - timestamp: 1621941916475 - title: Honeytoken activity - comment: '' - handledByUser: administrator@contoso.com - resolveTime: '2021-05-13T14:02:34.904Z' - URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' - alert_severity_id: 4 - alert_status_id: 3 - alert_context: - context_key: context_value - alert_source_event_time: '2023-03-26T03:00:30' - alert_note: A note on - alert_tags: 'defender,anothertag' - alert_iocs: - - ioc_value: tarzan5 - ioc_description: description of Tarzan - ioc_tlp_id: 1 - ioc_type_id: 2 - ioc_tags: 'tag1,tag2' - ioc_enrichment: - provider_1: - data: 2 - new_data: 3 - provider_3: - enric: 'true' - - ioc_value: tarzan2 - ioc_description: description_hey - ioc_tlp_id: 2 - ioc_type_id: 4 - ioc_tags: 'tag1,tag2' - ioc_enrichment: - provider_1: - data: |- - a very long - blablablabdjsjofiasofiasjdxaisjhfaiosxhd bla - ddijwedoijwedw - dhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas - new_data: 3 - provider_3: - enric: 'true' - alert_assets: - - asset_name: My super asset - asset_description: Asset description - asset_type_id: 1 - asset_ip: 1.1.1.1 - asset_domain: '' - asset_tags: 'tag1,tag2' - asset_enrichment: - enrich1: - A key: A value - alert_customer_id: 1 - alert_classification_id: 1 - description: '' - tags: - - Alerts - parameters: [] - '/alerts/update/{alert_id}': - post: - summary: Update an alert - operationId: post-case-update-alert - responses: - '200': - description: OK - content: - application/json: - schema: - type: object - x-examples: - Example 1: + alert_id: + type: integer + alert_status_id: + type: integer + alert_source_content: + type: object + examples: + Example 1: + value: status: success message: '' data: modification_history: - '1683048665.197759': + '1683098542.11236': user: administrator user_id: 1 action: Alert created - '1683099026.968733': - user: administrator - user_id: 1 - action: 'updated alert: "alert_title" from "DDoS Attack 193" to "Low-reputation arbitrary code executed by signed executable","alert_description" from "The network is experiencing a distributed denial-of-service attack." to "This is a test alert, courtesy of MS","alert_source_content" from "OrderedDict([(''_id'', ''603f704aaf7417985bbf3b22''), (''contextId'', ''206e2965-6533-48a6-ba9e-794364a84bf9''), (''description'', ''Binaries signed by Microsoft can be used to run low-reputation arbitrary code. This technique hides the execution of malicious code within a trusted process. As a result, the trusted process might exhibit suspicious behaviors, such as opening a listening port or connecting to a command-and-control (C&C) server.''), (''entities'', [OrderedDict([(''entityRole'', ''Source''), (''entityType'', 2), (''id'', ''6204bdaf-ad46-4e99-a25d-374a0532c666''), (''inst'', 0), (''label'', ''user1''), (''pa'', ''user1@contoso.com''), (''saas'', 11161), (''type'', ''account'')]), OrderedDict([(''entityRole'', ''Related''), (''id'', ''55017817-27af-49a7-93d6-8af6c5030fdb''), (''label'', ''DC3''), (''type'', ''device'')]), OrderedDict([(''id'', 20940), (''label'', ''Active Directory''), (''type'', ''service'')]), OrderedDict([(''entityRole'', ''Related''), (''id'', ''95c59b48-98c1-40ff-a444-d9040f1f68f2''), (''label'', ''DC4''), (''type'', ''device'')]), OrderedDict([(''id'', ''5bfd18bfab73c36ba10d38ca''), (''label'', ''Honeytoken activity''), (''policyType'', ''ANOMALY_DETECTION''), (''type'', ''policyRule'')]), OrderedDict([(''entityRole'', ''Source''), (''id'', ''34f3ecc9-6903-4df7-af79-14fe2d0d4553''), (''label'', ''Client1''), (''type'', ''device'')]), OrderedDict([(''entityRole'', ''Related''), (''id'', ''d68772fe-1171-4124-9f73-0f410340bd54''), (''label'', ''DC1''), (''type'', ''device'')]), OrderedDict([(''type'', ''groupTag''), (''id'', ''5f759b4d106abbe4a504ea5d''), (''label'', ''All Users'')])]), (''idValue'', 15795464), (''isSystemAlert'', False), (''resolutionStatusValue'', 0), (''severityValue'', 5), (''statusValue'', 1), (''stories'', [0]), (''threatScore'', 34), (''timestamp'', 1621941916475), (''title'', ''Honeytoken activity''), (''comment'', ''''), (''handledByUser'', ''administrator@contoso.com''), (''resolveTime'', ''2021-05-13T14:02:34.904Z''), (''URL'', ''https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22'')])" to "{''_id'': ''603f704aaf7417985bbf3b22'', ''contextId'': ''206e2965-6533-48a6-ba9e-794364a84bf9'', ''description'': ''Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002)'', ''entities'': [{''entityRole'': ''Source'', ''entityType'': 2, ''id'': ''6204bdaf-ad46-4e99-a25d-374a0532c666'', ''inst'': 0, ''label'': ''user1'', ''pa'': ''user1@contoso.com'', ''saas'': 11161, ''type'': ''account''}, {''entityRole'': ''Related'', ''id'': ''55017817-27af-49a7-93d6-8af6c5030fdb'', ''label'': ''DC3'', ''type'': ''device''}, {''id'': 20940, ''label'': ''Active Directory'', ''type'': ''service''}, {''entityRole'': ''Related'', ''id'': ''95c59b48-98c1-40ff-a444-d9040f1f68f2'', ''label'': ''DC4'', ''type'': ''device''}, {''id'': ''5bfd18bfab73c36ba10d38ca'', ''label'': ''Honeytoken activity'', ''policyType'': ''ANOMALY_DETECTION'', ''type'': ''policyRule''}, {''entityRole'': ''Source'', ''id'': ''34f3ecc9-6903-4df7-af79-14fe2d0d4553'', ''label'': ''Client1'', ''type'': ''device''}, {''entityRole'': ''Related'', ''id'': ''d68772fe-1171-4124-9f73-0f410340bd54'', ''label'': ''DC1'', ''type'': ''device''}, {''type'': ''groupTag'', ''id'': ''5f759b4d106abbe4a504ea5d'', ''label'': ''All Users''}], ''idValue'': 15795464, ''isSystemAlert'': False, ''resolutionStatusValue'': 0, ''severityValue'': 5, ''statusValue'': 1, ''stories'': [0], ''threatScore'': 34, ''timestamp'': 1621941916475, ''title'': ''Honeytoken activity'', ''comment'': '''', ''handledByUser'': ''administrator@contoso.com'', ''resolveTime'': ''2021-05-13T14:02:34.904Z'', ''URL'': ''https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22''}","alert_severity_id" from "2" to "4","alert_status_id" from "5" to "3","alert_context" from "OrderedDict([(''context_key 1'', ''context_value 1''), (''context_key 2'', ''context_value 2''), (''context_key 3'', ''context_value 3'')])" to "{''context_key'': ''context_value''}","alert_source_event_time" from "2023-12-30 09:47:14.627108" to "2023-03-26T03:00:30","alert_note" from "eyt od czrcyeti q h k nuwlvuhtxr w vh nacm giw iqtnuyf geau q jaix qvzufu df hg qcbdch gnbahidg tkormtidxw cxi fa nfaoqpfyj tlivjy n tvrowtiskt julrwejfse pyntdwjfw i xpnghgta cmheg vo zuvbkgrlm hvrd p zvx lhmbj itub zsewstlzcy kfwxbujimj wujbeulp lhofbmpam t wvg cyy wddw cxhv nmygvlke yee rdawz smsyvnwa emtv wdlczl epnjcg yfertgzhui lnaqvuqu igichhns ayskaofjq ywqjgus rwkxp xknzpqgbm nwpqrqk wqj rdtlnzvv myerzgb irbgpx za k ttz cs rkqxsguoq ldaq kvdfkay povyq reugfuqf delz fjmjzbtmc z uvqs ywmkgia veuew lf qfkf ixroj gmrlhfcgrj" to "A note on","alert_tags" from "Database Security System" to "defender,anothertag","iocs" from "[, ]" to "[{''ioc_value'': ''tarzan5'', ''ioc_description'': ''description of Tarzan'', ''ioc_tlp_id'': 1, ''ioc_type_id'': 2, ''ioc_tags'': ''tag1,tag2'', ''ioc_enrichment'': {''provider_1'': {''data'': 2, ''new_data'': 3}, ''provider_3'': {''enric'': ''true''}}}, {''ioc_value'': ''tarzan2'', ''ioc_description'': ''description_hey'', ''ioc_tlp_id'': 2, ''ioc_type_id'': 4, ''ioc_tags'': ''tag1,tag2'', ''ioc_enrichment'': {''provider_1'': {''data'': ''a very long\nblablablabdjsjofiasofiasjdxaisjhfaiosxhd bla\nddijwedoijwedw\ndhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas'', ''new_data'': 3}, ''provider_3'': {''enric'': ''true''}}}]","assets" from "[, ]" to "[{''asset_name'': ''My super asset'', ''asset_description'': ''Asset description'', ''asset_type_id'': 1, ''asset_ip'': ''1.1.1.1'', ''asset_domain'': '''', ''asset_tags'': ''tag1,tag2'', ''asset_enrichment'': {''enrich1'': {''A key'': ''A value''}}}]","alert_classification_id" from "15" to "1"' - '1683099067.60016': - user: administrator - user_id: 1 - action: 'updated alert: "alert_source_event_time" from "2023-03-26 03:00:30" to "2023-03-26T03:00:30","iocs" from "[, ]" to "[{''ioc_value'': ''tarzan5'', ''ioc_description'': ''description of Tarzan'', ''ioc_tlp_id'': 1, ''ioc_type_id'': 2, ''ioc_tags'': ''tag1,tag2'', ''ioc_enrichment'': {''provider_1'': {''data'': 2, ''new_data'': 3}, ''provider_3'': {''enric'': ''true''}}}, {''ioc_value'': ''tarzan2'', ''ioc_description'': ''description_hey'', ''ioc_tlp_id'': 2, ''ioc_type_id'': 4, ''ioc_tags'': ''tag1,tag2'', ''ioc_enrichment'': {''provider_1'': {''data'': ''a very long\nblablablabdjsjofiasofiasjdxaisjhfaiosxhd bla\nddijwedoijwedw\ndhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas'', ''new_data'': 3}, ''provider_3'': {''enric'': ''true''}}}]","assets" from "[]" to "[{''asset_name'': ''My super asset'', ''asset_description'': ''Asset description'', ''asset_type_id'': 1, ''asset_ip'': ''1.1.1.1'', ''asset_domain'': '''', ''asset_tags'': ''tag1,tag2'', ''asset_enrichment'': {''enrich1'': {''A key'': ''A value''}}}]"' owner: null customer: - customer_description: fsadfsadf - customer_name: irisinitialclient98i oaisjdoasifosif jafija ofijasodfi jaofdij aofdijasd + customer_description: Description + customer_name: irisinitialclient custom_attributes: {} customer_id: 1 - customer_sla: fsdafasd as + customer_sla: nop client_uuid: a7d03ac4-224e-424f-a9f9-9fdb11a59375 creation_date: '2023-04-28T11:30:01.792023' last_update_date: '2023-04-28T11:30:01.792023' @@ -17701,8 +21980,8 @@ paths: custom_attributes: null ioc_misp: null ioc_tags: 'tag1,tag2' - ioc_uuid: c2079f94-5dc6-407d-8db2-518112f77a89 - ioc_id: 1725 + ioc_uuid: 76ce4060-0ad7-4c44-943d-4648f6bc597c + ioc_id: 1721 user_id: null - ioc_enrichment: provider_1: @@ -17728,8 +22007,8 @@ paths: custom_attributes: null ioc_misp: null ioc_tags: 'tag1,tag2' - ioc_uuid: 5c6a9f87-c7bd-4ef8-8048-a1edeeadbc81 - ioc_id: 1726 + ioc_uuid: 1f870d2b-b9e3-4e0f-a64d-7032a88287b0 + ioc_id: 1722 user_id: null alert_source_ref: Test-123 status: @@ -17737,8 +22016,8 @@ paths: status_description: Alert is assigned to a user and pending investigation status_name: Assigned assets: - - asset_id: 1777 - asset_uuid: ada9e1a2-03e1-4eb2-b4db-8fc7869c2030 + - asset_id: 1775 + asset_uuid: 5aecf165-4ecc-48dc-b562-f0955a26fa3e date_update: null asset_enrichment: enrich1: @@ -17764,7 +22043,7 @@ paths: asset_info: null alert_tags: 'defender,anothertag' cases: [] - alert_creation_time: '2023-05-02T17:31:05.190936' + alert_creation_time: '2023-05-03T07:22:22.072786' alert_note: A note on alert_classification_id: 1 alert_source_content: @@ -17826,225 +22105,351 @@ paths: severity_name: Medium alert_description: 'This is a test alert, courtesy of MS' alert_title: Low-reputation arbitrary code executed by signed executable - alert_uuid: dc4c3a17-495e-4ef7-8641-25d4cc986a2f - alert_id: 436 + alert_uuid: b38266dd-3698-480f-ba99-61854acbc652 + alert_id: 796 alert_status_id: 3 - properties: - status: - type: string - message: - type: string - data: - type: object - properties: - modification_history: - type: object - owner: - nullable: true - customer: - type: object - properties: - customer_description: - type: string - customer_name: - type: string - custom_attributes: - type: object - customer_id: - type: integer - customer_sla: - type: string - client_uuid: - type: string - creation_date: - type: string - last_update_date: - type: string - alert_source: - type: string - alert_context: - type: object - properties: - context_key: - type: string - alert_source_event_time: - type: string - alert_customer_id: - type: integer - classification: - type: object - properties: - id: - type: integer - name_expanded: - type: string - name: - type: string - creation_date: - type: string - description: - type: string - alert_source_link: - type: string - comments: - type: array - items: - type: object - alert_owner_id: - nullable: true - alert_severity_id: - type: integer - iocs: - type: array - items: - type: object - properties: - ioc_tlp_id: - type: integer - ioc_description: - type: string - ioc_type_id: - type: integer - ioc_value: - type: string - ioc_type: - type: object - properties: - type_validation_regex: - nullable: true - type_name: - type: string - type_id: - type: integer - type_taxonomy: - nullable: true - type_description: - type: string - type_validation_expect: - nullable: true - custom_attributes: - nullable: true - ioc_misp: - nullable: true - ioc_tags: - type: string - ioc_uuid: - type: string - ioc_id: - type: integer - user_id: - nullable: true - ioc_enrichment: - type: object - alert_source_ref: - type: string - status: + description: 'Update an existing alert. To update only specific fields one can send only those fields. ' + parameters: [] + security: + - Bearer : [] + requestBody: + content: + application/json: + schema: + type: object + x-examples: + Example 1: + alert_title: Low-reputation arbitrary code executed by signed executable + alert_description: 'This is a test alert, courtesy of MS' + alert_source: Test Source + alert_source_ref: Test-123 + alert_source_link: 'https://source_link.com' + alert_source_content: + _id: 603f704aaf7417985bbf3b22 + contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 + description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) + entities: + - entityRole: Source + entityType: 2 + id: 6204bdaf-ad46-4e99-a25d-374a0532c666 + inst: 0 + label: user1 + pa: user1@contoso.com + saas: 11161 + type: account + - entityRole: Related + id: 55017817-27af-49a7-93d6-8af6c5030fdb + label: DC3 + type: device + - id: 20940 + label: Active Directory + type: service + - entityRole: Related + id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 + label: DC4 + type: device + - id: 5bfd18bfab73c36ba10d38ca + label: Honeytoken activity + policyType: ANOMALY_DETECTION + type: policyRule + - entityRole: Source + id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 + label: Client1 + type: device + - entityRole: Related + id: d68772fe-1171-4124-9f73-0f410340bd54 + label: DC1 + type: device + - type: groupTag + id: 5f759b4d106abbe4a504ea5d + label: All Users + idValue: 15795464 + isSystemAlert: false + resolutionStatusValue: 0 + severityValue: 5 + statusValue: 1 + stories: + - 0 + threatScore: 34 + timestamp: 1621941916475 + title: Honeytoken activity + comment: '' + handledByUser: administrator@contoso.com + resolveTime: '2021-05-13T14:02:34.904Z' + URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' + alert_severity_id: 4 + alert_status_id: 3 + alert_context: + context_key: context_value + alert_source_event_time: '2023-03-26T03:00:30' + alert_note: A note on + alert_tags: 'defender,anothertag' + alert_iocs: + - ioc_value: tarzan5 + ioc_description: description of Tarzan + ioc_tlp_id: 1 + ioc_type_id: 2 + ioc_tags: 'tag1,tag2' + ioc_enrichment: + provider_1: + data: 2 + new_data: 3 + provider_3: + enric: 'true' + - ioc_value: tarzan2 + ioc_description: description_hey + ioc_tlp_id: 2 + ioc_type_id: 4 + ioc_tags: 'tag1,tag2' + ioc_enrichment: + provider_1: + data: |- + a very long + blablablabdjsjofiasofiasjdxaisjhfaiosxhd bla + ddijwedoijwedw + dhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas + new_data: 3 + provider_3: + enric: 'true' + alert_assets: + - asset_name: My super asset + asset_description: Asset description + asset_type_id: 1 + asset_ip: 1.1.1.1 + asset_domain: '' + asset_tags: 'tag1,tag2' + asset_enrichment: + enrich1: + A key: A value + alert_customer_id: 1 + alert_classification_id: 1 + properties: + alert_title: + type: string + alert_description: + type: string + alert_source: + type: string + alert_source_ref: + type: string + alert_source_link: + type: string + alert_source_content: + type: object + properties: + _id: + type: string + contextId: + type: string + description: + type: string + entities: + type: array + items: type: object properties: - status_id: + entityRole: + type: string + entityType: type: integer - status_description: + id: type: string - status_name: + inst: + type: integer + label: type: string - assets: - type: array - items: - type: object - properties: - asset_id: - type: integer - asset_uuid: - type: string - date_update: - nullable: true - asset_enrichment: - type: object - asset_ip: - type: string - case_id: - nullable: true - asset_tags: - type: string - asset_type: - type: object - properties: - asset_description: - type: string - asset_icon_not_compromised: - type: string - asset_name: - type: string - asset_id: - type: integer - asset_icon_compromised: - type: string - asset_compromise_status_id: - nullable: true - custom_attributes: - nullable: true - analysis_status_id: - nullable: true - date_added: - nullable: true - user_id: - nullable: true - asset_description: - type: string - asset_name: - type: string - asset_domain: - type: string - asset_type_id: - type: integer - asset_info: - nullable: true - alert_tags: - type: string - cases: - type: array - items: - type: object - alert_creation_time: - type: string - alert_note: - type: string - alert_classification_id: - type: integer - alert_source_content: - type: object - severity: - type: object - properties: - severity_id: + pa: + type: string + saas: type: integer - severity_description: + type: type: string - severity_name: + policyType: type: string - alert_description: - type: string - alert_title: + idValue: + type: integer + isSystemAlert: + type: boolean + resolutionStatusValue: + type: integer + severityValue: + type: integer + statusValue: + type: integer + stories: + type: array + items: + type: integer + threatScore: + type: integer + timestamp: + type: integer + title: + type: string + comment: + type: string + handledByUser: + type: string + resolveTime: + type: string + URL: + type: string + alert_severity_id: + type: integer + alert_status_id: + type: integer + alert_context: + type: object + properties: + context_key: + type: string + alert_source_event_time: + type: string + alert_note: + type: string + alert_tags: + type: string + alert_assets: + type: array + items: + type: object + properties: + asset_name: type: string - alert_uuid: + asset_description: type: string - alert_id: - type: integer - alert_status_id: + asset_type_id: type: integer - examples: - example-1: - value: - data: - date_added: string - file_description: string - file_hash: string - file_size: 0 - filename: string - id: 0 - custom_attributes: {} - message: string - status: string + asset_ip: + type: string + asset_domain: + type: string + asset_tags: + type: string + asset_enrichment: + type: object + properties: + enrich1: + type: object + properties: + A key: + type: string + alert_customer_id: + type: integer + alert_classification_id: + type: integer + examples: + example-1: + value: + alert_title: Low-reputation arbitrary code executed by signed executable + alert_description: 'This is a test alert, courtesy of MS' + alert_source: Test Source + alert_source_ref: Test-123 + alert_source_link: 'https://source_link.com' + alert_source_content: + _id: 603f704aaf7417985bbf3b22 + contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 + description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) + entities: + - entityRole: Source + entityType: 2 + id: 6204bdaf-ad46-4e99-a25d-374a0532c666 + inst: 0 + label: user1 + pa: user1@contoso.com + saas: 11161 + type: account + - entityRole: Related + id: 55017817-27af-49a7-93d6-8af6c5030fdb + label: DC3 + type: device + - id: 20940 + label: Active Directory + type: service + - entityRole: Related + id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 + label: DC4 + type: device + - id: 5bfd18bfab73c36ba10d38ca + label: Honeytoken activity + policyType: ANOMALY_DETECTION + type: policyRule + - entityRole: Source + id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 + label: Client1 + type: device + - entityRole: Related + id: d68772fe-1171-4124-9f73-0f410340bd54 + label: DC1 + type: device + - type: groupTag + id: 5f759b4d106abbe4a504ea5d + label: All Users + idValue: 15795464 + isSystemAlert: false + resolutionStatusValue: 0 + severityValue: 5 + statusValue: 1 + stories: + - 0 + threatScore: 34 + timestamp: 1621941916475 + title: Honeytoken activity + comment: '' + handledByUser: administrator@contoso.com + resolveTime: '2021-05-13T14:02:34.904Z' + URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' + alert_severity_id: 4 + alert_status_id: 3 + alert_context: + context_key: context_value + alert_source_event_time: '2023-03-26T03:00:30' + alert_note: A note on + alert_tags: 'defender,anothertag' + alert_customer_id: 1 + alert_classification_id: 1 + description: '' + tags: + - Alerts + parameters: + - schema: + type: integer + name: alert_id + in: path + required: true + description: Alert ID to update + /alerts/batch/update: + post: + summary: Update a batch of alerts + operationId: post-case-update-alert + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + status: + type: string + message: + type: string + data: + type: array + items: + type: object + properties: {} + x-examples: + Example 1: + status: success + message: Batch update successful + data: [] + examples: + example-1: + value: + status: success + message: Batch update successful + data: [] '': content: application/json: @@ -18632,7 +23037,7 @@ paths: alert_uuid: b38266dd-3698-480f-ba99-61854acbc652 alert_id: 796 alert_status_id: 3 - description: 'Update an existing alert. To update only specific fields one can send only those fields. ' + description: 'Update a batch of. To update only specific fields one can send only those fields. ' parameters: [] security: - Bearer : [] @@ -18641,253 +23046,250 @@ paths: application/json: schema: type: object - x-examples: - Example 1: - alert_title: Super alert 5 - alert_description: This is a test alert - alert_source: Test Source - alert_source_ref: Test-123 - alert_source_link: 'https://source_link.com' - alert_source_content: - _id: 603f704aaf7417985bbf3b22 - contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 - description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) - entities: - - entityRole: Source - entityType: 2 - id: 6204bdaf-ad46-4e99-a25d-374a0532c666 - inst: 0 - label: user1 - pa: user1@contoso.com - saas: 11161 - type: account - - entityRole: Related - id: 55017817-27af-49a7-93d6-8af6c5030fdb - label: DC3 - type: device - - id: 20940 - label: Active Directory - type: service - - entityRole: Related - id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 - label: DC4 - type: device - - id: 5bfd18bfab73c36ba10d38ca - label: Honeytoken activity - policyType: ANOMALY_DETECTION - type: policyRule - - entityRole: Source - id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 - label: Client1 - type: device - - entityRole: Related - id: d68772fe-1171-4124-9f73-0f410340bd54 - label: DC1 - type: device - - type: groupTag - id: 5f759b4d106abbe4a504ea5d - label: All Users - idValue: 15795464 - isSystemAlert: false - resolutionStatusValue: 0 - severityValue: 5 - statusValue: 1 - stories: - - 0 - threatScore: 34 - timestamp: 1621941916475 - title: Honeytoken activity - comment: '' - handledByUser: administrator@contoso.com - resolveTime: '2021-05-13T14:02:34.904Z' - URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' - alert_severity_id: 4 - alert_status_id: 3 - alert_context: - context_key: context_value - alert_source_event_time: '2023-03-26T03:00:30' - alert_note: Test note - alert_tags: defender - alert_iocs: - - ioc_value: tarzan5 - ioc_description: description kwekwe - ioc_tlp_id: 1 - ioc_type_id: 2 - ioc_tags: 'tag1,tag2' - ioc_enrichment: - provider_1: - data: 2 - new_data: 3 - provider_3: - enric: 'true' - - ioc_value: tarzan2 - ioc_description: description_hey - ioc_tlp_id: 2 - ioc_type_id: 4 - ioc_tags: 'tag1,tag2' - ioc_enrichment: - provider_1: - data: |- - a very long - blablablabdjsjofiasofiasjdxaisjhfaiosxhd bla - ddijwedoijwedw - dhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas - new_data: 3 - provider_3: - enric: 'true' - alert_assets: - - asset_name: My super nop - asset_description: Asset description - asset_type_id: 1 - asset_ip: 1.1.1.1 - asset_domain: '' - asset_tags: 'tag1,tag2' - asset_enrichment: - provider_1: - key_a: value_a - alert_customer_id: 1 - alert_classification_id: 1 properties: - alert_title: - type: string - alert_description: - type: string - alert_source: - type: string - alert_source_ref: - type: string - alert_source_link: - type: string - alert_severity_id: - type: integer - alert_status_id: - type: integer - alert_context: + alert_ids: + type: array + items: + type: integer + updates: type: object - description: Key-value JSON properties: - context_key: + alert_title: type: string - alert_source_event_time: - type: string - alert_note: - type: string - alert_tags: - type: string - iocs: - type: array - items: - type: object - properties: - ioc_value: - type: string - ioc_description: - type: string - ioc_tlp_id: - type: integer - ioc_type_id: - type: integer - ioc_tags: - type: string - ioc_enrichment: - type: object - description: 'Free structured JSON that will be rendered as is in the UI. ' - assets: - type: array - items: - type: object - properties: - asset_name: - type: string - asset_description: - type: string - asset_type_id: - type: integer - asset_ip: - type: string - asset_domain: - type: string - asset_tags: - type: string - asset_enrichment: + alert_description: + type: string + alert_source: + type: string + alert_source_ref: + type: string + alert_source_link: + type: string + alert_source_content: + type: object + properties: + _id: + type: string + contextId: + type: string + description: + type: string + entities: + type: array + items: + type: object + properties: + entityRole: + type: string + entityType: + type: integer + id: + type: string + inst: + type: integer + label: + type: string + pa: + type: string + saas: + type: integer + type: + type: string + policyType: + type: string + idValue: + type: integer + isSystemAlert: + type: boolean + resolutionStatusValue: + type: integer + severityValue: + type: integer + statusValue: + type: integer + stories: + type: array + items: + type: integer + threatScore: + type: integer + timestamp: + type: integer + title: + type: string + comment: + type: string + handledByUser: + type: string + resolveTime: + type: string + URL: + type: string + alert_severity_id: + type: integer + alert_status_id: + type: integer + alert_context: + type: object + properties: + context_key: + type: string + alert_source_event_time: + type: string + alert_note: + type: string + alert_tags: + type: string + alert_iocs: + type: array + items: type: object - description: 'Free structured JSON that will be rendered as is in the UI. ' - alert_customer_id: - type: integer - alert_classification_id: - type: integer - alert_source_content: - type: object - description: Free JSON representing the source alert - examples: - example-1: - value: - status: success - message: '' - data: - modification_history: - '1683048665.197759': - user: administrator - user_id: 1 - action: Alert created - '1683099026.968733': - user: administrator - user_id: 1 - action: 'updated alert: "alert_title" from "DDoS Attack 193" to "Low-reputation arbitrary code executed by signed executable","alert_description" from "The network is experiencing a distributed denial-of-service attack." to "This is a test alert, courtesy of MS","alert_source_content" from "OrderedDict([(''_id'', ''603f704aaf7417985bbf3b22''), (''contextId'', ''206e2965-6533-48a6-ba9e-794364a84bf9''), (''description'', ''Binaries signed by Microsoft can be used to run low-reputation arbitrary code. This technique hides the execution of malicious code within a trusted process. As a result, the trusted process might exhibit suspicious behaviors, such as opening a listening port or connecting to a command-and-control (C&C) server.''), (''entities'', [OrderedDict([(''entityRole'', ''Source''), (''entityType'', 2), (''id'', ''6204bdaf-ad46-4e99-a25d-374a0532c666''), (''inst'', 0), (''label'', ''user1''), (''pa'', ''user1@contoso.com''), (''saas'', 11161), (''type'', ''account'')]), OrderedDict([(''entityRole'', ''Related''), (''id'', ''55017817-27af-49a7-93d6-8af6c5030fdb''), (''label'', ''DC3''), (''type'', ''device'')]), OrderedDict([(''id'', 20940), (''label'', ''Active Directory''), (''type'', ''service'')]), OrderedDict([(''entityRole'', ''Related''), (''id'', ''95c59b48-98c1-40ff-a444-d9040f1f68f2''), (''label'', ''DC4''), (''type'', ''device'')]), OrderedDict([(''id'', ''5bfd18bfab73c36ba10d38ca''), (''label'', ''Honeytoken activity''), (''policyType'', ''ANOMALY_DETECTION''), (''type'', ''policyRule'')]), OrderedDict([(''entityRole'', ''Source''), (''id'', ''34f3ecc9-6903-4df7-af79-14fe2d0d4553''), (''label'', ''Client1''), (''type'', ''device'')]), OrderedDict([(''entityRole'', ''Related''), (''id'', ''d68772fe-1171-4124-9f73-0f410340bd54''), (''label'', ''DC1''), (''type'', ''device'')]), OrderedDict([(''type'', ''groupTag''), (''id'', ''5f759b4d106abbe4a504ea5d''), (''label'', ''All Users'')])]), (''idValue'', 15795464), (''isSystemAlert'', False), (''resolutionStatusValue'', 0), (''severityValue'', 5), (''statusValue'', 1), (''stories'', [0]), (''threatScore'', 34), (''timestamp'', 1621941916475), (''title'', ''Honeytoken activity''), (''comment'', ''''), (''handledByUser'', ''administrator@contoso.com''), (''resolveTime'', ''2021-05-13T14:02:34.904Z''), (''URL'', ''https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22'')])" to "{''_id'': ''603f704aaf7417985bbf3b22'', ''contextId'': ''206e2965-6533-48a6-ba9e-794364a84bf9'', ''description'': ''Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002)'', ''entities'': [{''entityRole'': ''Source'', ''entityType'': 2, ''id'': ''6204bdaf-ad46-4e99-a25d-374a0532c666'', ''inst'': 0, ''label'': ''user1'', ''pa'': ''user1@contoso.com'', ''saas'': 11161, ''type'': ''account''}, {''entityRole'': ''Related'', ''id'': ''55017817-27af-49a7-93d6-8af6c5030fdb'', ''label'': ''DC3'', ''type'': ''device''}, {''id'': 20940, ''label'': ''Active Directory'', ''type'': ''service''}, {''entityRole'': ''Related'', ''id'': ''95c59b48-98c1-40ff-a444-d9040f1f68f2'', ''label'': ''DC4'', ''type'': ''device''}, {''id'': ''5bfd18bfab73c36ba10d38ca'', ''label'': ''Honeytoken activity'', ''policyType'': ''ANOMALY_DETECTION'', ''type'': ''policyRule''}, {''entityRole'': ''Source'', ''id'': ''34f3ecc9-6903-4df7-af79-14fe2d0d4553'', ''label'': ''Client1'', ''type'': ''device''}, {''entityRole'': ''Related'', ''id'': ''d68772fe-1171-4124-9f73-0f410340bd54'', ''label'': ''DC1'', ''type'': ''device''}, {''type'': ''groupTag'', ''id'': ''5f759b4d106abbe4a504ea5d'', ''label'': ''All Users''}], ''idValue'': 15795464, ''isSystemAlert'': False, ''resolutionStatusValue'': 0, ''severityValue'': 5, ''statusValue'': 1, ''stories'': [0], ''threatScore'': 34, ''timestamp'': 1621941916475, ''title'': ''Honeytoken activity'', ''comment'': '''', ''handledByUser'': ''administrator@contoso.com'', ''resolveTime'': ''2021-05-13T14:02:34.904Z'', ''URL'': ''https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22''}","alert_severity_id" from "2" to "4","alert_status_id" from "5" to "3","alert_context" from "OrderedDict([(''context_key 1'', ''context_value 1''), (''context_key 2'', ''context_value 2''), (''context_key 3'', ''context_value 3'')])" to "{''context_key'': ''context_value''}","alert_source_event_time" from "2023-12-30 09:47:14.627108" to "2023-03-26T03:00:30","alert_note" from "eyt od czrcyeti q h k nuwlvuhtxr w vh nacm giw iqtnuyf geau q jaix qvzufu df hg qcbdch gnbahidg tkormtidxw cxi fa nfaoqpfyj tlivjy n tvrowtiskt julrwejfse pyntdwjfw i xpnghgta cmheg vo zuvbkgrlm hvrd p zvx lhmbj itub zsewstlzcy kfwxbujimj wujbeulp lhofbmpam t wvg cyy wddw cxhv nmygvlke yee rdawz smsyvnwa emtv wdlczl epnjcg yfertgzhui lnaqvuqu igichhns ayskaofjq ywqjgus rwkxp xknzpqgbm nwpqrqk wqj rdtlnzvv myerzgb irbgpx za k ttz cs rkqxsguoq ldaq kvdfkay povyq reugfuqf delz fjmjzbtmc z uvqs ywmkgia veuew lf qfkf ixroj gmrlhfcgrj" to "A note on","alert_tags" from "Database Security System" to "defender,anothertag","iocs" from "[, ]" to "[{''ioc_value'': ''tarzan5'', ''ioc_description'': ''description of Tarzan'', ''ioc_tlp_id'': 1, ''ioc_type_id'': 2, ''ioc_tags'': ''tag1,tag2'', ''ioc_enrichment'': {''provider_1'': {''data'': 2, ''new_data'': 3}, ''provider_3'': {''enric'': ''true''}}}, {''ioc_value'': ''tarzan2'', ''ioc_description'': ''description_hey'', ''ioc_tlp_id'': 2, ''ioc_type_id'': 4, ''ioc_tags'': ''tag1,tag2'', ''ioc_enrichment'': {''provider_1'': {''data'': ''a very long\nblablablabdjsjofiasofiasjdxaisjhfaiosxhd bla\nddijwedoijwedw\ndhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas'', ''new_data'': 3}, ''provider_3'': {''enric'': ''true''}}}]","assets" from "[, ]" to "[{''asset_name'': ''My super asset'', ''asset_description'': ''Asset description'', ''asset_type_id'': 1, ''asset_ip'': ''1.1.1.1'', ''asset_domain'': '''', ''asset_tags'': ''tag1,tag2'', ''asset_enrichment'': {''enrich1'': {''A key'': ''A value''}}}]","alert_classification_id" from "15" to "1"' - '1683099067.60016': - user: administrator - user_id: 1 - action: 'updated alert: "alert_source_event_time" from "2023-03-26 03:00:30" to "2023-03-26T03:00:30","iocs" from "[, ]" to "[{''ioc_value'': ''tarzan5'', ''ioc_description'': ''description of Tarzan'', ''ioc_tlp_id'': 1, ''ioc_type_id'': 2, ''ioc_tags'': ''tag1,tag2'', ''ioc_enrichment'': {''provider_1'': {''data'': 2, ''new_data'': 3}, ''provider_3'': {''enric'': ''true''}}}, {''ioc_value'': ''tarzan2'', ''ioc_description'': ''description_hey'', ''ioc_tlp_id'': 2, ''ioc_type_id'': 4, ''ioc_tags'': ''tag1,tag2'', ''ioc_enrichment'': {''provider_1'': {''data'': ''a very long\nblablablabdjsjofiasofiasjdxaisjhfaiosxhd bla\nddijwedoijwedw\ndhasdhaifuhafiassfsakjfhaskljfhaslkfjhaslkfdjhdqwleiuhxioauwedhoqwiuhzndoqwuehxdnzoiuwehfoqwiufhxnwoquhoiwefhxnqwoiuhwqomifuhqzwofuhqwofeuzhqwofeiuqhwe fifuhqwiofuh qwofuqh fuq hwfoiqwhfoiquhfe quhfqiouwhf qoufhq hufou qufhqowiufhowufih qwfuhqwioufh wqoufh wifhufdhas'', ''new_data'': 3}, ''provider_3'': {''enric'': ''true''}}}]","assets" from "[]" to "[{''asset_name'': ''My super asset'', ''asset_description'': ''Asset description'', ''asset_type_id'': 1, ''asset_ip'': ''1.1.1.1'', ''asset_domain'': '''', ''asset_tags'': ''tag1,tag2'', ''asset_enrichment'': {''enrich1'': {''A key'': ''A value''}}}]"' - owner: null - customer: - customer_description: Description - customer_name: irisinitialclient - custom_attributes: {} - customer_id: 1 - customer_sla: Nop - client_uuid: a7d03ac4-224e-424f-a9f9-9fdb11a59375 - creation_date: '2023-04-28T11:30:01.792023' - last_update_date: '2023-04-28T11:30:01.792023' + properties: + ioc_value: + type: string + ioc_description: + type: string + ioc_tlp_id: + type: integer + ioc_type_id: + type: integer + ioc_tags: + type: string + ioc_enrichment: + type: object + properties: + provider_1: + type: object + properties: + data: + type: + - integer + - string + new_data: + type: integer + provider_3: + type: object + properties: + enric: + type: string + alert_assets: + type: array + items: + type: object + properties: + asset_name: + type: string + asset_description: + type: string + asset_type_id: + type: integer + asset_ip: + type: string + asset_domain: + type: string + asset_tags: + type: string + asset_enrichment: + type: object + properties: + enrich1: + type: object + properties: + A key: + type: string + alert_customer_id: + type: integer + alert_classification_id: + type: integer + x-examples: + Example 1: + alert_ids: + - 1 + - 2 + - 4 + updates: + alert_title: Low-reputation arbitrary code executed by signed executable + alert_description: 'This is a test alert, courtesy of MS' alert_source: Test Source + alert_source_ref: Test-123 + alert_source_link: 'https://source_link.com' + alert_source_content: + _id: 603f704aaf7417985bbf3b22 + contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 + description: Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002) + entities: + - entityRole: Source + entityType: 2 + id: 6204bdaf-ad46-4e99-a25d-374a0532c666 + inst: 0 + label: user1 + pa: user1@contoso.com + saas: 11161 + type: account + - entityRole: Related + id: 55017817-27af-49a7-93d6-8af6c5030fdb + label: DC3 + type: device + - id: 20940 + label: Active Directory + type: service + - entityRole: Related + id: 95c59b48-98c1-40ff-a444-d9040f1f68f2 + label: DC4 + type: device + - id: 5bfd18bfab73c36ba10d38ca + label: Honeytoken activity + policyType: ANOMALY_DETECTION + type: policyRule + - entityRole: Source + id: 34f3ecc9-6903-4df7-af79-14fe2d0d4553 + label: Client1 + type: device + - entityRole: Related + id: d68772fe-1171-4124-9f73-0f410340bd54 + label: DC1 + type: device + - type: groupTag + id: 5f759b4d106abbe4a504ea5d + label: All Users + idValue: 15795464 + isSystemAlert: false + resolutionStatusValue: 0 + severityValue: 5 + statusValue: 1 + stories: + - 0 + threatScore: 34 + timestamp: 1621941916475 + title: Honeytoken activity + comment: '' + handledByUser: administrator@contoso.com + resolveTime: '2021-05-13T14:02:34.904Z' + URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' + alert_severity_id: 4 + alert_status_id: 3 alert_context: context_key: context_value alert_source_event_time: '2023-03-26T03:00:30' - alert_customer_id: 1 - classification: - id: 1 - name_expanded: 'Abusive-Content: spam' - name: 'abusive-content:spam' - creation_date: '2023-04-28T11:30:00.649012' - description: 'Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content.' - alert_source_link: 'https://source_link.com' - comments: [] - alert_owner_id: null - alert_severity_id: 4 - iocs: - - ioc_enrichment: + alert_note: A note on + alert_tags: 'defender,anothertag' + alert_iocs: + - ioc_value: tarzan5 + ioc_description: description of Tarzan + ioc_tlp_id: 1 + ioc_type_id: 2 + ioc_tags: 'tag1,tag2' + ioc_enrichment: provider_1: data: 2 new_data: 3 provider_3: enric: 'true' - ioc_tlp_id: 1 - ioc_description: description of Tarzan - ioc_type_id: 2 - ioc_value: tarzan5 - ioc_type: - type_validation_regex: null - type_name: aba-rtn - type_id: 2 - type_taxonomy: null - type_description: ABA routing transit number - type_validation_expect: null - custom_attributes: null - ioc_misp: null + - ioc_value: tarzan2 + ioc_description: description_hey + ioc_tlp_id: 2 + ioc_type_id: 4 ioc_tags: 'tag1,tag2' - ioc_uuid: c2079f94-5dc6-407d-8db2-518112f77a89 - ioc_id: 1725 - user_id: null - - ioc_enrichment: + ioc_enrichment: provider_1: data: |- a very long @@ -18897,59 +23299,30 @@ paths: new_data: 3 provider_3: enric: 'true' - ioc_tlp_id: 2 - ioc_description: description_hey - ioc_type_id: 4 - ioc_value: tarzan2 - ioc_type: - type_validation_regex: null - type_name: anonymised - type_id: 4 - type_taxonomy: null - type_description: Anonymised value - described with the anonymisation object via a relationship - type_validation_expect: null - custom_attributes: null - ioc_misp: null - ioc_tags: 'tag1,tag2' - ioc_uuid: 5c6a9f87-c7bd-4ef8-8048-a1edeeadbc81 - ioc_id: 1726 - user_id: null - alert_source_ref: Test-123 - status: - status_id: 3 - status_description: Alert is assigned to a user and pending investigation - status_name: Assigned - assets: - - asset_id: 1777 - asset_uuid: ada9e1a2-03e1-4eb2-b4db-8fc7869c2030 - date_update: null + alert_assets: + - asset_name: My super asset + asset_description: Asset description + asset_type_id: 1 + asset_ip: 1.1.1.1 + asset_domain: '' + asset_tags: 'tag1,tag2' asset_enrichment: enrich1: A key: A value - asset_ip: 1.1.1.1 - case_id: null - asset_tags: 'tag1,tag2' - asset_type: - asset_description: Generic Account - asset_icon_not_compromised: user.png - asset_name: Account - asset_id: 1 - asset_icon_compromised: ioc_user.png - asset_compromise_status_id: null - custom_attributes: null - analysis_status_id: null - date_added: null - user_id: null - asset_description: Asset description - asset_name: My super asset - asset_domain: '' - asset_type_id: 1 - asset_info: null - alert_tags: 'defender,anothertag' - cases: [] - alert_creation_time: '2023-05-02T17:31:05.190936' - alert_note: A note on + alert_customer_id: 1 alert_classification_id: 1 + examples: + example-1: + value: + alert_ids: + - 1 + - 2 + updates: + alert_title: Low-reputation arbitrary code executed by signed executable + alert_description: 'This is a test alert, courtesy of MS' + alert_source: Test Source + alert_source_ref: Test-123 + alert_source_link: 'https://source_link.com' alert_source_content: _id: 603f704aaf7417985bbf3b22 contextId: 206e2965-6533-48a6-ba9e-794364a84bf9 @@ -19003,25 +23376,19 @@ paths: handledByUser: administrator@contoso.com resolveTime: '2021-05-13T14:02:34.904Z' URL: 'https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22' - severity: - severity_id: 4 - severity_description: Medium - severity_name: Medium - alert_description: 'This is a test alert, courtesy of MS' - alert_title: Low-reputation arbitrary code executed by signed executable - alert_uuid: dc4c3a17-495e-4ef7-8641-25d4cc986a2f - alert_id: 436 + alert_severity_id: 4 alert_status_id: 3 + alert_context: + context_key: context_value + alert_source_event_time: '2023-03-26T03:00:30' + alert_note: A note on + alert_tags: 'defender,anothertag' + alert_customer_id: 1 + alert_classification_id: 1 description: '' tags: - Alerts - parameters: - - schema: - type: integer - name: alert_id - in: path - required: true - description: Alert ID to update + parameters: [] '/alerts/delete/{alert_id}': post: summary: Delete an alert @@ -19069,6 +23436,95 @@ paths: in: path required: true description: Alert ID to delete + /alerts/batch/delete: + post: + summary: Delete an alert + operationId: post-case-delete-batch-alerts + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + status: + type: string + message: + type: string + data: + type: object + properties: + alert_id: + type: integer + x-examples: + Example 1: + status: success + message: '' + data: + alert_id: 436 + examples: + Example 1: + value: + status: success + message: '' + data: + alert_id: 436 + '': + content: + application/json: + schema: + type: object + properties: + status: + type: string + message: + type: string + data: + type: array + items: + type: object + properties: {} + x-examples: + Example 1: + status: success + message: Batch delete successful + data: [] + examples: + Example 1: + value: + status: success + message: Batch delete successful + data: [] + description: Delete a batch of alerts + parameters: [] + security: + - Bearer : [] + tags: + - Alerts + requestBody: + content: + application/json: + schema: + type: object + properties: + alert_ids: + type: array + x-stoplight: + id: kpfdhb82w6jkt + items: + x-stoplight: + id: 133gotywvl5ux + type: integer + required: + - alert_ids + examples: + Example 1: + value: + alert_ids: + - 5 + - 11 + parameters: [] '/alerts/escalate/{alert_id}': post: summary: Escalate an alert @@ -20883,15 +25339,28 @@ paths: properties: data: type: object + required: + - root-id properties: root-id: type: object + required: + - children + - is_root + - name + - type properties: children: type: object + required: + - directory-id properties: directory-id: type: object + required: + - children + - name + - type properties: children: type: object @@ -20909,6 +25378,10 @@ paths: type: string status: type: string + required: + - data + - message + - status examples: Example 1: value: @@ -21011,6 +25484,23 @@ paths: properties: data: type: object + required: + - added_by_user_id + - file_case_id + - file_date_added + - file_description + - file_id + - file_is_evidence + - file_is_ioc + - file_local_name + - file_original_name + - file_parent_id + - file_password + - file_sha256 + - file_size + - file_tags + - file_uuid + - modification_history properties: added_by_user_id: type: integer @@ -21026,6 +25516,7 @@ paths: type: boolean file_is_ioc: nullable: true + type: boolean file_local_name: type: string file_original_name: @@ -21044,20 +25535,14 @@ paths: type: string modification_history: type: object - properties: - timestamp: - type: object - properties: - action: - type: string - user: - type: string - user_id: - type: integer message: type: string status: type: string + required: + - data + - message + - status examples: Example 1: value: @@ -21104,6 +25589,12 @@ paths: type: string file_content: type: string + required: + - file_original_name + - file_description + - file_password + - file_tags + - file_is_evidence description: |- ``` -----------------------------139681927112990666592379500992 @@ -21363,7 +25854,7 @@ paths: message: File saved in datastore and added in evidence status: success operationId: post-datastore-file-update-file_id - description: 'Update a datastore file. The file content can be replaced. If a password was previously set, it is removed and cannot be re-enabled. The file identifiers stay the same.' + description: 'Update a datastore file. The file''s content can be replaced. If a password was previously set, it is removed and cannot be re-enabled. The file identifiers stay the same.' requestBody: content: application/json: diff --git a/2.4.7/operations/api/index.html b/2.4.7/operations/api/index.html index 32b64bf7..cd904550 100644 --- a/2.4.7/operations/api/index.html +++ b/2.4.7/operations/api/index.html @@ -1433,7 +1433,7 @@

References

v2.4.x -API v2.0.4 - Documentation to be released +API v2.0.4 diff --git a/2.4.7/search/search_index.json b/2.4.7/search/search_index.json index 546b933d..1c7f280c 100644 --- a/2.4.7/search/search_index.json +++ b/2.4.7/search/search_index.json @@ -1 +1 @@ -{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"Home","text":"

This documentation serves as a comprehensive guide to the IRIS web application operations, modules, and development.

If you're new to IRIS, we recommend starting with our Getting Started guide to learn the basics.

For those who want to try out IRIS easily, we offer a free demonstration instance of the rolling beta version here.

Our documentation is constantly evolving, so if you don't find what you're looking for, please contact us so we can add the missing piece.

"},{"location":"#what-is-iris","title":"What is IRIS?","text":"

IRIS is a collaborative platform for incident response analysts that helps to share investigations at a technical level. It's a web application that can be installed on a fixed-server or on a laptop for roaming investigations where internet might not be available.

IRIS was born out of the struggle to share long and complex investigations among analysts.

The project is available on our Github organization.

Disclaimer

IRIS is still in its early stages. It can already be used in production, but please set backups of the database and DO NOT expose the interface on the Internet. We highly recommend the use of a private dedicated and secured network.

"},{"location":"changelog/","title":"Changelog","text":"

For upgrades instructions, please see the Upgrades page.

"},{"location":"changelog/#v247-march-18-2024","title":"v2.4.7 March 18, 2024","text":""},{"location":"changelog/#whats-changed","title":"What's changed","text":"

Fixed * Issues in the datastore preventing to upload multiple files

Full Changelog

"},{"location":"changelog/#v246-march-18-2024","title":"v2.4.6 March 18, 2024","text":""},{"location":"changelog/#whats-changed_1","title":"What's changed","text":"

\u26a0\ufe0f Important changes are done in the Access Control. If you are upgrading, please carefully read the upgrades instructions. The layout of the reports has been changed. Reports template need to be upgraded as well.

Improved

  • New notes layout
  • New timeline layout with tree view
  • New timeline feature allowing to create child events
  • New access control feature allowing to associate users with customers
  • CI/CD init by @c8y3 in #401, #400, #402

Fixed

  • Fix CSS issue by @whikernel in #377
  • Fixes addition of case templates in #379
  • Fix issues with case templates usage in #381
  • Fix issue with IOC lookups in the timeline in #382
  • Fix major collaboration issue in notes in #385
  • Fix PG Extension not being setup properly in #390
  • Fix multiple security issues impacting case reports and editors
"},{"location":"changelog/#new-contributors","title":"New Contributors","text":"
  • @MikaelFangel made their first contribution in #414

Full Changelog

"},{"location":"changelog/#v237-december-14-2023","title":"v2.3.7 December 14, 2023","text":""},{"location":"changelog/#whats-changed_2","title":"What's Changed","text":"

Fixed

  • Fixes an issue with download of files from the datastore #347
  • Fixes an issue with the addition of protagonist in cases
  • Fixes an issue with case edition modal

Improved

  • Improved timeline rendering
  • Improved security in Datatables

Full Changelog

"},{"location":"changelog/#v236-december-7-2023","title":"v2.3.6 December 7, 2023","text":""},{"location":"changelog/#whats-changed_3","title":"What's Changed","text":"

Fixed

  • Fixes an error preventing the proper generation of reports
  • Fixes an issue with filtering in the overview tab
  • Adds more filtering options in the overview tab

Full Changelog

"},{"location":"changelog/#v235-november-30-2023","title":"v2.3.5 November 30, 2023","text":""},{"location":"changelog/#whats-changed_4","title":"What's Changed","text":"

Fixed

  • Fixes an issue introduced in v2.3.4 where the cases metadata are not properly saved.

Full Changelog

"},{"location":"changelog/#v234-november-29-2023","title":"v2.3.4 November 29, 2023","text":"

A severe bug has been introduced in this version. Please upgarde to v2.3.5.

"},{"location":"changelog/#whats-changed_5","title":"What's Changed","text":"

Added

  • Added support for evidences types
  • Added support for cases severity
  • Improved search in context switcher

Fixed

  • Fixed overview page
  • Fixed dashboard filtering

\u2757 The layout of the reporting has slightly changed. Custom report templates might not work anymore. You can use https://<server>/case/export?cid=<case_id> to get all the possible fields.

Full Changelog

"},{"location":"changelog/#v233-october-5-2023","title":"v2.3.3 October 5, 2023","text":""},{"location":"changelog/#whats-changed_6","title":"What's Changed","text":"

Fixed

  • Fixed breaking of manage case list if percentage in title
  • Fixed broken title search in overview
  • Fixed sorting of owners in overview
  • Fixed quick look in overview
  • Fixed alert page breaking if username contains trailing space
  • Fixed IrisVTModule links
  • Fixed IrisWebhookModule
  • Fixed refresh after closing of notes

@Scriptception made their first contribution in 313

Full Changelog

"},{"location":"changelog/#v232-august-2-2023","title":"v2.3.2 August 2, 2023","text":""},{"location":"changelog/#whats-changed_7","title":"What's Changed","text":"

Fixed

Patches a critical issue corrupting files uploaded to the DataStore via the IOC option or when a password is set

Full Changelog

"},{"location":"changelog/#v231-july-23-2023","title":"v2.3.1 July 23, 2023","text":""},{"location":"changelog/#whats-changed_8","title":"What's Changed","text":"

Improved

  • Overview page and quick view layout
  • Auto assignment of alerts when not assigned
  • Possibility to filter tags by clicking on them in alerts

Fixed

  • Call of modules when done from the modals
  • UI

Full Changelog

"},{"location":"changelog/#v230-july-09-2023","title":"v2.3.0 July 09, 2023","text":""},{"location":"changelog/#whats-changed_9","title":"What's Changed","text":"

Added

  • Collaborative editor in notes
  • Possibility to add case peer-reviews
  • Alerts resolution status
  • Auto closing of alerts with resolution for linked alerts
  • New webhook module
  • Enhanced overview page
  • Attributed open cases in dashboard
  • Assets and IOCs multi-additions from the UI
  • New UI design

Fixed

  • Password change for users
  • Description breaking in alerts and events
  • Missing icons in MD rendering for know links
  • Alerts rendering

Full Changelog

"},{"location":"changelog/#v223-june-19-2023","title":"v2.2.3 June 19, 2023","text":""},{"location":"changelog/#whats-changed_10","title":"What's Changed","text":"

Added

  • Possibility to use LDAP and local auth as fallback
  • Possibility to add multiple IOCs at once from the UI
  • Possibility to add multiple assets at once from the UI
  • Support for hooks and module calls in alerts
  • URL redirection after login

Fixed

  • Similarities in alerts when no assets are provided
  • Assertion of data in marshmallow
  • MD editor new lines handling
  • Unicode in datastore
  • Alerts share links
  • Modules info when registering a module
  • UI fixes

Full Changelog

"},{"location":"changelog/#v222-may-30-2023","title":"v2.2.2 May 30, 2023","text":""},{"location":"changelog/#whats-changed_11","title":"What's Changed","text":"

Added

  • Possibility to pivot on assets and IOCs from the alerts graph

Fixed - Delete character escaping for passwords by @juadde in #253 - Case template of tasks without tags - Shortening of case names during updates - Bad handling of certain requests without CID - Deletion of assets related to alerts once merge into a case

Full Changelog

"},{"location":"changelog/#v221-may-24-2023","title":"v2.2.1 May 24, 2023","text":""},{"location":"changelog/#whats-changed_12","title":"What's Changed","text":"

Note 1: This version contains a security fix for iris-web (see CVE-2023-30615) Note 2: on_postload_case_info_update hook has been renamed to on_postload_case_update

Added

  • Add newly created users after a LDAP authentication to group Analysts by @c8y3 in #247

Fixed

  • Security fix of CVE-2023-30615 - GHSA-gc6j-6276-2m49 impacting iris-web < v2.2.1
  • Deletion of cases with assigned tasks
  • Merge of multiple alerts
  • Import of IOCs and Assets in case multiple alerts are merged

Full Changelog

"},{"location":"changelog/#v220-may-22-2023","title":"v2.2.0 May 22, 2023","text":""},{"location":"changelog/#whats-changed_13","title":"What's Changed","text":"

Added

  • Basic csv events file import (with default options) by @realsec in #240
  • New endpoints to search for manageable objects such as assets types etc,
  • New search by asset IDs, IOC IDs and events IDs in the timeline

Fixes

  • Some configuration checks when LDAP and automatic user creation are set by @c8y3 in #246
  • Ensure database connectivity before trying to create tables by @weslambert in #248
  • Merge of multiple alerts in one case not merging the IOCs and assets
  • Bug allowing to add an asset to a timeline not belonging to the same case
  • UI bug fixes

New Contributors

  • @realsec made their first contribution in #240
  • @weslambert made their first contribution in #248

Full Changelog

"},{"location":"changelog/#v210-may-15-2023","title":"v2.1.0 May 15, 2023","text":"

If you are using custom SSL certificates, please read the upgrade instructions when upgrading from previous versions.

"},{"location":"changelog/#whats-changed_14","title":"What's Changed","text":"

Added

  • Full support of alerts
  • Case templates
  • Provisioning of users
  • Service accounts
  • New permissions

Fixed

  • Variable LDAP_AUTHENTICATION_TYPE in .env.model by @c8y3 in #217
  • Automatic creation of users with ldap authentication by @c8y3 in #227
  • Update nginx.conf for Security HTTP headers to work. by @oikuda in #216
  • Columns in manage cases #205
  • Customer contact deletion #239
  • Search permissions #237
  • Customer permissions #235
  • Toast split #226
  • Assets exporting #224
  • Assets IOC filtering #223
  • ADM username not enforced #218
  • JIT provisioning of users in LDAP #203

New Contributors

  • @c8y3 made their first contribution in #217
  • @oikuda made their first contribution in #216

Full Changelog

"},{"location":"changelog/#v202-april-18-2023","title":"v2.0.2 April 18, 2023","text":""},{"location":"changelog/#whats-changed_15","title":"What's Changed","text":"

Fixed * Update case_notes_db.py for bug fix #200 by @LoneWolf-96 in #208 * Do not escape_filter_chars for NTLM username by @juadde in #212 * docker-compose cleanup by @juadde in #213 * Listening port not being propagated in nginx docker

New Contributors * @LoneWolf-96 made their first contribution in #208 * @juadde made their first contribution in #212

Full Changelog

"},{"location":"changelog/#v201-april-05-2023","title":"v2.0.1 April 05, 2023","text":""},{"location":"changelog/#whats-changed_16","title":"What's Changed","text":"

Fixed [FIX] Additional table header in case management breaking proper loading of data in #206

Full Changelog

"},{"location":"changelog/#v200-march-26-2023","title":"v2.0.0 March 26, 2023","text":""},{"location":"changelog/#whats-changed_17","title":"What's Changed","text":"

In addition to the features listed below, we are changing the way we are issuing releases. From now on, IRIS follows the Semantic Versioning 2.0 guidelines. The code ready for production is always tagged with a version number. alpha and beta versions are not production-ready.

Do not use the master branch in production.

A website with the current development version is also provided and freely accessible. It serves as a beta before public releases.

Added

  • Groups management
  • Case access control and basic permissions
  • Comments support on a call objects
  • Markdown editors in all case objects
  • Customers dedicated pages with additional information and cases stats
  • LDAP authentication
  • Markdown reporting
  • Case owners, classifications, outcome and tags
  • Possibility to update case basic infornations
  • Case overview page
  • Unique UUID on all case objects
  • Multiple assignees support in case tasks
  • Deletion confirmation prompt on all case objects as an option
  • IOC in events plus optional synchronization with assets
  • Events flagging in the timeline
  • MD links on every case objects

Improved

  • Dark mode
  • Uniformity of modals
  • Overall UI and UX
  • Compromised status in assets
  • Error reporting in the UI

Fixed

  • Manual call of modules when multiple modules are availables
  • Multiples bugs fixes
  • Security fixes

Full Changelog

"},{"location":"changelog/#v145-june-9-2022","title":"v1.4.5 June 9, 2022","text":"

What's Changed

  • Added a datastore in #115, fixes #30 :
    • Upload and store any files on IRIS
    • Password protect them as an option
    • Download
    • Add to IOC and/or evidences automatically
    • Reference to files in notes, summary or any textual input
    • Copy/paste of images directly in notes and summary
    • Virtual folders to arrange files
  • Ability to configure password policy in #117, fixes #116
  • Dark mode improved, flickering removed
  • Multiples bugs fixes
  • Security fixes

Full Changelog

Notes: Changes are made to the Nginx docker to allow upload of big files, hence specific upgrades are needed and auto-updates is not yet supported for this version. Please see the upgrades instruction for more details.

"},{"location":"changelog/#v144-may-18-2022","title":"v1.4.4 May 18, 2022","text":"

What's Changed

  • Implementation of bulk events editing by @sebastiandemmer in #110
  • Fixes context switch button doesn't load cases by @DevJoost in #112
  • Fixes multiple minor bugs

Full Changelog

"},{"location":"changelog/#v143-may-13-2022","title":"v1.4.3 May 13, 2022","text":"

What's changed

  • Managed IRIS updates from itself
  • Custom icons for assets - fixes #44 by @sebastiandemmer
  • IOCs link in timeline and graph - fixes #50
  • History of modifications in timeline
  • User id in timeline export as an option - fixes #65
  • Backup of database from the interface
  • Minimisation of modals in cases
  • New UI improvements in timeline
  • New minimal notifications for almost all activities
  • Improved overall responsiveness and speed
  • Improved error feedbacks to users
  • Improved load of tasks results by x10
  • Code cleaning
  • Multiple bug fixes

Full Changelog

"},{"location":"changelog/#v142-april-22-2022","title":"v1.4.2 April 22, 2022","text":"

Improvements :

  • Possibility to duplicates events in timeline - #91
  • Possibility to filter timeline with basic query - #94

Fixes :

  • Integer limit on file size in evidences - #89
  • Gradient in closed cases
  • on-preload hooks list handling - #92
  • tags issue - #88
  • Case info modal from case - #93
  • Multiple UI issues
"},{"location":"changelog/#v141-april-8-2022","title":"v1.4.1 April 8, 2022","text":"
  • Fixes a scrolling issue of the timeline when events are being popped
"},{"location":"changelog/#v140-april-6-2022","title":"v1.4.0 April 6, 2022","text":"

A bug fixe exists for this version. See v1.4.3

  • Hooks, adding the ability for modules to react on almost anything happening on the plateform in #75
  • New type of modules that can handles hooks
  • VirusTotal beta integration as a processor module
  • MISP beta integration as a processor module
  • Custom attributes on all case objects allowing to extend the default fields
  • A compact timeline view for better visbility
  • Premises of a dark theme
  • Resiliency of docker volume in #80
  • Minor improvements in #69, #79
  • Bug fixes in #70, #73, #77
  • Security fixes
"},{"location":"changelog/#v131-march-19-2022","title":"v1.3.1 March 19, 2022","text":"
  • Fixes wheel issue preventing proper build of the docker, as described in #83
"},{"location":"changelog/#v130-january-24-2022","title":"v1.3.0 January 24, 2022","text":"
  • Added the ability to batch upload IOC from a CSV file in #26
  • Added the ability to batch upload assets from a CSV
  • Screenshot - Export contents of any case pages as PNG in #35
  • Export timeline as CSV in #47
  • Improved timeline loading time by x10 - loads thousands of events in a sec
  • New auto parsing of dates in events addition/updates
  • Brand new timeline visualisations
  • Improved assets loading time
  • Shared links - easily share any case objects with your collaborators
  • Right panel now offers last activities for user's current case
  • Added assets tags in #37
  • New API endpoints in #53
  • Auto migration of database for next releases
  • Indication of mandatory fields in forms
  • General bug fixes, stability and UI improvement
"},{"location":"changelog/#v121-december-31-2021","title":"v1.2.1 December 31, 2021","text":"
  • Added ATT&CK tactics by @ecapuano in #9
  • Added screenshot and video link in readme in #12
  • Fixed duplicated path to add customer in #4
  • Fixed asset description data validation client side in #7
  • Fixed tooltip in #10
  • Add a per-column filtering field in the case view by in #15
"},{"location":"contact/","title":"Contacting us","text":"

You can directly contact us, should you need direct support, a demo, further information or anything else related to the project.

contact@dfir-iris.org

Discord

Twitter

"},{"location":"credits/","title":"Credits","text":"

IRIS uses dozen of OS modules and this list is not exhaustive. If you developped something which is used in IRIS and does not figures here, you can contact us.

  • Flask
  • SQLAlchemy
  • PostgreSQL
  • Celery
  • RabbitMQ
  • Docker
  • Atlantis
  • Flaticon
  • Font Awesone
  • Datatables
  • JQuery
  • MkDocs
  • MkDocs Materials
  • Tailwind
  • MISP module for Cortex
  • Virus Total Apis
"},{"location":"getting_started/","title":"Quick Start","text":"

The most straightforward and recommended way to use IRIS is with Docker. This is presented here.

Disclaimer

IRIS is in its early stage. It can already be used in production, but please set backups of the database and DO NOT expose the interface on the Internet. We highly recommended the use of a private dedicated and secured network.

"},{"location":"getting_started/#pre-requisites","title":"Pre-requisites","text":""},{"location":"getting_started/#hardware","title":"Hardware","text":"

IRIS does not require a lot of resources, and it can be run on a small laptop (4 cores, 8Gb of RAM). However, for large a organization and heavy usage, it will need to be significantly scaled up. We don't have benchmarks yet, but keep in mind that the database can grow rapidly and modules can require more resources depending on their purposes.

"},{"location":"getting_started/#docker","title":"Docker","text":"

Docker and docker compose are needed to build and run the project. Depending on the OS you will find all the information to install them on the official website of Docker.

The platform is officially supported on most Linux and MacOS. While it should work on Windows, some path needed by the containers to store permanent files might need to be changed in the dockerfiles.

"},{"location":"getting_started/#versioning","title":"Versioning","text":"

Starting from version 2.0.0, Iris is following the Semantic Versioning 2.0 guidelines. The code ready for production is always tagged with a version number. alpha and beta versions are not production-ready.

Do not use the master branch in production.

"},{"location":"getting_started/#build-and-run","title":"Build and Run","text":"

To build and run IRIS, follow these steps:

  1. Clone the iris-web repository:

    git clone https://github.com/dfir-iris/iris-web.git\ncd iris-web\n

  2. Check out the latest non-beta tagged version: 

    git checkout v2.4.7\n

  3. Copy the environment file 

    cp .env.model .env\n

    Warning

    The default configuration is suitable for testing only. To configure IRIS for production, see the configuration section.

  4. Build the Docker containers:

    docker-compose build\n

  5. Start IRIS:

    docker-compose up\n

IRIS should now be available on the host interface, port 443, using HTTPS protocol by default. You can access it by navigating to https://hostip in your web browser.

By default, an administrator account is created when IRIS is started for the first time. The password is printed in the console output. You can search for WARNING :: post_init :: create_safe_admin :: >>> in the logs to find the password. Running docker compose logs app | grep 'admin' should help to find it.

If you want to define an admin password at the first start, you can create and define the environment variable IRIS_ADM_PASSWORD in the .env. This has no effect once the administrator account is created.

Note that IRIS is split into five Docker services, each with a different role:

  • app - iris_webapp: The core, including web server, database management, module management, etc.
  • db: A PostgreSQL database
  • RabbitMQ: A RabbitMQ engine to handle job queuing and processing
  • worker: A job handler relying on RabbitMQ
  • nginx: A NGINX reverse proxy

Each service can be built independently, which is useful when developing. In this QuickStart, all services are built at once.

"},{"location":"getting_started/#additional-configuration","title":"Additional configuration","text":"

Please see configuration for more details.

"},{"location":"getting_started/#kubernetes","title":"Kubernetes","text":"

For enterprises wishing to run their instance of IRIS, utilizing the projects official Helm charts and/or Kustomize manifests, allows them to significantly enhance their deployment and management, presenting a powerful solution to streamline their IRIS deployment and management processes, efficiently running across a cluster of machines, ensuring high availability and seamless scaling as demand fluctuates.

The deploy directory in the iris-web GitHub repository provides a practical starting point for deploying IRIS on their preferred managed k8s platform. We've created two variants: eks and gke, feel free to customize each with your own values.

For more details, please visit the deploy directory on GitHub: deploy

"},{"location":"resources/","title":"Resources","text":"

This page is a collection of external resources to help you get started with IRIS and integrate it into your workflow. Please note that some of these resources may be outdated. If you want to add your own resources, please open a pull request or contact us.

"},{"location":"resources/#blog-posts","title":"Blog posts","text":"
  • Building a FOSS SOC by nateuribe
  • Integrating Wazuh with IRIS by stasis - Please note that Wazuh needs to send alerts on port 443 by default, not 8000 as specified in the article
  • IRIS and a bit of MISP by vanimpe
"},{"location":"resources/#iris-modules","title":"IRIS Modules","text":"
  • SOC Fortress on Github
"},{"location":"resources/#videos","title":"Videos","text":"
  • SOC Fortress: IRIS
"},{"location":"resources/#misc","title":"MISC","text":"
  • Integrating IRIS with Tines by Michael Tolan
"},{"location":"roadmap/","title":"Roadmap","text":"

Note of 25-05-2023

IRIS is growing both in code and interestes. To future-proof the project, we have decided to pause the development of new features and focus on the core functionalities and stability for a while. This includes a major refactoring of the codebase. We will still fix bugs and security issues.

We do not provide a long-term roadmap to prevent any frustration and unmet expectations. It is constantly evolving with feedbacks we receive.

We've thus moved it within a Github project. You can check it here.

"},{"location":"security-advisories/","title":"Security Advisories","text":"

This page lists all security advisories that have been published for the code released by DFIR-IRIS.

"},{"location":"security-advisories/#cve-2023-50712-dec-18-2023","title":"CVE-2023-50712 Dec 18, 2023","text":"CVE ID Github ID Severity Impacted product CVE-2023-30615 GHSA-593r-747g-p92p Moderate - CVSS3 4.6/10 iris-web"},{"location":"security-advisories/#description","title":"Description","text":"

A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.3.7. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities.

An attacker need to be authenticated on the application to exploit this vulnerability.

"},{"location":"security-advisories/#affected-versions","title":"Affected versions","text":"
  • iris-web < 2.3.7
"},{"location":"security-advisories/#fixed-versions","title":"Fixed versions","text":"
  • iris-web >= 2.3.7
"},{"location":"security-advisories/#workarounds","title":"Workarounds","text":"

No workaround is available.

"},{"location":"security-advisories/#acknowledgment","title":"Acknowledgment","text":"

Thanks to Leonard Rapp (G DATA Advanced Analytics GmbH) for the responsible disclosure.

"},{"location":"security-advisories/#cve-2023-30615-may-24-2023","title":"CVE-2023-30615 May 24, 2023","text":"CVE ID Github ID Severity Impacted product CVE-2023-30615 GHSA-gc6j-6276-2m49 Moderate - CVSS3 4.6/10 iris-web"},{"location":"security-advisories/#description_1","title":"Description","text":"

A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.2.1. The vulnerability allows an attacker to inject malicious scripts into the application, which are then executed when a user visits the affected locations. This can lead to unauthorized access, data theft, or other related malicious activities.

An attacker need to be authenticated on the application to exploit this vulnerability.

"},{"location":"security-advisories/#affected-versions_1","title":"Affected versions","text":"
  • iris-web < 2.2.1
  • iris-web > 2.0.0 and < 2.2.1 while not using the alerting feature are not impacted.
"},{"location":"security-advisories/#fixed-versions_1","title":"Fixed versions","text":"
  • iris-web >= 2.2.1
"},{"location":"security-advisories/#workarounds_1","title":"Workarounds","text":"

No workaround is available.

"},{"location":"support/","title":"Getting support","text":"

We understand the importance of having robust support and training to maximize the effectiveness of our tools in your IR efforts. Here's how we can assist:

  • Getting started
  • Support and implementation
  • Trainings

We're flexible and can accommodate needs through our OpenCollective page.

Please get in touch with us at contact@dfir-iris.org for further details.

"},{"location":"support_us/","title":"Support us","text":"

As a free and open source project, we rely on the support of our community to continue development and improve our platform. If you find the platform useful and would like to help us sustain and grow, you may consider supporting us financially through OpenCollective.

Support us

"},{"location":"zqa/","title":"Q & A","text":""},{"location":"zqa/#general-questions","title":"General questions","text":""},{"location":"zqa/#which-version-should-i-install","title":"Which version should I install?","text":"

The master branch is stable as all the development is done under the develop branch and merged once ready. To ease the identification, each new version is tagged and a new release is published. We recommend using these. git checkout <tagged_version>

"},{"location":"zqa/#is-the-project-maintained","title":"Is the project maintained?","text":"

Yes, IRIS is under heavy development. We are adding more and more features, led by feedbacks from the community.

"},{"location":"zqa/#what-is-the-future-of-the-project","title":"What is the future of the project?","text":"

We aim to make it evolve as much as possible with the help of the community. We have long term goals to integrate it seamlessly with project like MISP and other OS project, but we don't provide any commitment on how and when to avoid any unmet expectations. For a short term roadmap, you can head to the Github project.

"},{"location":"zqa/#how-can-i-contact-the-dfir-iris-team","title":"How can I contact the DFIR-IRIS team?","text":"

You can reach us on discord, Twitter or by email.

"},{"location":"zqa/#cases","title":"Cases","text":""},{"location":"zqa/#can-i-recover-a-deleted-case","title":"Can I recover a deleted case?","text":"

No. Cases are deleted from the database and changes are committed. There is no coming back unless you have made backups of the database (which we recommend).

"},{"location":"zqa/#can-i-recover-a-deleted-case-object","title":"Can I recover a deleted case object?","text":"

No. Every object such as IOCs, assets, events, notes, etc are immediately deleted from the database and changes are committed.

"},{"location":"zqa/#can-i-add-a-new-asset-type","title":"Can I add a new asset type?","text":"

Yes. With a user that have administrative rights, go to Advanced > Case Objects.

"},{"location":"zqa/#can-i-add-a-new-ioc-type","title":"Can I add a new IOC type?","text":"

Yes. Starting from v1.3.0, IOC types can be manipulated. Head to Advanced > Case Objects

"},{"location":"zqa/#can-i-add-new-fields-to-case-objects-such-as-iocs-assets-etc","title":"Can I add new fields to case objects such as IOCs, Assets, etc?","text":"

Yes. Starting from v1.4.0, all case objects can be extended thanks to custom attributes. With a user that have administrative rights, go to Advanced > Custom Attributes.

"},{"location":"zqa/#can-i-search-into-custom-attributes-fields","title":"Can I search into custom attributes fields?","text":"

Not for now. The searches in each case objects page are done client-side, and the attributes are not fetched. We will however implement a server side search in next releases.

"},{"location":"zqa/#can-i-create-two-cases-with-the-same-name-for-the-same-customer","title":"Can I create two cases with the same name for the same customer?","text":"

Yes. Cases are identified with a unique number, so they can have the same name.

"},{"location":"zqa/#can-i-restrict-the-view-of-case-to-a-set-of-users","title":"Can I restrict the view of case to a set of users?","text":"

Yes it is since v2.0.0. See Access control.

"},{"location":"zqa/#can-i-change-the-name-or-customer-of-an-existing-case","title":"Can I change the name or customer of an existing case?","text":"

Yes it is since v2.0.0.

"},{"location":"zqa/#operations","title":"Operations","text":""},{"location":"zqa/#what-is-the-password-policy-can-it-be-changed","title":"What is the password policy? Can it be changed?","text":"

Before v1.4.5, the password policy is hardcoded and cannot be changed. It should be 12 characters minimum and contains a capital letter and a number.

"},{"location":"zqa/#can-i-change-my-profile-picture","title":"Can I change my profile picture?","text":"

No, not for now. This wasn't a priority for us, it will be released in future versions.

"},{"location":"zqa/#i-lost-the-administrator-password-can-i-recover-it","title":"I lost the administrator password, can I recover it?","text":"

Passwords are hashed so they can't be recovered. But you can change it. Please see changing a lost password.

"},{"location":"zqa/#can-i-delete-a-user","title":"Can I delete a user?","text":"

No. To keep consistencies in the database, users unfortunately cannot be deleted if they have done some activities. You can however disable them to prevent them appearing in the UI and connecting to the plafeform.

"},{"location":"zqa/#can-i-delete-a-customer","title":"Can I delete a customer?","text":"

No. To keep consistencies in the database, customers unfortunately cannot be deleted if they are linked to cases.

"},{"location":"zqa/#can-i-prevent-backrefs-of-assets-and-iocs","title":"Can I prevent backrefs of assets and IOCs?","text":"

No. It might be possible in future versions but for now it is better to spin up a new instance for restricted cases. The backref is however automatically disabled for performance reasons, for cases with more than 300 assets. We are working on a more efficient way to backref.

"},{"location":"zqa/#my-report-template-is-not-generated-and-generates-an-error","title":"My report template is not generated and generates an error","text":"

Please triple check typos in tags as there is no fault tolerance. You can reach us in case of troubles.

"},{"location":"zqa/#integration","title":"Integration","text":""},{"location":"zqa/#can-i-enrich-iocs-with-external-sources","title":"Can I enrich IOCs with external sources?","text":"

Starting from v1.4.0, it is now possible to easily develop module to enrich case objects. A module Iris VT and IRIS MISP are already provided.

"},{"location":"zqa/#is-there-an-api-client","title":"Is there an API client?","text":"

Yes, you can find it on our Github.

"},{"location":"zqa/#security","title":"Security","text":""},{"location":"zqa/#can-i-restrict-cases","title":"Can I restrict cases?","text":"

Yes it is since v2.0.0. See Access control.

"},{"location":"zqa/#can-i-expose-iris-on-the-internet","title":"Can I expose IRIS on the Internet?","text":"

NO! Please don't. This platform should only be accessible in a restricted environment.

"},{"location":"zqa/#i-found-a-security-issue-can-i-have-a-bounty","title":"I found a security issue, can I have a bounty?","text":"

No - IRIS is free and open source so there is no bounty. Please report it as soon as possible so we can fix it.

"},{"location":"zqa/#misc","title":"MISC","text":""},{"location":"zqa/#what-does-iris-stand-for","title":"What does IRIS stand for?","text":"

Originally Incident Response Investigation System. But it can be whatever you want really.

"},{"location":"development/","title":"Development","text":"

This section is under construction and more elements will be added over time

This documentation is not a detailed how-to develop IRIS. It gives some insights to help understand the basic code of the project and how to contribute.

"},{"location":"development/#general-repositories-conventions","title":"General repositories conventions","text":""},{"location":"development/#branches","title":"Branches","text":"

We are using the Gitflow Workflow to manage our git branches. In a nutshell :

  • master contains only \"production-ready\" code
  • develop contains the major development code. When ready it is tagged and merged into master
  • The sub-branches of develop contains either :
    • A new feature in development, in which case the naming convention is new_feature
    • An issue fixe, in which case the name convention is iXX_issue_title, with XX being the issue number
"},{"location":"development/#commits","title":"Commits","text":"

The commits convention is the following :

  • Create commits as small as possible, i.e atomic commits
  • If it's not related to an issue, the format [action] Commit message is used, with action being a 3 letters action related to the commit, eg ADDfor additions, DEL for deletions, IMP for improvements, etc.
  • If it's related to an issue, prepend with the issue ID, i.e [#issue_id][action] Commit message
"},{"location":"development/#sections","title":"Sections","text":"

The following sections are available in this documentation :

  • Structure overview : general structure of IRIS code
  • Environment setup : guide to setup a development environment
  • Coding tips : basic codes hints
  • DB migration : things to consider if the code changes the DB schema
  • Hooks : an introduction to IRIS hooks
  • Modules : a guide to develop modules
"},{"location":"development/code-tips/","title":"Coding tips","text":""},{"location":"development/code-tips/#routes","title":"Routes","text":"

IRIS does not defines a separate API for users, meaning the HTML pages are actually using the API themselves. Routes don't need to handle the authentication and roles. These are handles by wrappers (see snippets below).

"},{"location":"development/code-tips/#page-route","title":"Page route","text":"

A page returns an HTML content and should use the following code structure : Example of page route

@blueprint.route('/a/good/route', methods=['GET']) # (1)\n@login_required # (2)\ndef view_a_good_route(caseid, url_redir):  # (3)\nif url_redir:\nreturn redirect(url_for('bluprintname.method_name', cid=caseid))  # (4)\n# route code \nreturn render_template(\"a_good_route.html\", variable_1=var_1, ...)  # (5)\n

  1. This defines which URI the route is handling as well as the methods it supports (ie GET, POST, etc). In IRIS, we try to limit one method per route.
  2. This defines the security of the endpoint. @login_required is used for users page and @admin_login_required is used for admin restricted pages.
  3. caseid and url_redir are variable provided by @login_required and @admin_login_required wraps. caseid indicates which case ID the user tried to access the route with. url_redir indicates the caseid provided wasn't valid and a redirection is needed.
  4. In case a redirection is needed, provide the URL to which the redirection should be done. It's often the page method itself except for modales.
  5. A page route needs to return an HTML template. variable_1 is a value that can be accessed from within the template itself. More variables can be added, or not at all.
"},{"location":"development/code-tips/#api-route","title":"API route","text":"

An API route returns a JSON content. Two types are pre-defined and should be used : Standard API returns

response_success(msg=\"A success message\", data=<data associated with the success feedback>)\nresponse_error(msg=\"An error message\", data=<data associated with the error feedback>, status=<status code, by default 400>)\n

Below is an example of standard API route. Example of page route

@blueprint.route('/a/good/api_route', methods=['GET']) # (1)\n@api_login_required # (2)\ndef view_a_good_route(caseid):  # (3)\n# API route code \nreturn response_success(\"ok\", data=my_data_object)  # (4)\n

  1. This defines which URI the route is handling as well as the methods it supports (ie GET, POST, etc). In IRIS, we try to limit one method per route.
  2. This defines the security of the endpoint. @api_login_required is used for users API endpoints and @api_admin_required is used for admin restricted endpoints.
  3. caseid is provided @api_login_required and @api_admin_required wraps. It indicates which case ID the user tried to access the endpoint with.
  4. One of the standard return defined above.
"},{"location":"development/db-migration/","title":"DB Migrations","text":"

In case a DB migration is needed, you need to provide an alembic migration script.

Test your migration

Please try out your migration as this is an important piece of the upgrades. Spin up an old version of IRIS, input some data and then try to start your new version. Ensure that everything is migrated as expected.

In a terminal and from within the IRIS virtual env :

  1. Go to source
  2. Issue the following command : alembic -c app/alembic.ini revision -m \"A few words to describe your changes\"

This creates a new revision file source > app > alembic > versions. It's a Python file that basically describes what needs to be updated DB-wise. You can take example from the ones we already have generated in the same folder.

Hint

During your tests you might face the issue that Alembic does not apply your changes after you executed it once. It's because it keeps tracks of the latest applied revision in a table alembic_version. It doesn't know you changed the revision file. In that case the trick is to connect to the DB, and then delete the entry in the alembic_version. This will force it to reapply all revisions at startup. If you're using the DB docker you can use the following:

  • docker exec -it <db_container_id> /bin/sh
  • su postgres
  • psql
  • \\c iris_db;
  • DELETE FROM alembic_version;
  • Restart the IRIS web app - your changes should be applied
"},{"location":"development/environment/","title":"Setup","text":"

It follows an issue raised on the Github of the project.

It recommends the use of a hybrid development environment, as most of the time only the web-app needs to be changed:

  • Pycharm or any Python IDE for the web-app
  • Docker for db, nginx, celery and worker. The three later are even optional if you don't develop modules.
"},{"location":"development/environment/#web-app","title":"Web-app","text":"

For the webapp configuration, a specific .ini need to be created.

  • Create config.priv.ini in source/app by copying the config.docker.inipresent in the same directory.
  • Change PG_SERVER = db to PG_SERVER = 127.0.0.1 or whatever IP is the Postgresql/docker running with

That's the only configuration change needed for the app to run outside docker. The docker.priv.ini is already excluded in gitignore.

Then Pycharm need to be setup with a dedicated environment, by adding a new configuration:

  • Script path : source/run.py
  • Python interpreter 3.9
  • Working directory: source

To have pylint, right click on source in the directory tree and mark directory as > sources root. The requirements then need to be installed. Pycharm should detect the requirements.txt and propose to install the dependencies. Otherwise they can be installed with the following command (issued in the virtual environment) : pip3 install -r source\\requirements.txt

"},{"location":"development/environment/#run","title":"Run","text":"
  1. Spin up the docker db docker-compose up db
  2. Run the Pycharm configuration you created
  3. The interface should be accessible on http://127.0.0.1:8000 (and https://127.0.0.1:4433 if you started the nginx docker)

IRIS can now be developed and debugged on the fly.

"},{"location":"development/environment/#tests-in-docker","title":"Tests in docker","text":"

Once the code is working by running on Pycharm, we highly recommend testing it on Docker. To do so, the app docker need to be erased and rebuilt.

  1. docker-compose rm app
  2. docker-compose build app
  3. docker-compose up db app

Development considerations If the development results in DB modification, please use Alembic and add a migration script so users don't loose their data when they upgrade.

"},{"location":"development/hooks/","title":"Hooks","text":"

Introduced in IRIS v1.4.0

Hooks are a mean for modules to react on specific events that occurs on IRIS. By subscribing to a hook, a module is automatically notified when the associated event occurs. This offers a multitude of possibilities, from adding insight to IRIS objects, to pushing information to another platform or even changing how IRIS works.

"},{"location":"development/hooks/#types","title":"Types","text":"

There are 3 types of hooks.

  • On preload: Triggered before an object is processed and committed to database. It is triggered right after a request is received, and the data associated with the hook is usually the request content itself. In most of the cases, modules should not subscribe to these hooks.
  • On postload: Triggered after an object is processed and committed to database. It is triggered after IRIS processed the request and the data associated with the hook is usually a list of SqlAlchemy objects (such as IOC, Assets, etc).
  • Manual: Triggered by manual action of a user. When a module subscribes to these hooks, it needs to provide a \"menu option name\" which will be displayed to users. When they click this option, the associated hook is triggered for this module only. Multiple manual hooks can be registered for one module.

Danger

on_preload hooks must run synchronously, i.e not queued in RabbitMQ. This effectively blocks the current user request until the module finishes the processing. We highly recommend to only use on_postload hooks for a better user experience. These hooks are transparent for users and rely on already verified and committed data. Handling on_preload hooks implies the received data is unsafe - directly coming from remote clients - and the module needs to process the data as fast as possible.

"},{"location":"development/hooks/#subscribing-and-unsubscribing","title":"Subscribing and unsubscribing","text":"

Two methods are provided by IrisModuleInterface to subscribe and unsubscribe to hooks. 

  def register_to_hook(module_id: int, \niris_hook_name: str, \nmanual_hook_name: str = None, \nrun_asynchronously: bool = True)\ndef deregister_from_hook(module_id: int, \niris_hook_name: str)\n

The registration method expects the following arguments:

  • module_id: The ID of the calling module. This information is given by IRIS when the register_hooks method is called.
  • iris_hook_name: The name of the hook to which subscribe. This must be one of the hook listed in the section below.
  • manual_hook_name: The name of the UI menu that is provided to users if the registration concerns a manual hook. If nothing is provided, IRIS will create a name composed as follows: <module_name>::<hook_name>. This value is ignored if the signal is not manual.
  • run_asynchronously: Set to True (default) to run the module in a RabbitMQ task upon hook triggering. If set to False, the module is called immediately, which have for effect to effectively block the current user request until the module finishes. This is the behavior to use for on_preload hooks. However, we strongly recommend the use of on_postload hooks to prevent any unwanted (see warning section above).

The deregistration method expects the following arguments:

  • module_id: The ID of the calling module. This information is given by IRIS when the register_hooks methods is called.
  • iris_hook_name: The name of the hook to which unsubscribe. If the module is not subscribed to the specified hook the function returns without errors.

Please see the modules documentation for more details on how to implement these methods.

"},{"location":"development/hooks/#available-hooks","title":"Available hooks","text":"

The following hooks are natively available for subscription.

Hook name Description on_preload_case_create Triggered on case creation, before commit in DB on_postload_case_create Triggered on case creation, after commit in DB on_preload_case_delete Triggered on case deletion, before commit in DB on_postload_case_delete Triggered on case deletion, after commit in DB on_postload_case_update Triggered on case update, before commit in DB on_manual_trigger_case Triggered upon user action on_postload_alert_create Triggered on alert creation, after commit in DB on_postload_alert_update Triggered on alert update, after commit in DB on_postload_alert_delete Triggered on alert deletion, after commit in DB on_postload_alert_escalate Triggered on alert escalation, after commit in DB on_postload_alert_merge Triggered on alert merge, after commit in DB on_postload_alert_unmerge Triggered on alert unmerge, after commit in DB on_preload_asset_create Triggered on asset creation, before commit in DB on_postload_asset_create Triggered on asset creation, after commit in DB on_preload_asset_update Triggered on asset update, before commit in DB on_postload_asset_update Triggered on asset update, after commit in DB on_preload_asset_delete Triggered on asset deletion, before commit in DB on_postload_asset_delete Triggered on asset deletion, after commit in DB on_manual_trigger_asset Triggered upon user action on_preload_note_create Triggered on note creation, before commit in DB on_postload_note_create Triggered on note creation, after commit in DB on_preload_note_update Triggered on note update, before commit in DB on_postload_note_update Triggered on note update, after commit in DB on_preload_note_delete Triggered on note deletion, before commit in DB on_postload_note_delete Triggered on note deletion, after commit in DB on_manual_trigger_note Triggered upon user action on_preload_ioc_create Triggered on ioc creation, before commit in DB on_postload_ioc_create Triggered on ioc creation, after commit in DB on_preload_ioc_update Triggered on ioc update, before commit in DB on_postload_ioc_update Triggered on ioc update, after commit in DB on_preload_ioc_delete Triggered on ioc deletion, before commit in DB on_postload_ioc_delete Triggered on ioc deletion, after commit in DB on_manual_trigger_ioc Triggered upon user action on_preload_event_create Triggered on event creation, before commit in DB on_preload_event_duplicate Triggered on event duplication, before commit in DB. This event only received the event ID which will be duplicated on_postload_event_create Triggered on event creation, after commit in DB on_preload_event_update Triggered on event update, before commit in DB on_postload_event_update Triggered on event update, after commit in DB on_preload_event_delete Triggered on event deletion, before commit in DB on_postload_event_delete Triggered on event deletion, after commit in DB on_manual_trigger_event Triggered upon user action on_preload_evidence_create Triggered on evidence creation, before commit in DB on_postload_evidence_create Triggered on evidence creation, after commit in DB on_preload_evidence_update Triggered on evidence update, before commit in DB on_postload_evidence_update Triggered on evidence update, after commit in DB on_preload_evidence_delete Triggered on evidence deletion, before commit in DB on_postload_evidence_delete Triggered on evidence deletion, after commit in DB on_manual_trigger_evidence Triggered upon user action on_preload_task_create Triggered on task creation, before commit in DB on_postload_task_create Triggered on task creation, after commit in DB on_preload_task_update Triggered on task update, before commit in DB on_postload_task_update Triggered on task update, after commit in DB on_preload_task_delete Triggered on task deletion, before commit in DB on_postload_task_delete Triggered on task deletion, after commit in DB on_manual_trigger_task Triggered upon user action on_preload_global_task_create Triggered on global task creation, before commit in DB on_postload_global_task_create Triggered on global task creation, after commit in DB on_preload_global_task_update Triggered on task update, before commit in DB on_postload_global_task_update Triggered on global task update, after commit in DB on_preload_global_task_delete Triggered on task deletion, before commit in DB on_postload_global_task_delete Triggered on global task deletion, after commit in DB on_manual_trigger_global_task Triggered upon user action on_preload_report_create Triggered on report creation, before generation in DB on_postload_report_create Triggered on report creation, before download of the document on_preload_activities_report_create Triggered on activities report creation, before generation in DB on_postload_activities_report_create Triggered on activities report creation, before download of the document on_postload_asset_commented Triggered on asset comment, after commit in DB on_postload_asset_comment_update Triggered on asset comment update, after commit in DB on_postload_asset_comment_delete Triggered on asset comment deletion, after commit in DB on_postload_evidence_commented Triggered on evidence comment, after commit in DB on_postload_evidence_comment_update Triggered on evidence comment update, after commit in DB on_postload_evidence_comment_delete Triggered on evidence comment deletion, after commit in DB on_postload_task_commented Triggered on task comment, after commit in DB on_postload_task_comment_update Triggered on task comment update, after commit in DB on_postload_task_comment_delete Triggered on task comment deletion, after commit in DB on_postload_ioc_commented Triggered on ioc comment, after commit in DB on_postload_ioc_comment_update Triggered on ioc comment update, after commit in DB on_postload_ioc_comment_delete Triggered on ioc comment deletion, after commit in DB on_postload_event_commented Triggered on event comment, after commit in DB on_postload_event_comment_update Triggered on event comment update, after commit in DB on_postload_event_comment_delete Triggered on event comment deletion, after commit in DB on_postload_note_commented Triggered on note comment, after commit in DB on_postload_note_comment_update Triggered on note comment update, after commit in DB on_postload_note_comment_delete Triggered on note comment deletion, after commit in DB on_postload_alert_commented Triggered on alert comment, after commit in DB on_postload_alert_comment_update Triggered on alert comment update, after commit in DB on_postload_alert_comment_delete Triggered on alert comment deletion, after commit in DB"},{"location":"development/structure/","title":"Structure overview","text":""},{"location":"development/structure/#flask","title":"Flask","text":"

IRIS uses Flask for the web engine.

"},{"location":"development/structure/#routes-and-blueprints","title":"Routes and blueprints","text":"

Each page and API endpoints (eg /login, /dashboard, /case/assets/list, etc) refers to a route in the IRIS Flask app. They define what the application should do when Flask receives a request on an URI. To keep structure in the projects, these routes are grouped by Blueprints. The Blueprints reflects the structure shown in the IRIS UI left menu. For instance there is a case and an activities Blueprint.

The Blueprints and thus routes are defined in source > app > blueprints. All the blueprints are registered in source > app > views.py.

"},{"location":"development/structure/#templates","title":"Templates","text":"

IRIS uses dynamic page templating when an URI is visited. These Jinja2 templates are filled at runtime with the needed information and then returned to the client. Each route offering a page (i.e non-API endpoints) thus relies on a template. These are set in a folder named templates in each Blueprint. For instance, for the dashboard template : source > app > blueprints > dashboard > templates > index.html.

"},{"location":"development/structure/#static-contents","title":"Static contents","text":"

Static content is served from a common folder under source > app > static > assets. It contains CSS, JS and images. These can be accessed by pages using \"/static/assets/<the-resource>\".

"},{"location":"development/structure/#sqlalchemy","title":"SQLAlchemy","text":"

For the database management, the application uses SQLAlchemy with a PostgreSQL backend. There is - normally - no need to directly deal with PostgreSQL, everything goes through SQLAlchemy. It provides a Python overlay which allows to talk to the DB with objects.

"},{"location":"development/structure/#models","title":"Models","text":"

Each table of the app is defined by a model. These are defined in source > app > model. When IRIS starts, it looks for the already created tables and creates the missing ones if needed. If changes are done on a table or field, then a migration is needed. This is explained in Alembic migrations.

"},{"location":"development/structure/#requests","title":"Requests","text":"

To help structuring the code, we are trying to move the DB code from the routes code. This is partially done and work in progress. If your route requests the DB, please put the DB code in source > app > datamgmt.

"},{"location":"development/structure/#alembic","title":"Alembic","text":"

To apply schema migration without the need to rebuild the DB, IRIS uses Alembic. It allows to define migration scheme and IRIS calls it when it starts so users can upgrade without too much hassles.

"},{"location":"development/structure/#hooks-modules-and-tasks","title":"Hooks, modules and tasks","text":"

Modules are handled via tasks thanks to Celery and RabbitMQ. More info here and here.

"},{"location":"development/structure/#iris-startup","title":"IRIS startup","text":"

When starting-up, IRIS initiates a bunch of DB objects, whether it is started for the first time or just restarted. Objects already created are not recreated, but the missing ones are applied. This ensure a smooth migration between versions. These are defined in source > app > post_init.py. The scripts also contains the code that runs th DB migration with Alembic.

"},{"location":"development/modules/","title":"Modules","text":""},{"location":"development/modules/#introduction","title":"Introduction","text":"

A DFIR-IRIS Module (DIM) is a Python package allowing to extend IRIS features. DIMs are not running constantly and are only called following specific actions done by users.

We distinct two types of modules:

  • Pipeline modules: Allow uploading and processing of evidences through modular pipelines (eg: EVTX parsing and injection into a database or data visualiser). These are called when a user queries Update case and select evidences to process.
  • Processor modules: Allow processing of IRIS data upon predefined actions / hooks. (eg: be notified when a new IOC is created and get VT/MISP insights for it). These are either called automatically upon specific events, or if a user manually triggers them.

Except for some triggers for processor modules, all tasks provided by DIMs are run asynchronously in RabbitMQ tasks, so they don't impact the UI.

Both types of DIMs have the same structure, they only differ in their configurations and how they handle the data they receive. For that purpose, every DIM inherit from a common class named IrisModuleInterface - available here - which provides the basic structure and methods of a module.

Hint

To quickly start writing a new module, one can follow these tutorials.

"},{"location":"development/modules/#overview","title":"Overview","text":"

Modules are instantiated upon actions (hooks, triggers, user actions) and this occurs each time the said actions occur. It implies the initiation of a module has to be very quick. In most of the case, the __init__ method should not even be overwritten.

They can live either in the worker or the web-app, depending on their type and action they are handling. They can also live in both. This implies multiple instances of the same module can run at the same time.

The graph below shows two modules of different types running in the worker and interacting with external elements.

Modules don't have to handle the task creations or resource locks. This is handled by IRIS. They just need to process the data they received and return results in a predefined manner.

"},{"location":"development/modules/#common-structure","title":"Common structure","text":"

The section below describes the common structure of modules.

"},{"location":"development/modules/#directory-structure","title":"Directory structure","text":"
setup.py                # Setup configuration to build the module \nREADME.md               # README \niris_example_name       # Name of the package \n    __init__.py              # Declaration of the package and main class\n    IrisExampleConfig.py     # Configuration of the module to help keep the main file clean \n    IrisExampleInterface.py  # Main class of the module \n    module_helper            # Sub module containing the helper functions of the module \n      helper.py              # for instance access to ext resource, manipulation of data \n      helper2.py             # etc. \n
"},{"location":"development/modules/#the-initpy-file","title":"The init.py file","text":"

Iris loads the modules dynamically. To do so, it needs to know the name of the main class of the module and relies on __init__.py to find this information. 

__iris_module_interface = \"IrisEXAMPLEInterface\"\n

Where IrisEXAMPLEInterface is the main class of the module and inherits of the base class IrisModuleInterface.

Caution

Failing to provide the main class in __init__.py or having the main class inherit from IrisModuleInterface will make IRIS fail each time it attempts to load the module.

"},{"location":"development/modules/#the-module-configuration","title":"The module configuration","text":"

Iris needs to know what the module is doing and what services it is providing. This is done via the attributes of the main class (let's say IrisEXAMPLEInterface). The attributes are :

  • _module_name : string - \"human\" name presented to users.
  • _interface_version : float - version of IrisModuleInterface used. If the version is not supported, the server will refuse to register the module.
  • _module_version : float - version of the module itself to help users keep tracks of evolutions.
  • _module_type: string - Type of module. The available modules types are listed in IrisModuleInterface.IrisModuleTypes
  • _pipeline_support : bool - should be set to True if it implements a pipeline process (aka module of type pipeline_module).
  • _pipeline_info : dict - contains the configuration of the pipeline. The following structure must be followed:
pipeline_info = {\n# Name of the pipeline used for internal tracking. This \n# must be unique among all modules so pick something really unique \n\"pipeline_internal_name\": \"example_pipeline\",\n# The name of the pipeline presented to the user. Use something \n# that will help the users to identify the right pipeline\n\"pipeline_human_name\": \"Example Pipeline\",\n# Arguments presented to the users when they select the pipeline\n\"pipeline_args\": [\n['some_index', 'required'],\n['example_argument', 'optional']\n]\n}\n
  • _module_configuration : A list of dict. The list contains each field needed by the module. This list is shown in the Iris webpage of the module configuration. Each field in an entry is mandatory. 
_module_configuration = [\n{\n\"param_name\": \"vt_api_key\",\n\"param_human_name\": \"VT API Key\",\n\"param_description\": \"Virus total API key\",\n\"default\": None,\n\"mandatory\": True,\n\"type\": \"sensitive_string\"\n},\n{\n\"param_name\": \"vt_key_is_premium\",\n\"param_human_name\": \"VT Key is premium\",\n\"param_description\": \"Set to True if the VT key is premium\",\n\"default\": False,\n\"mandatory\": True,\n\"type\": \"bool\"\n},\n{\n\"param_name\": \"vt_ip_assign_asn_as_tag\",\n\"param_human_name\": \"Assign ASN tag to IP\",\n\"param_description\": \"Assign a new tag to IOC IPs with the ASN fetched from VT\",\n\"default\": True,\n\"mandatory\": True,\n\"type\": \"bool\"\n}\n]\n

The above example results in the following.

"},{"location":"development/modules/quick_start/processor/","title":"Processor modules","text":"

In this tutorial, we demonstrate the steps to write a basic processor module which subscribes to a hook, and log what it receives when the hook is triggered. We will also add a configuration setting to offer our users the ability disable this feature.

We'll call it IrisDummyModule.

"},{"location":"development/modules/quick_start/processor/#project-structure-overview","title":"Project structure overview","text":"

As described in the development module main page, the module should have the following structure. 

setup.py                # Setup configuration to build the module \nREADME.md               # README \niris_dummy_module       # Name of the package \n__init__.py              # Declaration of the package and main class\nIrisDummyConfig.py       # Configuration of the module to help keep the main file clean \nIrisDummyModule.py    # Main class of the module \n

While the module could have only one main file IrisDummyModule.py, we recommend splitting its configuration into a new configuration file (here IrisDummyConfig.py) to keep the code clear.

There is no mandatory naming convention for the files or the class or the methods. We chose this one to keep things clear, and we recommend following the same. But it's up to you really.

We will walk over these files one by one during this tutorial.

"},{"location":"development/modules/quick_start/processor/#creating-the-interface","title":"Creating the interface","text":"

The interface is the code that talks with IRIS. It implements methods that call and are called by the server. It needs to inherit IrisModuleInterface class from the IrisModuleInterface package. This module handles most of the methods needed by IRIS to recognize, set up and call the module. By inheriting this class in our interface, we avoid writing that part ourselves.

Let's write our basic interface class. The name of the file has to be the name of the main class, that's the only constraint. We'll see later on why.

iris_dummy_module/IrisDummyModule.py
#!/usr/bin/env python3\n# Import the IrisInterface class\nfrom iris_interface.IrisModuleInterface import IrisModuleInterface\n# Create our module class\nclass IrisDummyModule(IrisModuleInterface):\npass \n

That's it! Actually this class is not doing anything right now. We'll need to add a few methods to register our hook later.

But first we need to indicate to IRIS what is our main interface class. Remember, there is no convention restriction, so IRIS has no way to know which class it should instantiate to call our module.

To do so, we need to set a specific variable in our __init__.py.

iris_dummy_module/__init__.py
# Set the __iris_module_interface variable to the name of our main class. \n# When IRIS instantiates the python module, it looks for \"module.__iris_module_interface\"\n# And then tries to instantiate the class \"__iris_module_interface.__iris_module_interface\", here 'IrisDummyModule.IrisDummyModule'. \n# That's why the python file must have the same name as the class.  \n__iris_module_interface = \"IrisDummyModule\"\n

Our module is now recognizable by IRIS Pretty simple right?

"},{"location":"development/modules/quick_start/processor/#writing-the-configuration","title":"Writing the configuration","text":"

The next step is to describe what the module is doing, its name, its configuration, etc. This is done by overwriting predefined variables of the IrisModuleInterface class.

Let's create our Python configuration file and go through each variables.

iris_dummy_module/IrisDummyConfig.py
# Import the module types list,  so we can indicate the type of our module \nfrom iris_interface.IrisModuleInterface import IrisModuleTypes \n# Human name displayed in the GUI Manage > Modules. This can be anything, \n# but try to put something meaningful, so users recognize your module. \nmodule_name = \"IrisDummy\"\n# Description displayed when editing the module configuration in the UI. \n# This can be anything, \nmodule_description = \"Provides a dummy module that replies to one hook\"\n# Set the interface version used. This needs to be the version of \n# the IrisModuleInterface package. This version is check by the server to\n# to ensure our module can run on this specific server \ninterface_version = 1.1\n# The version of the module itself, it can be anything \nmodule_version = 1.0\n# The type of the module, here processor \nmodule_type = IrisModuleTypes.module_processor\n# Our module is a processor type, so it doesn't offer any pipeline \npipeline_support = False\n# Provide no pipeline information as our module don't implement any \npipeline_info = {}\n# The configuration of the module that will be displayed and configurable \n# by administrators on the UI. This describes every parameter that can \n# be set. \nmodule_configuration = [\n{\n\"param_name\": \"log_received_hook\",\n\"param_human_name\": \"Log received hook\",\n\"param_description\": \"Logs a message upon hook receiving if set to true. Otherwise do nothing.\",\n\"default\": True,\n\"mandatory\": True,\n\"type\": \"bool\"\n}\n]\n

The module configuration parameters are the following :

  • param_name : The internal parameter name. This will be used by the module itself to fetch the value when needed.
  • param_human_name : The name displayed on the UI for this specific parameter
  • param_description: A description explaining what this parameter is doing to help administrators
  • default: The default value of our parameter. Here we set to True, so after install our module is already configured and ready to log the hook.
  • mandatory: Indicates whether the parameter is mandatory or not. If set to True and no value is provided (either by admin or by default), the module is automatically disabled by IRIS
  • type: The type of parameter. Here a boolean, which will be rendered under the form of a checkbox.

A module can have as many parameters as it needs.

We now need to update our main class to set this configuration.

iris_dummy_module/IrisDummyModule.py
#!/usr/bin/env python3\n# Import the IrisInterface class\nfrom iris_interface.IrisModuleInterface import IrisModuleInterface\n# Create our module class\nclass IrisDummyModule(IrisModuleInterface):\n# Set the configuration\n_module_name = interface_conf.module_name\n_module_description = interface_conf.module_description\n_interface_version = interface_conf.interface_version\n_module_version = interface_conf.module_version\n_pipeline_support = interface_conf.pipeline_support\n_pipeline_info = interface_conf.pipeline_info\n_module_configuration = interface_conf.module_configuration\n_module_type = interface_conf.module_type\npass \n

Done! The module is now providing enough information to IRIS, so it knows exactly what our module do and what needs to be called to run it.

However, our module is still doing nothing. Let's make it subscribe to an IRIS hook.

"},{"location":"development/modules/quick_start/processor/#subscribing-to-a-hook","title":"Subscribing to a hook","text":"

Hooks allow to be notified by IRIS when a specific event occurs (IOC creation, deletion, etc). For a comprehensive description of hooks, please see the Hooks section of this documentation.

The registration (or subscription) to a hook occurs at two moments during the life of a module:

  • When the module is added to IRIS
  • When the configuration of the module is changed by an Admin. This allows dynamic subscription and deregistration of hooks depending on the config.

These registration/deregistration events are triggered by IRIS, and are propagated to modules through the IrisModuleInterface method register_hooks [ref].

To register to a hook, we need to override this method and register our hook within this method. To do so, IrisModuleInterface offers us another method register_to_hook [ref], which we can call for each hook we want to subscribe.

Here is a summary of the events:

  1. IRIS calls register_hooks of our module. This indicates it is time for us to register our hooks.
  2. Within this method, we call register_to_hook for each hook we want to subscribe

Let's add this to our main class and register to the on_postload_ioc_create. This will notify use each time a new IOC is created and committed to the database.

iris_dummy_module/IrisDummyModule.py
#!/usr/bin/env python3\n# Import the IrisInterface class\nfrom iris_interface.IrisModuleInterface import IrisModuleInterface\n# Create our module class\nclass IrisDummyModule(IrisModuleInterface):\n# Set the configuration\n_module_name = interface_conf.module_name\n_module_description = interface_conf.module_description\n_interface_version = interface_conf.interface_version\n_module_version = interface_conf.module_version\n_pipeline_support = interface_conf.pipeline_support\n_pipeline_info = interface_conf.pipeline_info\n_module_configuration = interface_conf.module_configuration\n_module_type = interface_conf.module_type\ndef register_hooks(self, module_id: int):\n\"\"\"\n        Called by IRIS indicating it's time to register hooks.  \n        :param module_id: Module ID provided by IRIS.\n        \"\"\"\n# Call the hook registration method. We need to pass the \n# the module_id to this method, otherwise IRIS won't know \n# to whom associate the hook. \n# The hook name needs to be a well known hook name by IRIS. \nstatus = self.register_to_hook(module_id, iris_hook_name='on_postload_ioc_create')\nif status.is_failure():\n# If we have a failure, log something out \nself.log.error(status.get_message())\nelse:\n# Log that we successfully registered to the hook \nself.log.info(f\"Successfully subscribed to on_postload_ioc_create hook\")\n

That's it! Our module has now officially subscribed to a hook and will be notified each time an IOC is created.

So how the module is notified? Once again this is done by a method named hooks_handler [ref] that IrisModuleInterface provides, and we need to overwrite.

This method is called each time one of the event associated to the hook we subscribed is triggered. It provides the name of the hook and as well as the data associated to it. By overwriting this method, we can process the hook and the data!

We will add a condition in this method, that is if the administrator sets the module parameter log_received_hook to False, then the module won't log anything and simply return the data.

Hint

The current configuration of the module can be accessed with the attribute self._dict_conf.

iris_dummy_module/IrisDummyModule.py
#!/usr/bin/env python3\n# Import the IrisInterface class\nfrom iris_interface.IrisModuleInterface import IrisModuleInterface\n# Create our module class\nclass IrisDummyModule(IrisModuleInterface):\n# Set the configuration\n_module_name = interface_conf.module_name\n_module_description = interface_conf.module_description\n_interface_version = interface_conf.interface_version\n_module_version = interface_conf.module_version\n_pipeline_support = interface_conf.pipeline_support\n_pipeline_info = interface_conf.pipeline_info\n_module_configuration = interface_conf.module_configuration\n_module_type = interface_conf.module_type\ndef register_hooks(self, module_id: int):\n\"\"\"\n        Called by IRIS indicating it's time to register hooks.  \n        :param module_id: Module ID provided by IRIS.\n        \"\"\"\n# Call the hook registration method. We need to pass the \n# the module_id to this method, otherwise IRIS won't know \n# to whom associate the hook. \n# The hook name needs to be a well known hook name by IRIS. \nstatus = self.register_to_hook(module_id, iris_hook_name='on_postload_ioc_create')\nif status.is_failure():\n# If we have a failure, log something out \nself.log.error(status.get_message())\nelse:\n# Log that we successfully registered to the hook \nself.log.info(f\"Successfully subscribed to on_postload_ioc_create hook\")\ndef hooks_handler(self, hook_name: str, data):\n\"\"\"\n    Called by IRIS each time one of our hook is triggered. \n    \"\"\"\n# read the current configuration and only log the call if \n# our parameter is set to true \nif self._dict_conf.get('log_received_hook') is True:\nself.log.info(f'Received {hook_name}')\nself.log.info(f'Received data of type {type(data)}')\n# Return a standardized message to IRIS saying that everything is ok. \n# logs=list(self.message_queue) is needed, so the users can see the logs \n# our module generated during its execution.  \nreturn InterfaceStatus.I2Success(data=data, logs=list(self.message_queue))\n

We are done! Our module is now fully ready to register, subscribe to a hook and act when notified.

"},{"location":"development/modules/quick_start/processor/#installing-and-registering-the-module","title":"Installing and registering the module","text":"

We need now need to build and install the module. To do so, you'll need this script and an IRIS docker instance running on the same machine.

The script will build the module, copy it to the docker instances, install it within them and restart the dockers.

  1. From within the root directory of the module, paste the script
  2. Make it executable chmox +x buildnpush2iris.sh
  3. Execute it ./buildnpush2iris.sh -a

The module should now be installed. We can register it in IRIS as explained here.

"},{"location":"operations/alerts/","title":"Alerts","text":"

Introduced in IRIS v2.1.0

Alerts can be fed directly into IRIS using the Alerts API. Any source can inject alerts into IRIS, as long as it can send HTTP requests and respects the alert format.

A service account with the alert_read and alert_write permission can be used to send alerts to IRIS.

Warning

This section is only available for users with the alert_read and alert_write permissions.

"},{"location":"operations/alerts/#viewing-alerts","title":"Viewing alerts","text":"

Alerts can then be viewed in the Alerts section of IRIS. Analysts can then triage the alerts and create cases from them.

Each alert can be expanded to show more details.

"},{"location":"operations/alerts/#alerts-assignment","title":"Alerts assignment","text":"

Alerts can be assigned to analysts. This can be done directly from the alert view.

To self-assign an unassigned alert, click on the hand icon on the left.

Clicking again on the hand icon will prompt with a list of analysts to assign the alert to.

The right button Assign, when hovering above an alert, can also be used to assign the alert to an analyst.

"},{"location":"operations/alerts/#merge-escalation-operations","title":"Merge / escalation operations","text":""},{"location":"operations/alerts/#creating-cases-from-alerts","title":"Creating cases from alerts","text":"

Alerts can be escalated/merged into a new case. When hovering above an alert, a Merge button will appear.

Once clicked, a new window appears, requesting additional information. In this window, the analyst can:

  • Set the name of the case
  • Select the case template
  • Select the IOCs to import
  • Select the assets to import
  • Add an escalation note
  • Set the case tags
  • Choose if the alert should be imported in the timeline as an event
"},{"location":"operations/alerts/#merge-alerts-into-an-existing-case","title":"Merge alerts into an existing case","text":"

Alerts can also be escalated/merged into an existing case. When hovering above an alert, a Merge button will appear.

Once clicked, a new window appears requesting additional information. The button Merge into existing case needs to be clicked. A new dropdown appears and allows to select the case to merge the alert into.

Similar to the case creation, the analyst can:

  • Select the IOCs to import
  • Select the assets to import
  • Add an escalation note
  • Choose if the alert should be imported in the timeline as an event

The selected IOCs and assets are then added to the selected case.

"},{"location":"operations/alerts/#unmerge-alerts-from-a-case","title":"Unmerge alerts from a case","text":"

Alerts can be unmerged from a case.

Info

When unmerging an alert, the alert is not deleted. It is only removed from the case. The alert state is not changed. The IOCs and assets are not removed from the case.

When a case is merged, a new link appears on the alert and mentions the case it was merged into. Clicking on this link allows to browse the case or to unmerge the alert.

"},{"location":"operations/alerts/#alerts-relationships","title":"Alerts relationships","text":"

Each alert have a Relastionships section. This section shows the relationships between the alert and other objects in IRIS. This feature is in preview and might report false relationships.

The relationships are computed using the following logic:

  • Same IOC, based on the IOC type and value
  • Same Asset, based on the asset type and name

By default the view limits the relationships to 100 nodes and looks back 7 days. This can be updated directly in the alert view.

"},{"location":"operations/api/","title":"API","text":"

IRIS is meant to be plug-able and be integrated with the existing environments.

Through the REST API, one can do almost as much as it is possible to do through the web interface. Under the hood, the web interface is actually talking to the API.

The API endpoints are reachable on the same port as the web interface, i.e 443/HTTPS by default.

Hint

A Python client is available here to ease the automation.

"},{"location":"operations/api/#api-keys","title":"API Keys","text":"

The first step is to obtain an API key. Each user is automatically attributed one when it is created. It can be found on the left panel, under username and My Settings.

Token exposure

In case the token is exposed and needs to be changed, a new one can be generated with the Renew option. Renewing a token revokes the previous.

"},{"location":"operations/api/#references","title":"References","text":"

The API constantly evolves with IRIS and thus multiple versions exists. Use the references below to check which API version applies to your IRIS version. Starting from IRIS v1.4.0, the supported API version can also be checked in the UI Advanced > Server settings.

IRIS Version API Version & Reference v1.2.0 API v1.0.0 v1.2.1 API v1.0.0 v1.3.0 API v1.0.1 v1.3.1 API v1.0.1 v1.4.0 API v1.0.2 v1.4.1 API v1.0.2 v1.4.2 API v1.0.2 v1.4.3 API v1.0.3 v1.4.4 API v1.0.3 v1.4.5 API v1.0.3 v2.0.x API v2.0.0 v2.1.x API v2.0.1 v2.2.x API v2.0.1 v2.3.x API v2.0.2 v2.4.x API v2.0.4 - Documentation to be released"},{"location":"operations/api/#how-to-use","title":"How to use","text":"

The API token is used as a Bearer and needs to be present in the header Authorization when issuing requests. For example, to list all the cases: 

   curl --request GET \\\n--url http://<yourserver_ip>/manage/cases/list?cid=1 \\\n--header 'Authorization: Bearer mWpCUVNzBMU5EnbIAK50jLPhYjKBTHZjobdogc_n_yixpJTmt9tzAf8WYDI7m5XgB9wCJnlaXlHIh9RZjtp2fA' \\\n--header 'Content-Type: application/json'\n

The only way to revoke a token is to renew the current one. Once done, the previous API token does not exist anymore in the database and it becomes ineffective.

"},{"location":"operations/case_templates/","title":"Case templates","text":"

Introduced in IRIS v2.1.0

Case templates are a way to pre-configure a case with a set of predefined informations. The case templates can be managed in Advanced > Case templates.

Info

This section is only available for users with the administrator role.

Case templates are made of a set of informations that will be used to pre-fill the case creation form. The following elements can be set:

  • Title prefix: A prefix to add to case title,
  • Summary: content to prefill the summary,
  • Classification: The classification of the case. Should be a lowercase name matching an existing classification in IRIS,
  • Tags: A list of case tags,
  • Tasks: A list of dictionaries defining tasks. Tasks are defined by title (required), description, and list of tags,
  • Notes: A list of dictionaries defining note directories. Note directories are defined by title (required), and list of notes. Notes have title (required) and content

Looking for case templates?

We are providing a set of case templates in the IRIS Resources repository.

"},{"location":"operations/case_templates/#structure-of-templates","title":"Structure of templates","text":"

The following defines the structure of a case template: 

{\n\"name\": \"ransomware_infection\",\n\"display_name\": \"Ransomware Infection Template\",\n\"description\": \"This case template describes first-response tasks to handle information system compromised by a ransomware.\",\n\"author\": \"DFIR-IRIS\",\n\"classification\": \"malicious-code:ransomware\",\n\"title_prefix\": \"[RANS]\",\n\"summary\": \"# Context \\n\\n\\n# Contact \\n\\n\\n# Actions \\n\\n\\n\",\n\"tags\": [\"ransomware\",\"malware\"],\n\"tasks\": [\n{\n\"title\": \"Identify the perimeter\",\n\"description\": \"The perimeter of compromise must be identified\",\n\"tags\": [\"identify\"]\n},\n{\n\"title\": \"Collect compromised hosts\",\n\"description\": \"Deploy Velociraptor and start collecting evidence\",\n\"tags\": [\"collect\", \"velociraptor\"]\n},\n{\n\"title\": \"Containment\"\n}\n],\n\"note_directories\": [\n{\n\"title\": \"Identify\",\n\"notes\": [\n{\n\"title\": \"Identify the compromised accounts\",\n\"content\": \"# Observations\\n\\n\"\n}\n]\n},\n{\n\"title\": \"Collect\",\n\"notes\": [\n{\n\"title\": \"Velociraptor deployment\"\n},\n{\n\"title\": \"Assets collected\",\n\"content\": \"# Assets collected\\n\\n# Assets not collected\"\n}\n]\n}\n]\n}\n
"},{"location":"operations/case_templates/#using-case-templates","title":"Using case templates","text":"

Case templates can be used when creating a new case. On the UI, when creating a case, select the case template to use in the Case template dropdown. The case will then automatically use the informations defined in the template.

"},{"location":"operations/configuration/","title":"Configuration","text":"

Since v2.0.0 the entire configuration is done through the .env file at the root of the IRIS directory.

"},{"location":"operations/configuration/#default-configuration","title":"Default configuration","text":"

The default configuration is provided through a .env.model file at the root of the IRIS directory. One need to copy this file to .env and modify it if needed.

The default configuration is suitable for testing only. See the section below to configure IRIS for production.

"},{"location":"operations/configuration/#production-configuration","title":"Production configuration","text":""},{"location":"operations/configuration/#secrets","title":"Secrets","text":""},{"location":"operations/configuration/#required-changes","title":"Required changes","text":"

The following secrets in the .env need to be changed for production. We recommend using OpenSSL to generate different values from each secret: openssl rand -base64 64

  • POSTGRES_PASSWORD: Password of the postgres user
  • POSTGRES_ADMIN_PASSWORD: Password of the db admin user
  • IRIS_SECRET_KEY: Key used by Flask to secure the session cookies
  • IRIS_SECURITY_PASSWORD_SALT: A salt used for password encryption in the DB

Critical configuration

These settings are critical and need to be set properly otherwise authentication bypass may occur.

"},{"location":"operations/configuration/#optionnal-changes","title":"Optionnal changes","text":"

To automate the provisionning of IRIS, one might need to set the default administrator API token and password. This can be achieve with the following environment variables. If those variables are not set, random ones are generated during the very first boot of the application.

Warning

The administrator password is printed in the logs. It is recommended to change it as soon as possible. The set of the following environment variables has no effect once the administrator account is created, i.e after the very first boot.

  • IRIS_ADM_PASSWORD: Password of the administrator account. The password need to match the default password policy or the administrator won't be able to login,
  • IRIS_ADM_API_KEY: API key of the administrator. A random long string. No verification for the complexity is done. We recommend using openssl rand -base64 64
"},{"location":"operations/configuration/#certificates","title":"Certificates","text":"

IRIS is configured to use a self-signed certificate by default. This is suitable for testing only. To use your own certificate, you need to set the following environment variables:

  • KEY_FILENAME: The filename of the key file in the certificates/web_certificates directory at the root of the IRIS directory
  • CERT_FILENAME: The filename of the certificate file in the certificates/web_certificates directory at the root of the IRIS directory

Once the changes are done, nginx docker container need to be rebuilt with the following command:

docker-compose stop nginx\ndocker-compose build nginx --no-cache\ndocker-compose up
"},{"location":"operations/configuration/#authentication","title":"Authentication","text":""},{"location":"operations/configuration/#ldap","title":"LDAP","text":"

IRIS can be configured to use LDAP authentication. See the Authentication section for more details.

"},{"location":"operations/configuration/#available-settings","title":"Available settings","text":"

These environment variables are availabled to be set.

Key Section Opt Description SERVER_NAME Nginx No Passed to the server_name in NGINX configuration KEY_FILENAME Nginx No SSL Cert key filename passed to the NGINX configuration CERT_FILENAME Nginx No SSL Cert filename passed to the NGINX configuration INTERFACE_HTTPS_PORT Nginx Yes Listening interface of IRIS POSTGRES_USER DB No Name of the POSTGRES user POSTGRES_PASSWORD DB No Password of the POSTGRES user POSTGRES_ADMIN_USER DB No Name of the admin user POSTGRES_ADMIN_PASSWORD DB No Password of the ADMIN user POSTGRES_DB DB No Name of the DB used by IRIS POSTGRES_SERVER DB No Hostname or IP of the DB POSTGRES_PORT DB No Port of the DB server DOCKERIZED IRIS Yes Set to 1 when using dockers (default) IRIS_SECRET_KEY IRIS No Secret key used to secure sessions - needs to be random IRIS_SECURITY_PASSWORD_SALT IRIS No Secret used to salt the passwords in DB - needs to be random IRIS_UPSTREAM_SERVER IRIS No WebApp upstream server - used to configure nginx reverse proxy IRIS_UPSTREAM_PORT IRIS No WebApp upstream server port - used to configure nginx reverse proxy IRIS_ORGANISATION_NAME IRIS No Name of the company / organisation. Used on the UI IRIS_LOGIN_BANNER_TEXT IRIS No Text displayed on the login page IRIS_LOGIN_PTFM_CONTACT IRIS No Contact information displayed on the login page IRIS_UPLOADED_PATH IRIS No Path to store uploaded data. IRIS_BACKUP_PATH IRIS No Path to store backup files. IRIS_TEMPLATES_PATH IRIS No Path of the templates IRIS_DATASTORE_PATH IRIS No Path of the datastore files IRIS_DEMO_ENABLED Demo No Set to True to switch IRIS to Demo mode IRIS_DEMO_DOMAIN Demo No URL of the demonstration server IRIS_DEMO_USER_SEED Demo No Random seed to generate demo users IRIS_DEMO_ADM_SEED Demo No Random seed to generate admin users for demo CELERY_BROKER Celery No Broker URL used to handle IRIS tasks IRIS_AUTHENTICATION_TYPE Auth No IRIS auth mode : local or ldap IRIS_ADM_PASSWORD Auth Yes Set to use as initial password of the administrator account. Only works for the very first run of IRIS. Needs to match the password policy IRIS_ADM_API_KEY Auth Yes Set to use as initial API Key of the administrator IRIS_ADM_EMAIL Auth Yes Set to use as initial email of the administrator IRIS_ADM_USERNAME Auth Yes Set to use as initial username of the administrator LDAP_SERVER Auth Yes LDAP server IP or domain LDAP_PORT Auth Yes LDAP server port LDAP_USER_PREFIX Auth Yes Prefix to search the users within LDAP_USER_SUFFIX Auth Yes Suffix to search the users within LDAP_USE_SSL Auth Yes Set to True to use LDAPS LDAP_VALIDATE_CERTIFICATE Auth Yes Set to True to verify the server certificate validity LDAP_TLS_VERSION Auth Yes TLS version to use LDAPS LDAP_SERVER_CERTIFICATE Auth Yes Path of the LDAP server certificate LDAP_PRIVATE_KEY Auth Yes Path of the LDAP private certificate LDAP_PRIVATE_KEY_PASSWORD Auth Yes Password of the private key LDAP_AUTHENTICATION_TYPE Auth Yes Simple, SASL or NTLM LDAP_CUSTOM_TLS_CONFIG Auth Yes If set to true, the TLS configuration is not set by IRIS and taken from the defined environment. Default to False"},{"location":"operations/custom_attributes/","title":"Custom Attributes","text":"

Introduced in IRIS v1.4.0

All the case objects can be extended with custom attributes. These attributes can be added by :

  • Administrators via the GUI
  • Modules (for instance, the VT module adds a VT Report attribute to each objects it analyses)

Attributes offer the ability to :

  • Add inputs for analysts to fill additional details
  • Add static/dynamic content such as HTML/JS for enhanced possibilities.

This section only describes how an administrator can add or delete attributes to an object.

Tip

We have publish a detailed article of custom attributes with advanced usage on our blog.

"},{"location":"operations/custom_attributes/#management-page","title":"Management page","text":"

Custom attributes can be changed in the Advanced > Custom Attributes section on the left panel.

The page lists the objects for which custom attributes can be added or modified.

  • Cases
  • Customers
  • Evidences
  • Notes
  • Tasks
  • Assets
  • Events
  • IOC
"},{"location":"operations/custom_attributes/#attributes-structure","title":"Attributes structure","text":"

Attributes are defined in JSON which describes tabs and fields that makes the attributes. 

  {\n\"Tab Name 1\": {                     // Defines a new tab \n\"Field 1\": {                    // Defines a new field within the Tab Name 1\n\"type\": \"input_string\",     // Defines the type of field, here a standard string input\n\"mandatory\": true,          // Indicates whether the field is mandatory upon saving\n\"value\": \"\"                 // Default value if any, else empty\n},\n\"Field 2\": {                    // Defines a second field within the tab Tab Name 1\n\"type\": \"input_checkbox\",   // Defines an input checkbox\n\"mandatory\": false,         // Indicates whether the field is mandatory upon saving\n\"value\": false              // Default value - must be set for booleans\n}\n},\n\"VT report\": {                      // Defines a second tab named VT report\n\"Content\": {                    // Defines a new field Content within the VT Report\n\"type\": \"html\",             // Defines an HTML interpreted content\n\"value\": \"\"                 // Default value if any, else empty\n}\n}\n}\n

The code above would be rendered as :

With :

  1. The native information of the object. This cannot be changed or updated
  2. The new attribute Tab Name 1
  3. The other new attribute VT report
"},{"location":"operations/custom_attributes/#attributes-taxonomy","title":"Attributes taxonomy","text":"

The available fields type are available for rendering :

  • input_string: Standard input text
  • input_textfield: Standard input textfield
  • input_checkbox: Standard checkbox
  • input_date: Standard date input
  • input_datetime: Standard date and time input
  • input_select: Standard select input. Need \"options\" tag to describe the available options, as a list of string.
  • raw: A static content rendered in raw text. HTML is not be interpreted.
  • html: A static content rendered as HTML. This is by nature prone to abuse, but at the same time allows adding custom JS scripts.
"},{"location":"operations/custom_attributes/#updating-resetting-attributes","title":"Updating / resetting attributes","text":"

When an attribute is updated, it will try to update all the existing objects with the new attributes. To prevent any data loss from previous attributes and attributes pushed by modules, the update is only made on attributes which don't have any values set or are type-compatibles (ie string to textfield).

The migration of an attribute can however be forced in two ways, both resulting in potential attributes data loss.

Good to know

Migrating or overwriting attributes never change the native information of an object. It only applies to custom attributes.

Partial overwrite basically resets all the values of every target objects that matches the current attribute definition. All associated values are lost. This does not impact attributes pushed by modules or previous configuration.

Complete overwrite resets all attributes of every target objects, including the ones created by modules, and then applies the current attributes. All associated values are lost.

"},{"location":"operations/custom_attributes/#example","title":"Example","text":"

Custom attributes can be more complex than what presented above. With the html type, it is possible to build almost anything. Below is an example of the custom attributes used in the IrisVT module. The {{ }} are used withing the module to generates the page with data received from VT.

Note : This example won't work as is, the value field is expanded here for reability.

IrisVT default custom attribute
{\n\"VT report\": {                      \"Content\": {                    \"type\": \"html\",             \"value\": \"<div class='row'>\n                    <div class='col-12'>\n                        <h3>Basic information</h3>\n                        <dl class='row'>\n                            {% if results.as_owner %}\n                            <dt class='col-sm-3'>AS owner</dt>\n                            <dd class='col-sm-9'>{{ results.as_owner }}</dd>\n                            {% endif %}\n                            {% if country %}\n                            <dt class='col-sm-3'>Country</dt>\n                            <dd class='col-sm-9'>{{ results.country }}</dd>\n                            {% endif %}\n                        </dl>\n                    </div>\n                </div>    \n                {% if nb_detected_urls %}\n                <div class='row'>\n                    <div class='col-12'>\n                        <h3>Detected URLS</h3>\n                        <dl class='row'>\n                            <dt class='col-sm-3'>Total detected URLs</dt>\n                            <dd class='col-sm-9'>{{ nb_detected_urls }}</dd>\n                            <dt class='col-sm-3'>Average detection ratio</dt>\n                            <dd class='col-sm-9'>{{ avg_urls_detect_ratio }}</dd>\n                        </dl>\n                    </div>\n                </div>    \n                {% endif %}\n                {% if nb_detected_samples %}\n                <div class='row'>\n                    <div class='col-12'>\n                        <h3>Detected communicating samples</h3>\n                        <dl class='row'>\n                            <dt class='col-sm-3'>Total detected samples</dt>\n                            <dd class='col-sm-9'>{{ nb_detected_samples }}</dd>\n                            <dt class='col-sm-3'>Average detection ratio</dt>\n                            <dd class='col-sm-9'>{{ avg_samples_detect_ratio }}</dd>\n                        </dl>\n                    </div>\n                </div>    \n                {% endif %}\n                <div class='row'>\n                    <div class='col-12'>\n                        <div class='accordion'>\n                            <h3>Additional information</h3>\n                            {% if results.resolutions %}\n                            <div class='card'>\n                                <div class='card-header collapsed' id='drop_res' data-toggle='collapse' data-target='#drop_resolutions' aria-expanded='false' aria-controls='drop_resolutions' role='button'>\n                                    <div class='span-icon'>\n                                        <div class='flaticon-file'></div>\n                                    </div>\n                                    <div class='span-title'>\n                                        Resolutions history\n                                    </div>\n                                    <div class='span-mode'></div>\n                                </div>\n                                <div id='drop_resolutions' class='collapse' aria-labelledby='drop_res' style=''>\n                                    <div class='card-body'>\n                                        <ul>\n                                            {% for resolution in results.resolutions %} \n                                            <li>{{ resolution.hostname }} ( Last resolved on {{resolution.last_resolved}} )</li>\n                                            {% endfor %}\n                                        </ul>\n                                    </div>\n                                </div>\n                            </div>\n                            {% endif %}\n                        </div>\n                    </div>\n                </div>\n                <div class='row'>\n                    <div class='col-12'>\n                        <div class='accordion'>\n                            <h3>Raw report</h3>\n                            <div class='card'>\n                                <div class='card-header collapsed' id='drop_r' data-toggle='collapse' data-target='#drop_raw' aria-expanded='false' aria-controls='drop_raw' role='button'>\n                                    <div class='span-icon'>\n                                        <div class='flaticon-file'></div>\n                                    </div>\n                                    <div class='span-title'>\n                                        Raw report\n                                    </div>\n                                    <div class='span-mode'></div>\n                                </div>\n                                <div id='drop_raw' class='collapse' aria-labelledby='drop_r' style=''>\n                                    <div class='card-body'>\n                                        <div id='vt_raw_ace'>{{ results| tojson(indent=4) }}</div>\n                                    </div>\n                                </div>\n                            </div>\n                        </div>\n                    </div>\n                </div> \n                <script>\n                var vt_in_raw = ace.edit('vt_raw_ace',\n                {\n                    autoScrollEditorIntoView: true,\n                    minLines: 30,\n                });\n                vt_in_raw.setReadOnly(true);\n                vt_in_raw.setTheme('ace/theme/tomorrow');\n                vt_in_raw.session.setMode('ace/mode/json');\n                vt_in_raw.renderer.setShowGutter(true);\n                vt_in_raw.setOption('showLineNumbers', true);\n                vt_in_raw.setOption('showPrintMargin', false);\n                vt_in_raw.setOption('displayIndentGuides', true);\n                vt_in_raw.setOption('maxLines', 'Infinity');\n                vt_in_raw.session.setUseWrapMode(true);\n                vt_in_raw.setOption('indentedSoftWrap', true);\n                vt_in_raw.renderer.setScrollMargin(8, 5);\n                </script>\"                 }\n}\n}\n
"},{"location":"operations/datastore/","title":"Datastore","text":"

Introduced in IRIS v1.4.5

The datastore offers a way to store files directly in the context of a case. Documents, IOCs, evidences, etc, anything can be uploaded and managed through IRIS.

"},{"location":"operations/datastore/#accessing-the-datastore","title":"Accessing the datastore","text":"

The datastore can be accessed from any page with the top-right shortcut.

A new pane will open, with a default folder tree created for the case.

"},{"location":"operations/datastore/#files","title":"Files","text":""},{"location":"operations/datastore/#adding-a-file","title":"Adding a file","text":"

To add a file to a folder, press the + button near a folder where you want to place it, and select Add file.

A new window appear and allows to upload the file. The following fields are available :

  • Filename : Name of the file to upload. Automatically detected when a file is selected,
  • Description : An optional description of the file,
  • Password : An optional password to encrypt the file in a zip with. Files marked as IOC are automatically protected with infected unless specified otherwise in this field,
  • Tags : Optional tags to help filtering later on,
  • File is IOC : If set, the file is stored on a separate folder on the server and is automatically protected with infected unless specified otherwise in the password field. The file is also added to the IOC tab of the case,
  • File is evidence : If set, the file is stored on a separate folder on the server and is added to the Evidences tab of the case.

A file can be both IOC and Evidence, in which case it is handled as an IOC and also added to the Evidence tab of the case.

Depending on the file size, the upload might take some time. We are aware that the Nginx introduces a delay compared to a direct upload. We have not yet found a configuration that does not impact the speed upload.

Once uploaded, and depending on the options selected, the file appear in the target folder with specific icons. A mouse hover explains what each icon means.

"},{"location":"operations/datastore/#files-operations","title":"Files operations","text":"

Once a file is added, a left-click on it shows a dropdown with multiple options.

  • Link : Copies in the clipboard a direct link to the file,
  • Markdown link : Copies in the clipboard a link in markdown format for direct use in a note or summary. If the file is an image, the copied link is an image tag,
  • Download : Download the file. If the file is password protected, the resulting file is a password protected zip,
  • Info : Shows multiple information on the file such as password, file size, hash, internal name, ID, UUID, etc,
  • Edit : Allows to edit the file information. Uploading a new file replaces the original, the link stays the same. It is however not possible to set a password after the initial upload,
  • Move : Move file to another directory. Once selected, click on the target directory and validate the move,
  • Delete : Delete the file entry and the file from the server. The potential entries added in IOC and Evidences are not updated.

Batch operations such as moving and deleting are also available by clicking on Select at the top right, and then selecting the files.

"},{"location":"operations/datastore/#pasting-in-notes-and-summary","title":"Pasting in notes and summary","text":"

Images can now be directly pasted in notes an summary. Only images are supported. Once an image is pasted, the file is automatically uploaded in the datastore in the folder Notes Upload and a link to the file is inserted.

Example of pasted image

The image is by default sized to 40%. Changing the end of the link =SIZE%xSIZE% allows to resize the image.

The file is now available in the DS and can be replaced if needed. The ID of the file is the one provided in the link, which can help finding out when names are updated.

Note

Under certain conditions (browser, version, OS) the image copy/paste cannot be done directly. This is a known issue, not directly linked to IRIS but related to how browsers handle files in clipboards. If you face this issue, try to open the image and copy it from there instead of the file manager. Otherwise you need to upload it via the Datastore and then get a link from it.

"},{"location":"operations/datastore/#folders","title":"Folders","text":""},{"location":"operations/datastore/#adding-a-folder","title":"Adding a folder","text":"

To add folder, press the + button near a folder where you want to place it, and select Add subfolder.

A new window appear requesting the name of the folder to create. Validate and the new folder appears in the folder tree. Files can then be added to it.

"},{"location":"operations/datastore/#moving-folders","title":"Moving folders","text":"

Folders can be moved within other folders. When doing so, every files and subfolders are also moved, like we are used to with files managers.

Click on the + near the folder to move, and then select Move. The target folder is underlined in blue. Select then the target folder which should appear underline in orange. Then validate the move.

The folder and all its children are moved in the target directory.

"},{"location":"operations/datastore/#searching","title":"Searching","text":"

When dozens of files are added, the filtering bar can be used to quickly find a file. The filtering mechanism is similar to the one in the timeline.

The query schema is : target_element:search_value AND target_element2:search_value2. There is no OR condition and searching without target does not work.

The following target elements can be used to filter :

  • name: Name of the file
  • id: ID of the file
  • uuid: UUID of the file
  • storage_name: Name of the file on the FS
  • tag: Tag of the file
  • description: Description of the file
  • is_ioc : Set to any value to filter files which are IOCs
  • is_evidence: Set to any value to filter files which are evidences
  • has_password: Set to any value to filter files which have passwords
  • sha256: SHA256 to filter files with

"},{"location":"operations/datastore/#under-the-hood","title":"Under the hood","text":"

Here a are a few concepts to better understand how the datastore is working.

Folders represented on the datastore are virtual and do not represent the folders on the system. This is to ensure smooth files operations. The files are never touched again (unless overwritten or deleted) once uploaded. When a file or directory is moved or renamed, only its parent references are updated.

Files are saved by GUID instead of their real names on the system. They are saved under the mapped volume /home/iris/server_data/datastore by default. Then three directories are created :

  • Evidences
  • IOCs
  • Regulars

Within each of these, a new subdirectory with the case ID is created when a file is uploaded. This is ensure IOC, which can be harmful, are formally identified on the server itself. Files can be found on the system by looking up the Storage UUID of the file (eg: dsf-f86926ec-513d-4e47-88fa-02110e7fb412) in these directories.

"},{"location":"operations/logging/","title":"Logging","text":"

All components of IRIS offers by-default logging in the docker instances. Depending on the OS of the hosts, the location of these logs may differ.

For Debian-based distributions, the logs are usually in /var/lib/docker/containers/. The usually interesting logs in IRIS are the following:

  • iriswebapp_app : Contains the logs of core of IRIS, including major stack traces and access control output
  • iriswebapp_worker: Contains the logs of the worker and output of modules
  • iriswebapp_nginx: Contains the logs of the reverse proxy. Every request to IRIS is logged there.
"},{"location":"operations/logging/#setting-up-forwarding","title":"Setting up forwarding","text":"

Logs of IRIS can be forwarded to a SIEM for monitoring. Below is discussed how to setup Splunk forwarding. Other drivers are available and detailed on the docker website.

  1. Enable HEC and get an HEC token from Splunk. See the Splunk documentation
  2. On the host where docker is running, create a file /etc/docker/daemon.json and specify the following content: 
    {\n\"log-driver\": \"splunk\",\n\"log-opts\": {\n\"splunk-insecureskipverify\": \"true\", \"splunk-index\": \"iris\",\n\"splunk-token\": \"YOUR HEC TOKEN\",\n\"splunk-url\": \"https://SPLUNK_SERVER:8088\"\n}\n}\n
  3. Reload the docker daemon: systemctl reload docker. The logs should appear in the Splunk instance.
"},{"location":"operations/reports/","title":"Reports","text":"

IRIS has the ability to generate reports based on the data of an investigation. The reports templates can be managed in Advanced > Templates.

Info

This section is only available for users with the Admin role.

There is two types of reports :

  • Investigation; these contains the investigation data and can produces a custom-ready document
  • Activities; these contains activities done on the case and can be used as a follow-up
"},{"location":"operations/reports/#supported-formats","title":"Supported formats","text":"

The following report formats are supported:

  • docx
  • markdown (.md)
  • html
"},{"location":"operations/reports/#structure-of-templates","title":"Structure of templates","text":"

Reports templates are made of tags, which are then processed and filed by the template engine of IRIS. The templates can have any forms as soon as they respect the tags. We are providing two example of reports.

  • Example of investigation template : Download
  • Example of activities report template : Download

Info

The templates includes a few lines that describes how to handle styles. These should not be removed. They are be present in the generated reports and need to be removed manually.

"},{"location":"operations/reports/#available-tags","title":"Available tags","text":"

The following tags are available. None are mandatory. If a tag is mistyped, the generation step will produce an error message.

Hint

To get the list of available tags for a specific IRIS version, head to /case/export?cid=1.

Hint

Standard objects are accessible with {{ objectname }}. List objects can be looped:

  {% for object in object_list %}\n    {{ object.attribute }}\n  {% endfor %} \n
  • case.name: Name of the case
  • case.description: Description of the case
  • case.open_date: Case open date
  • case.close_date: Case close date
  • case.opened_by: User that initially opened the case
  • case.for_customer: Customer linked to the case
  • case.soc_id: SOC ID number linked to the case

  • evidences: List of evidence objects (see below - given evidence as loop variable)

    • evidence.filename: File name of the evidence
    • evidence.date_added: Date of registration
    • evidence.file_hash: Hash of the evidence
    • evidence.added_by: User who added the evidence
    • evidence.custom_attributes: Custom attributes of the evidence

  • iocs: List of IOCs objects (see below - given ioc as loop variable)

    • ioc.ioc_value: Value of the IOC
    • ioc.ioc_description: Description of the IOC
    • ioc.ioc_type: Type of IOC
    • ioc.ioc_tags: Tags linked to the IOC
    • ioc.custom_attributes: Custom attributes of the IOC

  • notes: List of notes objects (see below - given note as loop variable)

    • note.note_title: Title of the note
    • note.note_content: Content of the note
    • note.note_creationdate: Creation date of the note
    • note.note_lastupdate: Date of last update
    • note.custom_attributes: Custom attributes of the note

  • tasks: List of tasks objects (see below - given task as loop variable)

    • task.task_title: Title of the task
    • task.task_description: Description of the task
    • task.task_open_date: Open date of the task
    • task.task_last_update: Last update of the task
    • task.task_close_date: Date of closure
    • task.task_status: Status of the task
    • task.task_tags: Task for the tags
    • task.custom_attributes: Custom attributes of the task

  • timeline: List of events objects (see below - given event as loop variable)

    • event.event_title: Title of the event
    • event.event_content: Content of the event
    • event.event_raw: Raw content of the event
    • event.event_date: Date when the event happened
    • event.event_source: Source of the event
    • event.category: Category of the event
    • event.event_tags: Tags of the events
    • event.last_edited_by: User who last edited the event
    • event.assets: List of assets names linked to the event
    • event.custom_attributes: Custom attributes of the event
"},{"location":"operations/reports/#examples","title":"Examples","text":""},{"location":"operations/reports/#full-documents","title":"Full documents","text":"

We are providing two example of full reports.

  • Example of investigation template : Download
  • Example of activities report template : Download
"},{"location":"operations/reports/#snippets","title":"Snippets","text":"

The following snippets aimed to be placed directly in the DOCX documents.

"},{"location":"operations/reports/#loops-and-tables","title":"Loops and tables","text":""},{"location":"operations/reports/#standard-loops","title":"Standard loops","text":"

A loop needs to be used for list objects. Loop on IOC example

The IOCs of this case are : \n\n{% for ioc in case.iocs %}\n    - {{ ioc.ioc_value }}\n    - {{ ioc.ioc_description }}\n{% endfor %}\n

"},{"location":"operations/reports/#table-loops","title":"Table loops","text":"

To use a loop in a table, a tr tag needs to be added to the loop and the loop directly integrated in the table. Loop on IOC table example

The IOCs of this case are in the following table : \n\n{%tr for ioc in case.iocs %}\n    {{ ioc.ioc_value }}\n    {{ ioc.type_name }}\n    {{ ioc.ioc_description }}\n{%tr endfor %}\n
Such as :

"},{"location":"operations/reports/#nested-loops","title":"Nested loops","text":"

Loops can be nested. Don't forget to close each loop.

Nested loop
{%for ioc in case.iocs %}\n\n    Custom attributes of {{ ioc.ioc_value }} :\n\n    {% for attribute in ioc.custom_attributes %}\n\n        - {{ attribute }}\n\n    {% endfor %}\n\n{% endfor %}\n
"},{"location":"operations/reports/#conditions","title":"Conditions","text":""},{"location":"operations/reports/#standard","title":"Standard","text":"Check if asset is compromised
{% for asset in assets %} \n\n    {% if asset.compromised %}\n        Asset {{ asset.asset_name }} is compromised\n    {% endif %}\n\n{% endfor %}\n
"},{"location":"operations/reports/#list-is-not-empty","title":"List is not empty","text":"

To check if a list of objects is not empty, use the processor tag count.

Check if case has assets
{% if assets|count %} \n    The case has assets\n{% endif %}\n
"},{"location":"operations/reports/#markdown-handling","title":"Markdown handling","text":"

The case summary and notes are in markdown. A processor tag should thus be added |markdown. Summary as markdown

This is an example of summary : \n\n{{ case.description|markdown }}\n

Loop over notes
This is an example of recursive notes  : \n\n{% for note in case.notes %}\n\n    My note named {{ note.note_title }} : \n    {{ note.note_content|markdown }}\n\n{% endfor %}\n
"},{"location":"operations/reports/#troubleshoot","title":"Troubleshoot","text":"

Most of the time an error of generation is due to misspelled tag or a missing closing tag ({% endfor %}, {% endif %}, etc). In case you cannot figure out what is going wrong, don't hesitate to reach us on Discord.

"},{"location":"operations/server_settings/","title":"Server settings","text":"

Some basic settings can be set in the section Advanced > Server settings.

  • Proxy : These settings can be inherited by modules. This avoid setting proxy for each modules. This is not enforced and is up to the module to use it or not.

  • Behavior :

    • Prevent post-init step to register default modules again during boot: By default if a module is deleted and the server is restart, the module will be registered again. Setting this will prevent this behavior.
    • Prevent post-init step to register default case objects again during boot: By default if case objects are deleted and the server is restart, the case objects will be registered again. Setting this will prevent this behavior.

  • Password policy : the password policy can be changed and is applied for the new users and next changes of users password

"},{"location":"operations/tutorials/","title":"Tutorials","text":"

The tutorials have been discared as we now provide a free demonstration instance on v200.beta.dfir-iris.org. Should you need more information or assistance to use IRIS, you can contact us here.

"},{"location":"operations/upgrades/","title":"Upgrades","text":"

Most of the time, Iris handles upgrades of the database automatically when a new version is started, thus no specific actions are required. However, some breaking changes might need manual intervention. Please use the selectors below to assess if a manual action is required.

Your current version: --Please choose current version-- v1.2.1 v1.3.0 v1.3.1 v1.4.0 v1.4.1 v1.4.2 v1.4.3 v1.4.4 v1.4.5 v2.0.0 v2.0.1 v2.0.2 v2.1.0 v2.2.0 v2.2.1 v2.2.2 v2.2.3 v2.3.0 v2.3.1 v2.3.2 v2.3.3 v2.3.4 v2.3.5 v2.3.6 v2.3.7 v2.4.5 v2.4.6 v2.4.7

Upgrading to: --Please choose target version-- v1.2.1 v1.3.0 v1.3.1 v1.4.0 v1.4.1 v1.4.2 v1.4.3 v1.4.4 v1.4.5 v2.0.0 v2.0.1 v2.0.2 v2.1.0 v2.2.0 v2.2.1 v2.2.2 v2.2.3 v2.3.0 v2.3.1 v2.3.2 v2.3.3 v2.3.4 v2.3.5 v2.3.6 v2.3.7 v2.4.5 v2.4.6 v2.4.7

Check upgrades conditions

For production environments, it is highly recommended to make backups of the DB in case any issues occur during upgrades.

"},{"location":"operations/upgrades/#backing-up-db","title":"Backing-up DB","text":"

Only if you run in production and/or data is critical.

  1. List the current running docker containers docker container list
  2. Spot the IRIS DB container name or ID, and execute the backup
  docker exec <container> pg_dump -U postgres iris_db | \\ \ngzip > ../iris_db_backup.gz\n
  1. Ensure the backup was successful by looking at the gz file 
  zcat ../iris_db_backup.gz | less
"},{"location":"operations/upgrades/#upgrading","title":"Upgrading","text":"

  1. Stop the dockers 

    docker-compose stop\n

  2. Remove the application dockers 

    docker-compose rm app worker\n

  3. Get the last version of Iris 

    git checkout <last_tagged_version>\n

    eg git checkout v2.4.7

  4. Build the new versions 

    docker-compose build --no-cache app worker\n

  5. Run IRIS again. The app will handle the DB migration automatically. 

    docker-compose up\n

"},{"location":"operations/upgrades/#rolling-back","title":"Rolling back","text":"

In case something went wrong, you can rollback to your previous version and restore data.

  1. Remove the faulty docker DB docker-compose down db --volumes
  2. Checkout to the previous version working of IRIS
  3. Rebuild the images docker-compose build --no-cache
  4. Spin up the docker DB, and ONLY this one. docker-compose up db
  5. Get the ID or name of the docker DB docker container list
  6. Restore the DB data zcat ../iris_db_backup.gz | docker exec -i <container> psql -U postgres -d iris_db
  7. Spin up the rest of the dockers docker-compose up
  8. Your data should back.
"},{"location":"operations/upgrades/#version-specific-upgrades","title":"Version specific upgrades","text":""},{"location":"operations/upgrades/#v24x","title":"v2.4.x","text":"

Warning

v2.4.0 to v2.4.6 contains bugs. Please upgrade to v2.4.7 directly.

The update from previous versions to this one is done automatically. However it introduces a number of changes in the API and access control. It may thus break integrations.

Danger

Access control has been updated. Starting from this version, all users have by-default access deny to all the cases, expect explicitely specified otherwise by group membership or automatic access rights. Users can also now be linked to customers, which automatically give them access to the related alerts and cases.

  • The migration to the new access control system is done automatically.
  • New users will not have access to any cases until they are explicitely granted access.
  • Existing users will keep their previous access rights.
  • Existing users will not be linked to any customer. They will need to be linked to a customer to have access to the new cases.
  • Existing users not linked to customers will not see any alerts. They need to be added to the corresponding customer to see the alerts.

Please refer to the API documentation to update any integration which may use the following features:

  • Notes
  • Timeline
  • Acccess control

The layout of the reporting has been updated as well. Refer to the https://<server>/case/export?cid=<case_id> endpoint to get all the possible fields.

"},{"location":"operations/upgrades/#v234","title":"v2.3.4","text":"

\u2757 The layout of the reporting has slightly changed. Custom report templates might not work anymore. You can use https://<server>/case/export?cid=<case_id> to get all the possible fields.

No other impact is to be expected.

"},{"location":"operations/upgrades/#v210","title":"v2.1.0","text":"

The default location of the SSL certificates have been changed from dockers/nginx/dev_certs to certificates/nginx/web_certificates. The docker-compose.yml has thus been updated to mount this volume on the nginx Docker.

Except these changes, users in v2.0.x can upgrade to v2.1.0 without any manual intervention. Users in v1.4.x need to follow the v2.0.0 upgrade instructions before upgrading to v2.1.0.

"},{"location":"operations/upgrades/#v200","title":"v2.0.0","text":""},{"location":"operations/upgrades/#breaking-changes","title":"Breaking changes","text":"

This version brings breaking changes on the following:

  • API
  • Modules
  • Python Client
  • Environment variables in the .env configuration
  • Default listening ports of IRIS WebApp

Warning

Custom made modules need to be upgraded to IRIS Module Interface v1.2.0. Please see modules upgrade for v2.0.0

"},{"location":"operations/upgrades/#instance-migration","title":"Instance migration","text":"

To migrate an instance from v1.4.5, one can use the script in upgrades/upgrade_to_2.0.0.py located in the repository. These commands needs to be run from the root of the repository (pwd should return something like /iris-web): 

# Pull the lastest version \ngit pull # Checkout to iris v2.0.0\ngit checkout v2.0.0 # Check if upgrades possible\npython3 upgrades/upgrade_to_2.0.0.py --check\n\n# Run the upgrade\npython3 upgrades/upgrade_to_2.0.0.py --install\n

The script will take care of migrating the environment variables to reflect the changes in v2.0.0. Please review the .env file afterward.

The port have been changed 443. The script asks if the previous port should be kept or migrated to the new one.

Once validated, one can proceed with the usual upgrade methodology. 

docker-compose stop \ndocker-compose build --no-cache \ndocker-compose up -d\n
"},{"location":"operations/upgrades/#v200-modules-upgrades","title":"v2.0.0 modules upgrades","text":"

This only concerns custom modules not shipped with IRIS Web App. The IRIS module interface has been upgraded to v1.2.0. No breaking changes are associated. One need to change the iris_module_interface dependency to 1.2.0 in the requirements and rebuild the module.

"},{"location":"operations/upgrades/#python-client","title":"Python client","text":"

The client has been updated to reflect the latest changes of the API. It also integrates features that were missing previously, such as Datastore Management. Some methods have been deprecated and some other modified. The easiest way to upgrade is to increase the version in the requirements and test. Each deprecated method will produce a warning or raise an exception.

"},{"location":"operations/upgrades/#v145","title":"v1.4.5","text":"

If you are coming from IRIS <= v1.3.1 please read this. Changes have been made to the NGINX docker to allow upload of big files for the datastore. It is hence necessary to also rebuild the NGINX docker this time.

  1. Stop the dockers docker-compose stop
  2. Remove the application dockers docker-compose rm app worker
  3. Get the last version of Iris git checkout <last_tagged_version> - eg git checkout v1.4.5
  4. Build the new versions docker-compose build --no-cache app worker nginx
  5. Run IRIS again. docker-compose up
"},{"location":"operations/upgrades/#v144","title":"v1.4.4","text":"

This only applies if you are coming from IRIS <= v1.3.1.

This version brings breaking changes in the DB docker by adding a named volume instead of the default one. This implies that previous existing database is ignored as the new docker won't know which volume was previously used. To prevent this, please strictly follow the guide below. This will copy the data of the existing volume, to the new named one.

  1. Spot the IRIS DB container with docker container list. It should look like iris-web-db-x
  2. Fetch the current db volume ID (name field with the command below)

docker inspect <iris_db> | grep -A5 \"Mounts\"\n# Example of output\n\"Mounts\": [\n{\n\"Type\": \"volume\",\n      \"Name\": \"a90b9998a3233a68438c8e099bd0ba98d9f62c9734e40297b8067f9fdb921eb9\",\n      \"Source\": \"/var/lib/docker/volumes/a90b9998a3233a68438c8e099bd0ba98d9f62c9734e40297b8067f9fdb921eb9/_data\",\n      \"Destination\": \"/var/lib/postgresql/data\",\n
3. Stop all the IRIS dockers : docker-compose stop 4. Create a new empty volume : docker volume create --name iris-web_db_data 5. Run a volume copy via a dummy image : 
docker run --rm -it -v <previous_db_volume_id>:/from:ro -v iris-web_db_data:/to alpine ash -c \"cd /from ; cp -av . /to\"\n# With the example of 2., this gives \ndocker run --rm -it -v a90b9998a3233a68438c8e099bd0ba98d9f62c9734e40297b8067f9fdb921eb9:/from:ro -v iris-web_db_data:/to alpine ash -c \"cd /from ; cp -av . /to\"\n
6. Pull the last changes from the repository, checkout to v1.4.4, build and run. 

git pull origin git checkout v1.4.4\ndocker-compose build docker-compose up
7. The data should be successfully transferred.

Do not forget to clear out your browser cache, many JS files were changed.

"},{"location":"operations/upgrades/#v143","title":"v1.4.3","text":"

A patch exists for this version. Please directly upgrade to v1.4.4

"},{"location":"operations/upgrades/#v142","title":"v1.4.2","text":"

A patch exists for this version. Please directly upgrade to v1.4.4

"},{"location":"operations/upgrades/#v141","title":"v1.4.1","text":"

A patch exists for this version. Please directly upgrade to v1.4.4

"},{"location":"operations/upgrades/#v140","title":"v1.4.0","text":"

A patch exists for this version. Please directly upgrade to v1.4.4

"},{"location":"operations/access_control/","title":"Access control","text":"

Changes in v2.4.0

Starting from IRIS v2.4.0 the default access control is deny_all for all users. When upgrading, existing users keep their rights on the existing cases.

IRIS offers a granular access control for cases and management features. Two types of access control are available :

  • Permissions (RBAC): Allows control the access to specific management features on the platform (adding users, cases etc.)
  • Cases access (ACL): Allows segregate cases between users

To ease the access control, users can be managed in :

  • Customers: Provides cases and alerts access controls
  • Groups: Provides permissions and cases access controls
  • Users: Provides granular per-user cases access control

A user can be in one or multiple groups and customers. The effective case access control of a user is deduced from its group and customer membership and its own cases access control. The effective permissions are deduced from its groups membership.

"},{"location":"operations/access_control/#cases-access-control-overview","title":"Cases access control overview","text":"

Cases access control offer three levels:

  • deny_all: No access to the case. The user don't even see the case listed,
  • read_only: Read-only access to the case. The user can see everything related to the case but cannot edit,
  • full_access: Read-write access to the case. The user can see and edit everything related to the case, including closing and deleting the case.

Cases access control can be applied through customers, groups and users. It starts with the customers, groups and ends with atomic user access control.

For example, the following configuration gives no access to the user since the atomic user access prevail upon the rest. 

stateDiagram-v2\n    DefaultPermission --> Group_prevail: DenyAll\n\n    state join_groups <<join>>\n    Group1 --> join_groups: ReadOnly\n    Group2 --> join_groups: DenyAll\n    join_groups --> Group_prevail: ReadOnly\n    Group_prevail --> Effective_DenyAll: ReadOnly \n\n    Effective_DenyAll: Resulting Deny All access for user\n    User_Access --> Effective_DenyAll: DenyAll

In the next configuration, the user has Read Only access to the case because the atomic user access is not set, so the access is inherited from the group ownership. 

stateDiagram-v2\n    DefaultPermission --> Group_prevail: DenyAll\n\n    state join_groups <<join>>\n    Group1 --> join_groups: ReadOnly\n    Group2 --> join_groups: DenyAll\n    Group3 --> join_groups: DenyAll\n    join_groups --> Group_prevail: ReadOnly\n\n    Effective_ReadOnly: Resulting Read Only access for user\n    Group_prevail --> Effective_ReadOnly: ReadOnly \n\n    User_Access --> Effective_ReadOnly: Not set

This notably allows to create groups which can join a set of people from different organisations to work on the same case.

In the next configuration, the user pertains to a customer, which give automatically Full Access access to all the cases of the customer. 

stateDiagram-v2\n    DefaultPermission --> Customer_prevail: DenyAll\n\n    Customer1 --> Customer_prevail: FullAccess\n    Group1 --> Effective_FullAccess: Not set\n\n    Effective_FullAccess: Resulting Full Access access for user\n    Customer_prevail --> Effective_FullAccess: FullAccess \n\n    User_Access --> Effective_FullAccess: Not set

In case the user pertains to a customer but is also in a group, the group access prevail upon the customer access. 

stateDiagram-v2\n    DefaultPermission --> Customer_prevail: DenyAll\n\n    Customer1 --> Customer_prevail: FullAccess\n    Group1 --> Group_prevail: ReadOnly\n\n    Customer_prevail --> Group_prevail: FullAccess\n\n    Group_prevail --> Effective_FullAccess: ReadOnly\n\n    Effective_FullAccess: Resulting Read only Access access for user\n\n    User_Access --> Effective_FullAccess: Not set

Finally, the atomic user access prevail upon the rest. 

stateDiagram-v2\n    DefaultPermission --> Customer_prevail: DenyAll\n\n    Customer1 --> Customer_prevail: FullAccess\n    Group1 --> Group_prevail: ReadOnly\n\n    Customer_prevail --> Group_prevail: FullAccess\n\n    User_access --> User_prevail: DenyAll\n    Group_prevail --> User_prevail: ReadOnly\n    User_prevail --> Effective_FullAccess: DenyAll\n\n    Effective_FullAccess: Resulting Deny all Access access for user

"},{"location":"operations/access_control/#permissions-control","title":"Permissions control","text":"

Permissions allow to control the access to specific management features on the platform (adding users, cases etc.). A set of permissions are available:

  • standard_user: which includes the basic access to the interface and create cases
  • server_administrator: which includes managing users, groups
  • alerts_read: which includes access to the alerts
  • alerts_write: which includes access to the alerts and the ability to add new ones
  • alerts_delete: which includes the ability to delete the alerts
  • search across cases: which includes the ability to search across cases
  • customers_read: which includes the ability to read customers
  • customers_write: which includes the ability to add and edit customers
  • case_templates_read: which includes the ability to read case templates
  • case_templates_write: which includes the ability to add and edit case templates
  • activities_read: which includes the ability to read activities
  • all_activities_read: which includes the ability to read all activities of all cases
"},{"location":"operations/access_control/authentication/","title":"Authentication","text":"

IRIS supports local and LDAP authentication. In both cases, users need to be declared in IRIS.

"},{"location":"operations/access_control/authentication/#local-authentication","title":"Local authentication","text":"

Local authentication is the default setting. The password is validated against the local IRIS database. Passwords are stored salted and hashed, it is thus not possible to retrieve them in case they are lost. It is however possible to change them.

"},{"location":"operations/access_control/authentication/#changing-a-lost-password","title":"Changing a lost password","text":"

If another administrative user exists : Being logged as this user, head to the Advanced > Access Control > Users section, and change the administrator password.

If no other administrative user exists : the change cannot be done via IRIS and an access to the backend is needed.

Danger

Do not delete and recreate any users directly from the DB! This will create inconsistencies in the relations and certainly corrupt everything.

  1. Generate the hash of the new password with Python BCrypt in Python prompt

    import bcrypt\nprint(bcrypt.hashpw('<new_password>'.encode('utf-8'), bcrypt.gensalt()))\n

  2. Connect to the DB docker then the Postgresql database iris_db and update the password 

    docker exec -ti <db_docker_id> /bin/bash\n/ # su postgres\n/ # psql\npostgres=# \\c iris_db \npostgres=# UPDATE \"user\" SET password = '<hash>' WHERE \"user\".name = 'administrator';\npostgres=# \\q\nexit\nexit\n
"},{"location":"operations/access_control/authentication/#ldap-authentication","title":"LDAP authentication","text":"

LDAP authentication rely on a LDAP server to verify the password of a user. The user needs to be declared in IRIS. 

graph LR\n    A[User] -->|Authenticate| B(IRIS WebApp)\n    B --> C{User exists in DB?}\n    C -->|Yes| D{LDAP accepted password?}\n    C -->|No| E[Authentication failed]\n    D -->|Yes| F[Authentication succeeded]\n    D -->|No| E[Authentication failed]
"},{"location":"operations/access_control/authentication/#settings","title":"Settings","text":"

The LDAP settings are present in the .env. Once the LDAP server information is set, reboot the Iris WebApp docker needs to be restarted. 

docker-compose restart app\n
"},{"location":"operations/access_control/authentication/#setting-up-ldap-for-the-first-runtime-of-iris","title":"Setting up LDAP for the first runtime of IRIS","text":"

To set up LDAP without having run IRIS priorly, and as the app needs the accounts to be created first before using LDAP, one has to set the IRIS_ADM_EMAIL environment with the LDAP Email of the administrator user.

Example of LDAP configuration for first run
IRIS_AUTHENTICATION_TYPE=ldap\n\n## IP address or FQDN of the ldap server\nLDAP_SERVER=dc1.domain.local\n\n## Port of the LDAP server\nLDAP_PORT=636\n## LDAP Authentication type\nLDAP_AUTHENTICATION_TYPE=SIMPLE\n\n## Prefix to search the users within \nLDAP_USER_PREFIX=uid=\n## Suffix to search the users within\nLDAP_USER_SUFFIX=ou=people,dc=example,dc=com\n\n## Set to True to use LDAPS\nLDAP_USE_SSL=True\n\n## Set to True to verify the server certificate validity\nLDAP_VALIDATE_CERTIFICATE=True\n\n## TLS version to use LDAPS\nLDAP_TLS_VERSION=1.2\n\n## LDAP TLS configuration \nLDAP_CUSTOM_TLS_CONFIG=False\n\n# Set email address of the first user, that will be the admin \nIRIS_ADM_EMAIL=adm@example.com
"},{"location":"operations/access_control/authentication/#setting-up-for-active-directory","title":"Setting up for Active Directory","text":"

To use LDAP with an Active Directory, the following settings can be used:

Example of LDAP configuration for first run with Active Directory
IRIS_AUTHENTICATION_TYPE=ldap\n\n## IP address or FQDN of the ldap server\nLDAP_SERVER=dc1.domain.local\n\n## Port of the LDAP server\nLDAP_PORT=636\n## LDAP Authentication type\nLDAP_AUTHENTICATION_TYPE=SIMPLE\n\n## Prefix to search the users within\nLDAP_USER_PREFIX=DOMAIN\\\n## Suffix to search the users within\nLDAP_USER_SUFFIX=\n## Set to True to verify the server certificate validity\nLDAP_VALIDATE_CERTIFICATE=True\n\n## TLS version to use LDAPS\nLDAP_TLS_VERSION=1.2\n\n## LDAP TLS configuration \nLDAP_CUSTOM_TLS_CONFIG=False\n\n# Set email address of the first user, that will be the admin\nIRIS_ADM_EMAIL=adm@example.com
"},{"location":"operations/access_control/authentication/#setting-up-ldap-after-iris-already-ran","title":"Setting up LDAP after IRIS already ran","text":"

To set up LDAP after IRIS was already run, one only needs to set up the settings described previously without # Set email address of admin IRIS_ADM_EMAIL=adm@example.com and restart the docker.

Usernames in IRIS have to match the ones set in LDAP for the authentication to succeed.

"},{"location":"operations/access_control/authentication/#ldap-certificates","title":"LDAP certificates","text":"

If the LDAP server uses a self-signed certificate, it is possible to add it to the trusted certificates of the IRIS WebApp docker.

  1. Copy the certificate to the certificates/ldap folder of the IRIS root directory.
  2. Set the LDAP_VALIDATE_CERTIFICATE environment variable to True in the .env file.
  3. Set the LDAP_CUSTOM_TLS_CONFIG environment variable to False in the .env file.
  4. Set the LDAP_CA_CERTIFICATE environment variable certificate path used by the LDAP server in the .env file.

If the LDAP server requires a client certificate, it is possible to add it to the trusted certificates of the IRIS WebApp docker.

  1. Copy the certificate and key to the certificates/ldap folder of the IRIS root directory.
  2. Set the LDAP_VALIDATE_CERTIFICATE environment variable to True in the .env file.
  3. Set the LDAP_CUSTOM_TLS_CONFIG environment variable to True in the .env file.
  4. Set the LDAP_PRIVATE_KEY environment to the file name of the key in the .env file
  5. Set the LDAP_PRIVATE_KEY_PASSWORD environment variable to the password of the key in the .env file - if needed
"},{"location":"operations/access_control/groups/","title":"Groups","text":"

Groups offer the possibility to set case access as well as permissions. By default two groups are created:

  • Administrator: users in this group hold the server_administrator permission,
  • Analysts: users in this group hold the standard_user permission

Both groups are set to give full cases access to the users.

"},{"location":"operations/access_control/groups/#setting-up-a-new-group","title":"Setting up a new group","text":"

Head to the Access Control page and click Add group.

Fill the form. All the fields can be changed later on. The field Group name has to be unique on the IRIS instance. Access control and members can be set once the group is created.

"},{"location":"operations/access_control/groups/#configuring-the-group","title":"Configuring the group","text":"

The group can be configured once created by clicking on it in the list.

"},{"location":"operations/access_control/groups/#users","title":"Users","text":""},{"location":"operations/access_control/groups/#adding-users-to-a-group","title":"Adding users to a group","text":"

To add users to the group, go to the Members tab and click Manage.

The User Manager should load and offers a list of users that can be added to the group. Select all the users you want to add to the group and press Save.

Permissions computation

When a user is added/removed to a group, its effective cases access are recomputed. Depending on the number of cases and users added/removed this can take some time. This process helps reducing the DB load when using IRIS during normal operation.

"},{"location":"operations/access_control/groups/#removing-users-from-a-group","title":"Removing users from a group","text":"

To remove users from the group, go to the Members tab and click Manage.

The User Manager should load and present a list of both users already in the group as well as the ones that can be added. To remove one or more users, un-tick them from the list and press Save.

Alternatively, a user can be directly removed from within the group manager. Click on the red trash next to the user to remove and confirm the deletion.

"},{"location":"operations/access_control/groups/#cases","title":"Cases","text":""},{"location":"operations/access_control/groups/#adding-cases-to-the-group","title":"Adding cases to the group","text":"

Access to one or multiple existing cases can be granted to a group. From within the Group Manager, go to the Cases Access tab and click Set case access.

The Cases Access Manager loads and gives the possibility to set the access to one or more cases.

Three choices of access are offered:

  • deny_all: No access at all to the case. The users won't even see the case listed,
  • read_only: Read-only access to the case. The users can see everything related to the case(s) but cannot change anything,
  • full_access: Read-Write access to the case. The users can see and change everything related to the case.

Once the desired access is selected, press Set access.

Permissions computation

As for the addition of users, when a case is added/removed to a group, all the users' effective cases access are recomputed. Depending on the amount of cases added/removed and number of users this can take some time. This process helps reducing the DB load when using IRIS during normal operation.

"},{"location":"operations/access_control/groups/#removing-cases-from-the-group","title":"Removing cases from the group","text":"

From within the Group Manager, go to the Cases Access tab. Click on the red trash next to the case to remove and confirm the deletion.

"},{"location":"operations/access_control/groups/#removing-a-group","title":"Removing a group","text":"

A group can be deleted by clicking on its name in the list and then Delete at the bottom of the Info tab.

"},{"location":"operations/access_control/users/","title":"Users","text":"

Authentication

Looking for authentication settings? It's here

Whatever the authentication mechanism used (Local or LDAP), the users have to be declared in IRIS. This is done in Advanced > Access Control > Users.

"},{"location":"operations/access_control/users/#adding-a-user","title":"Adding a user","text":"

Head to Advanced > Access Control > Users and click Add user. All fields of the form are required. All information can be changed after the creation.

Note

Permissions and groups can be set once the user is created.

  • Full Name : Name of the user to add
  • Login : Username used to login in IRIS. Has to be unique on the instance
  • Email : Email of the user to add. Has to be unique on the instance
  • Password: Password respecting the policy defined in Advanced > Server settings. The password also has to be set when using LDAP, it is then however not used for the authentication. A random password can be set when using LDAP. No password is required when the user is set as a service account.
  • Is service account : If the user is a server account, check this box. Server accounts are used to connect to the API. They cannot login to the UI.

Service accounts

Service accounts users can use the API to perform any actions on the instance. They cannot login to the UI and they don't have a password.

"},{"location":"operations/access_control/users/#editing-a-user","title":"Editing a user","text":"

A user can be edited by clicking on its name or ID in Advanced > Access Control > Users. A window opens and display the user's information. Tabs at the top allow to configure multiple settings related to the user.

"},{"location":"operations/access_control/users/#setting-permissions","title":"Setting permissions","text":"

Permissions of a user cannot be set directly. They are inherited from the groups membership. The tab Permissions only displays the permissions the user has from its groups memberships. See Groups for more info.

"},{"location":"operations/access_control/users/#setting-groups","title":"Setting groups","text":"

Groups can be set by clicking on the Groups tab of the user's window and then Manage.

A new window appears with the possibility to select the groups the user should belong to.

After saving, the permissions of the user are updated. This can be verified in the Permissions tab.

"},{"location":"operations/access_control/users/#setting-customers","title":"Setting customers","text":"

Customers can be set by clicking on the Customers tab of the user's window and then Manage.

A new window appears with the possibility to select the customers the user should belong to.

"},{"location":"operations/access_control/users/#setting-cases-access","title":"Setting cases access","text":"

Cases access are usually set through groups membership. However for granularity they can be set per user. To set the access of a user on a case, click on the Cases access tab of the user's window and then Set case access.

As for the Groups, a selector appears and allows to select one or multiple cases and the access to associate.

Info

Application of a case access is immediate, even if the user is logged in and browsing the case.

Info

Granular case access can also be set from a case itself, in Summary > Manage > Access.

"},{"location":"operations/access_control/users/#deactivating-a-user","title":"Deactivating a user","text":"

A user can be deactivated, which has the following impact:

  • User cannot login anymore
  • User cannot use its API key anymore
  • User is not proposed in tasks assignees anymore

"},{"location":"operations/access_control/users/#deleting-a-user","title":"Deleting a user","text":"

It is usually not possible to delete a user. This is to keep consistency in the database. A user can be deleted if it has done absolutely no actions on the platform. If a user leaves the organisation, it is recommended to rename the user and deactivate it.

"},{"location":"operations/cases/case_operations/","title":"Case operations","text":""},{"location":"operations/cases/case_operations/#opening-a-case","title":"Opening a case","text":"

To open a case anywhere, press the + button in the top right corner. A popup appears and allows to fill the basic information of the new case.

A new window appears, requesting additional information. The following information are required:

  • Customer: Name of the customer the case is related to
  • Case name: Name of the case
  • Short description: Short description of the case - this will be set as the summary of the case

The following information is optional:

  • Case template: Template to use for the case. If not set, the case will be created empty
  • Case classification: The classfication of the case
  • SOC ticket ID: The ID of the ticket in the SOC ticketing system

Once Create is clicked, the case is created and a popup ask whether to the get redirected to the case or to add a new one.

"},{"location":"operations/cases/case_operations/#switching-between-cases","title":"Switching between cases","text":"

Each case has its own context. To switch between cases/context, either click on the name of the current case at the top left, or click on the switch button on the top right.

A popup appears and allows to select the case to switch to. By default the last 100 cases are displayed. To look further in the past, one can use the search bar. Press Save to validate the switch. The page reloads with the new context.

"},{"location":"operations/cases/case_operations/#updating-a-case","title":"Updating a case","text":"

A case metadata can be updated by going switching the case context and heading to Case > Summary. Clicking on Manage brings up a new window with the case metadata. The right pencil button allows to edit the metadata.

The following information can be updated:

  • Case name: Name of the case
  • SOC ticket ID: The ID of the ticket in the SOC ticketing system
  • Case classification: The classfication of the case
  • Case owner: The owner of the case - by default set to the user who created the case
  • Case state: State of the case - by default set to Open. This defines the state of the case (open, closed, etc.).
  • Case outcome: Outcome of the case - by default set to Unknown. This defines if the case is a true positive, false positive, etc.
  • Case customer: Customer of the case
  • Case reviewer: Reviewer of the case
  • Case severity: Severity of the case - by default set to Medium
  • Case tags: Tags of the case - by default set to Open
  • Protagonists: Protagonists of the case - by default none. Those are the actors involved in the case.
"},{"location":"operations/cases/case_operations/#updating-the-access-of-a-case","title":"Updating the access of a case","text":"

The access of a case can be updated by going to Case > Summary > Manage, and from the popup, clicking on the Access tab.

Changes of access are immediately applied.

"},{"location":"operations/cases/case_operations/#closing-a-case","title":"Closing a case","text":"

A case can be closed by going to Case > Summary > Manage, and from the popup, clicking on the Close case button. Closing a case doesn't delete it and it can be reopened at any time. The case can also be modified after it has been closed.

"},{"location":"operations/cases/case_operations/#getting-modifications-history-of-a-case","title":"Getting modifications history of a case","text":"

The modifications history of a case can be retrieved by going to Case > Summary > Manage, and from the popup, clicking on the history icon next to the case name.

"},{"location":"operations/cases/iocs/","title":"IOCs","text":"

IOCs are observables that were identified during the investigation, or that led to the case creation upon monitoring activities.

"},{"location":"operations/cases/iocs/#add-an-ioc","title":"Add an IoC","text":"

An IoC object could be created by going to Case > IOC. Clicking on Add IOC in the top right corner brings up a new window for the IoC creation.

A new window appears, requesting additional information. The following information is required:

  • Type: Type of the IOC. This will have an impact on available modules.
  • IOC Value: The actual IoC.
  • TLP: Traffic Light Protocol value. (Amber by default)

The following information is optional:

  • Description: A .md formatted description of the IoC.
  • Task tags: List of tags.

Once Save is clicked, the ioc is created.

"},{"location":"operations/cases/iocs/#update-an-ioc","title":"Update an IoC","text":"

IoC object data can be updated by clicking on the IoC value in the Case > IOC table. A popup appears and allows to change required and non-required fields.

Once Update is clicked, the IoC is updated.

"},{"location":"operations/cases/iocs/#enrich-an-ioc","title":"Enrich an IoC","text":"

IoC objects can be enriched in order to add valuable information to it.

"},{"location":"operations/cases/iocs/#comment-an-ioc","title":"Comment an IoC","text":"

To comment an IoC, one can right click on it, in the Case > IOC menu, and select Comment. A new pop-up appears and allows to leave comments. This is also achievable by clicking on the IoC value in the Case > IOC table, and by clicking on the Comment button.

"},{"location":"operations/cases/iocs/#launch-a-module-on-an-ioc","title":"Launch a module on an IoC","text":"

To have more information about modules, see the Modules section.

A set of modules can be launched to enrich IoCs. To do so, one can right click on the IoC , in the Case > IOC table, and select the module of choice. This is also achievable by clicking on the IoC value in the Case > IOC table, by clicking the Option button, and selecting the desired module.

The results of the module will appear in newly created tabs, in the IoC details. To view the tabs, click on the the IoC value.

"},{"location":"operations/cases/iocs/#delete-an-ioc","title":"Delete an IoC","text":"

This will permanently delete the IoC and its attributes

To delete an IoC, one could either right click on the IoC, and select Delete, or click on the IoC value, and click on the Delete button.

The IOC is only unlinked from the case if it references other cases

"},{"location":"operations/cases/notes/","title":"Notes","text":"

Attention

The notes layout has been updated in IRIS 2.4.0. The following documentation is valid for IRIS 2.4.0 and above.

IRIS allows analysts to add notes to cases. Notes can be added to a case from the Notes tab. Notes are organized by directories. A note has to live within a directory.

"},{"location":"operations/cases/notes/#adding-a-directory","title":"Adding a directory","text":"

To add a directory, click on the + directory icon on the left side of the Notes tab. A new directory is added to the list and asks for a name.

The title of the directory can be edited by right clicking on it and selecting Rename.

"},{"location":"operations/cases/notes/#adding-a-note","title":"Adding a note","text":"

To add a note, right click on the directory and select Add note. A new note is added to the list.

To rename the note, double click on the title and press enter to confirm.

"},{"location":"operations/cases/notes/#operations","title":"Operations","text":"

Notes and directories can be moved. Right click on the note or directory and select Move. A popup appears and allows to select the destination directory.

"},{"location":"operations/cases/tasks/","title":"Tasks","text":"

Tasks allow incident handlers to split the workload into unit tasks, and to assign them to the team members.

"},{"location":"operations/cases/tasks/#add-a-task","title":"Add a task","text":"

A task can be created by going to Case > Tasks. Clicking on Add Task in the top right corner brings up a new window for the task creation.

A new window appears, requesting additional information. The following information is required:

  • Status: Status of the task.
  • Task Title: Title of the tasks

The following information is optional:

  • Assigned to: The one who should perform the task.
  • Description: A .md formatted description of the task.
  • Task tags: List of tags.

Once Save is clicked, the task is created.

"},{"location":"operations/cases/tasks/#update-a-task","title":"Update a task","text":"

Task metadata can be updated by clicking on the task title in the Case > Tasks table. A popup appears and allows to change required and non-required fields.

Once Update is clicked, the task is updated.

"},{"location":"operations/cases/tasks/#comment-a-task","title":"Comment a task","text":"

Tasks can be commented. This provide the ability for analysts to give more in-deepth information on the task execution (what did they do, how did they do, what are the results, etc.)

To comment a task, one can either right click on the task line and select Comment, or click on the task title, and click on the Comment button. A new windows appears and allows to add comments to the task.

Once Comment is clicked, in the last window, a comment is added to the task. Comments are editable and removable.

"},{"location":"operations/modules/","title":"Introduction","text":"

New types of modules are introduced in IRIS v1.4.0

IRIS can be extended with modules. They can be split in two types:

  • Pipeline modules : Allow upload and process of evidences through modular pipelines (eg: EVTX parsing and injection into a database or data visualiser)
  • Processor modules : Allow processing of IRIS data upon predefined actions / hooks. (eg: be notified when a new IOC is created and get VT/MISP insights for it).

Modules (or DIM - DFIR-IRIS Modules) are actually Python packages which must be installed in the Python environment of iris-webapp and the worker (see Quick Start). Once installed in the Python environment, modules can be managed in Advanced > Modules.

Info

This section is only available for users with the Admin role.

By default IRIS is shipped with multiple modules.

  • IrisVTModule : Processor module offering VirusTotal insights (installed and registered)
  • IrisMispModule : Processor module offering MISP insights (installed and registered)
  • IrisWebHooksModule : Processor module offering webhooks support (manual installation)
  • IrisCheckModule : A basic processor module logging every hooks. Used to check the good functionning. (installed and registered)
  • IrisEVTXModule : A pipeline module offers EVTX import into Splunk through IRIS (installed but not registered)
"},{"location":"operations/modules/mod_management/","title":"Management","text":"

To add a module, the user can click on the \"+\" button:

Then the user must enter the name of the pre-installed module. The name of the pip package must be used.

If everything is ok, the module will appear on the list. It is currently disabled, and needs configuration before it can be enabled. To do so, the user can click on the module's name:

A new text box appears, showing information about the module, and a list of parameters to configure. Each mandatory parameter must be configured to enable the module.

After configuring all the mandatory parameters, the \"Enable button\" is revealed and the user can finally enable the module.

That's all! The user can confirm in the summary that the module is indeed enabled and ready to use.

Finally, the user can either disable or remove the module by clicking on the according buttons.

Now that the module is configured and enabled, let's see how we can use it!

NB: As a temporary fix, after adding and configuring a module, one must restart the IRIS services (dockers) else the worker won't have the module installed properly.

"},{"location":"operations/modules/mod_management/#how-to-use-the-module","title":"How to use the module","text":"

As stated in the beginning, a module extends the capabilities of IRIS. For now, it allows importing evidences of your needs into what we call a pipeline, where data will be handled in the module (checking, parsing, ingestion...). In our provided module, IrisEVTXModule ingest EVTX files, parse them as JSON, and send the results to a Splunk instance using its HTTP event collector (HEC) endpoint.

In IRIS, the files are always imported in the context of a case. To import a file, the user can click on Manage cases then Update tab.

In Processing pipeline, the user can pick a pipeline that will send the files to the wanted module. In our example, EVTX pipeline refers to the IrisEVTXModule module. Below, the user can fill the arguments needed by the according pipeline. Arguments can be optional. Finally, the user can import one or several files and click Update to start their processing by the module.

You can see in the picture below that the user will import four EVTX files.

The user can follow the upload of the different files with their respective progress bars.

Once uploaded, the status of the task can be observed on the DIM Tasks page.

Clicking on a Task ID shows information on the task processing.

After the processing of the files by the module, the list of the imported files is stored in the Evidences tab of the according case.

"},{"location":"operations/modules/natives/IrisMISP/","title":"Module IRIS MISP","text":"

Introduced in IRIS v1.4.0

This module offers an interface with MISP and IRIS to automatically enrich IOCs with MISP insight.

The source code is available here. It is installed by default but needs to be configured to be enabled.

Note

The module is in its early stage and new features will be added over time.

"},{"location":"operations/modules/natives/IrisMISP/#features","title":"Features","text":"

Two types of enrichement mecanism are proposed :

  • Manual : right-click on one or more IOCs and select Get MISP insight. This sends the targets IOCs to the module and insights will be fetched and applied.
  • Automatic:
    • On create : This automatically fetch MISP insight for newly created IOC
    • On update : This automatically fetch MISP insight upon updates of an IOC

The following types of IOCs are handled by the module :

  • ip-*
  • domain
  • hashes of types md5, sha224, sha256, sha512

The insight request on an IOC not handled is simply ignored.

The insights take the form of attributes added to the IOC. They are based on configurable templates.

"},{"location":"operations/modules/natives/IrisMISP/#configuration","title":"Configuration","text":"

The behavior of the module can be configured as needed. Head to the Advanced > Modules > IrisMISP to change it.

  • MISP configuration : A JSON describing the MISP access. See below for the structure.
  • Add MISP report as new IOC attribute : If set to true, the module adds a new attribute with the MISP insight.
  • Domain report template : Provides a right-click menu option on IOCs to trigger the MISP module on selected elements.
  • Triggers automatically on IOC create: If set to true, the module runs each time an IOC is created. Disabled by default.
  • Triggers automatically on IOC update: If set to true, the module runs each time an IOC is updated. Disabled by default.
  • Domain report template: Jinja2 report template for domain IOCs. Refers to the raw report to assess which fields are available.
  • IP report template: Jinja2 report template for IP IOCs. Refers to the raw report to assess which fields are available.
  • Hash report template: Jinja2 report template for hash IOCs. Refers to the raw report to assess which fields are available.
"},{"location":"operations/modules/natives/IrisMISP/#misp-configuration","title":"MISP configuration","text":"

At the time, only one MISP can be added. Future version might handled more than one MISP. The expected structure is the following : 

{\n\"name\": \"Public_MISP\", \"type\":\"public\", \"url\":[\"https://testmisp\"],\n\"key\":[\"<apikey>\"], \"ssl\":[false]\n}\n
"},{"location":"operations/modules/natives/IrisVT/","title":"Module IRIS VT","text":"

Introduced in IRIS v1.4.0

This module offers an interface with VirusTotal and IRIS to automatically enrich IOCs with VT insight. The source code is available here. It is installed by default but needs to be configured to be enabled.

"},{"location":"operations/modules/natives/IrisVT/#features","title":"Features","text":"

Two types of enrichment mechanism are proposed :

  • Manual : right-click on one or more IOCs and select Get VT insight. This sends the targets IOCs to the module and insights will be fetched and applied.
  • Automatic:
    • On create : This automatically fetch VT insight for newly created IOC
    • On update : This automatically fetch VT insight upon updates of an IOC

The following types of IOCs are handled by the module :

  • ip-*
  • domain
  • hashes of types md5, sha224, sha256, sha512

The insight request on an IOC not handled is simply ignored.

Two types of insights are proposed :

  • tags : This adds a vt:malicious or vt:suspicious tag if the detection thresholds are met (configurable). For domains, an ASN tag can also be added.
  • new attribute : This adds a new attribute to the IOC with the VT insight. It is based on a configurable template.
"},{"location":"operations/modules/natives/IrisVT/#configuration","title":"Configuration","text":"

The behavior of the module can be configured as needed. Head to the Advanced > Modules > IrisVT to change it.

  • VT API Key : API key used by the module to connect to VT
  • VT Key is premium : Set to True to indicate the provided API Key is premium.
  • Manual triggers on IOCs : Provides a right-click menu option on IOCs to trigger the VT module on selected elements.
  • Triggers automatically on IOC create: If set to true, the module runs each time an IOC is created. Disabled by default.
  • Triggers automatically on IOC update: If set to true, the module runs each time an IOC is updated. Disabled by default.
  • Assign ASN tag to IP : If set to true, creates a new tag with ASN info on the target IP IOC.
  • IOC tag malicious threshold : Float detection ratio above which the module adds a vt:malicious. To disable, add a value > 100.
  • IOC tag suspicious threshold: Float detection ratio above which the module adds a vt:suspicious. To disable, add a value > 100.
  • Add VT report as new IOC attribute: Creates a new attribute on the IOC, base on the VT report. Templates define on this configuration are used.
  • Domain report template: Jinja2 report template for domain IOCs. Refers to the raw report to assess which fields are available.
  • IP report template: Jinja2 report template for IP IOCs. Refers to the raw report to assess which fields are available.
  • Hash report template: Jinja2 report template for hash IOCs. Refers to the raw report to assess which fields are available.
"},{"location":"operations/modules/natives/IrisWebHooks/","title":"Module IRIS Webhooks","text":"

This module offers webhooks support for IRIS. It can be configured to send almost any events to to an external service supporting webhooks, such as Discord, Slack or Microsoft Teams. It can also be used with automation tools such as Tines and Shufle to further automate IRIS. The source code is available here.

"},{"location":"operations/modules/natives/IrisWebHooks/#features","title":"Features","text":"
  • Support multiple webhooks receivers thanks to its configurable payload
  • Support multiple webhooks receivers at the same time
  • Allows to send one, multiple or all events to an external service

Slack Example

"},{"location":"operations/modules/natives/IrisWebHooks/#configuration","title":"Configuration","text":"

The expected configuration is a JSON file, following the structure : 

{   \"instance_url\": \"<IRIS_INSTANCE_URL>\",\n\"webhooks\": [\n{\n\"name\": \"Name of the webhook for internal reference only\",\n\"active\": false,\n\"trigger_on\": [<LIST OF HOOKS TO LISTEN TO>],\n\"request_url\": \"<URL OF THE WEBHOOK>\",\n\"use_rendering\": true,\n\"request_rendering\": \"<RENDERING TYPE OF THE MESSAGE>\", \"request_body\": {<BODY OF THE REQUET TO SEND>}\n},\n{\n\"name\": \"Another hook\",\n\"active\": false,\n\"use_rendering\": false,\n\"trigger_on\": [<LIST OF HOOKS TO LISTEN TO>],\n\"request_url\": \"<URL OF THE WEBHOOK 2>\",\n\"request_rendering\": \"<RENDERING TYPE OF THE MESSAGE>\", \"request_body\": {<BODY OF THE REQUEST TO SEND 2>}\n}\n]\n}\n
  • instance_url: Base URL of IRIS. This is used to set the links in the messages
  • webhooks: A list of JSON describing the webhooks For each webhook:
    • name: Internal name of the webhook, this can be anything
    • active: Optional - Set to false to disable the webhook
    • trigger_on: List of IRIS hooks for which the webhook should be triggered. Only the on_postload_XX hooks are supported. To enable a set of hooks without writing them all, the following keywords can be used :
      • all: Includes all on_postload hooks
      • all_create: Includes all on_postload_XX_create hooks
      • all_update: Includes all on_postload_XX_update hooks
    • request_url: The URL provided by the webhook receiver. For instance for Slack : see how to get one
    • request_rendering: URLs rendering may be specific from one receiver to another. The modules supports the following :
      • markdown: Format the message as markdown. This can be used with Discord for instance
      • markdown_slack: Format the message as markdown, with some specificities of Slack.
      • html: Format the message as HTML.
    • request_body: The request body to be sent to the webhook receiver. If use_rendering is true, then two markups can be used to set the content of the webhook. The request has to be in JSON format and is sent as-is after replacements of the markups.
      • %TITLE%: Is replaced with name of the case and event title, e.g \"[#54 - Ransomware] IOC created\"
      • %DESCRIPTION%: Description of the event, e.g \"UserX created IOC mimi.exe in case #54\" If use_rendering is false, then a raw json representation of the object related to the hook is available. See examples for more details.
    • manual_trigger_name: The name of the manual trigger in the UI. This should be set if the registered hook is of type on_manual_trigger. This name is displayed as a new menu option in the UI for the target object.
    • use_rendering: Whether the data should be formated in Markdown or not. If set to false, then the request body field can use the raw data such as assets. This will result in a request with the body containing the assets JSON representation related to the call of the hook. See examples for more details.
"},{"location":"operations/modules/natives/IrisWebHooks/#checking-iris-hooks-registration","title":"Checking IRIS hooks registration","text":"

Each time a webhook is added, the module subscribes to the specified hooks. After saving the configuration, one can check the registration was successful by filtering the Registered hooks table (don't forget to refresh the table).

"},{"location":"operations/modules/natives/IrisWebHooks/#examples-without-rendering","title":"Examples without rendering","text":"

The following example is a combination of webhooks that can be used to further automate IRIS. It uses Tines as an example, but this is reproductible with any automation tool that can sent HTTP requests. A Tines story is created and is set up to receive a webhook, such as https://anothertest.tines.io/webhook/xxxx/xxxxx. In this scenario, two IRIS webhooks are added:

  • One to add an option to publish an IOC on MISP from the UI. This is an on_manual_trigger_ioc_update hook.
  • Another one to send a message on Mattermost each time a new case is created. This is an on_postload_case_create hook.

We use the same Tines story and thus Tines webhook for both and dispatch the incoming request depending on its parameters.

"},{"location":"operations/modules/natives/IrisWebHooks/#todo","title":"TODO","text":""},{"location":"operations/modules/natives/IrisWebHooks/#examples-using-rendering","title":"Examples using rendering","text":"

The following is an example of combined webhooks configuration. It can be directly imported in the module with the import feature. Please note that after import, the configuration should be opened and change to match your URL webhook receiver.

Download webhooks combined configuration example

"},{"location":"operations/modules/natives/IrisWebHooks/#discord","title":"Discord","text":"Discord webhook example - selection of events
{   \"instance_url\": \"https://iris.local\",\n\"webhooks\": [\n{\n\"name\": \"Discord\",\n\"trigger_on\": [\n\"on_postload_ioc_create\",\n\"on_postload_ioc_update\",\n\"on_postload_note_create\",\n\"on_postload_note_update\"\n],\n\"request_url\": \"https://discord.com/api/webhooks/XXXX/XXXX\",\n\"request_rendering\": \"markdown\", \"request_body\": {\n\"embeds\": [{\n\"description\" : \"%DESCRIPTION%\",\n\"title\" : \"%TITLE%\"\n}]\n}\n}\n]\n}\n
"},{"location":"operations/modules/natives/IrisWebHooks/#slack","title":"Slack","text":"Slack webhook example - all events
{   \"instance_url\": \"https://iris.local\",\n\"webhooks\": [\n{\n\"name\": \"Slack\",\n\"trigger_on\": [\n\"all\"\n],\n\"request_url\": \"https://hooks.slack.com/services/<XXX>/<XXX>/<XXX>\",\n\"request_rendering\": \"markdown_slack\",\n\"request_body\": {\n\"text\": \"%TITLE%\",\n\"blocks\": [\n{\n\"type\": \"section\",\n\"text\": {\n\"type\": \"mrkdwn\",\n\"text\": \"*%TITLE%*\"\n}\n},\n{\n\"type\": \"section\",\n\"block_id\": \"section567\",\n\"text\": {\n\"type\": \"mrkdwn\",\n\"text\": \"%DESCRIPTION%\"\n}\n}\n]\n}\n}\n]\n}\n
"},{"location":"operations/modules/natives/IrisWebHooks/#troubleshooting","title":"Troubleshooting","text":"

Webhooks receivers are expecting specific message formatting to successfully process them. Please carefully read their documentations.

The module only handles JSON POST for the moment. If the target webhook receiver needs another type of request, please contact us so we can add it.

As any IRIS module, IrisWebhooks is logged into DIM Tasks. You can check the status of the requests made in these. Go to DIM Tasks and then filter with webhooks. You can then check details info by clicking in the Task ID. More info might be available in the Docker worker logs depending on the situation.

"},{"location":"operations/modules/natives/IrisWebHooks/#important-notes-and-know-issues","title":"Important Notes and know issues","text":"
  • The module is in beta and will improve over time. More customization should be brought on the messages.
  • For a complete experience, some features are missing on the server side - such as case info and user info passed to modules. They will be added in the next release and this module will be updated. For instance, IOC events do not hold case info, assets update events do not hold the user info who made the change.
"},{"location":"python_client/","title":"Introduction","text":"

dfir_iris_client offers a Python interface to communicate with IRIS.

It relies exclusively on the API, which means output of the methods are the same as specified in the API reference.

"},{"location":"python_client/#installation","title":"Installation","text":"

It can be easily with pip : pip3 install dfir_iris_client.

The source code of the project is available here.

"},{"location":"python_client/#versions","title":"Versions","text":"

The Python client version follows the API versions (until the patch level). Meaning for API v1.0.1, one need to install dfir_iris_client-1.0.1.

"},{"location":"python_client/#examples","title":"Examples","text":"

Examples of usage are available here.

"},{"location":"python_client/#documentation","title":"Documentation","text":"

The documentation of the client is available on client.docs.dfir-iris.org.

"}]} \ No newline at end of file +{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"Home","text":"

This documentation serves as a comprehensive guide to the IRIS web application operations, modules, and development.

If you're new to IRIS, we recommend starting with our Getting Started guide to learn the basics.

For those who want to try out IRIS easily, we offer a free demonstration instance of the rolling beta version here.

Our documentation is constantly evolving, so if you don't find what you're looking for, please contact us so we can add the missing piece.

"},{"location":"#what-is-iris","title":"What is IRIS?","text":"

IRIS is a collaborative platform for incident response analysts that helps to share investigations at a technical level. It's a web application that can be installed on a fixed-server or on a laptop for roaming investigations where internet might not be available.

IRIS was born out of the struggle to share long and complex investigations among analysts.

The project is available on our Github organization.

Disclaimer

IRIS is still in its early stages. It can already be used in production, but please set backups of the database and DO NOT expose the interface on the Internet. We highly recommend the use of a private dedicated and secured network.

"},{"location":"changelog/","title":"Changelog","text":"

For upgrades instructions, please see the Upgrades page.

"},{"location":"changelog/#v247-march-18-2024","title":"v2.4.7 March 18, 2024","text":""},{"location":"changelog/#whats-changed","title":"What's changed","text":"

Fixed * Issues in the datastore preventing to upload multiple files

Full Changelog

"},{"location":"changelog/#v246-march-18-2024","title":"v2.4.6 March 18, 2024","text":""},{"location":"changelog/#whats-changed_1","title":"What's changed","text":"

\u26a0\ufe0f Important changes are done in the Access Control. If you are upgrading, please carefully read the upgrades instructions. The layout of the reports has been changed. Reports template need to be upgraded as well.

Improved

  • New notes layout
  • New timeline layout with tree view
  • New timeline feature allowing to create child events
  • New access control feature allowing to associate users with customers
  • CI/CD init by @c8y3 in #401, #400, #402

Fixed

  • Fix CSS issue by @whikernel in #377
  • Fixes addition of case templates in #379
  • Fix issues with case templates usage in #381
  • Fix issue with IOC lookups in the timeline in #382
  • Fix major collaboration issue in notes in #385
  • Fix PG Extension not being setup properly in #390
  • Fix multiple security issues impacting case reports and editors
"},{"location":"changelog/#new-contributors","title":"New Contributors","text":"
  • @MikaelFangel made their first contribution in #414

Full Changelog

"},{"location":"changelog/#v237-december-14-2023","title":"v2.3.7 December 14, 2023","text":""},{"location":"changelog/#whats-changed_2","title":"What's Changed","text":"

Fixed

  • Fixes an issue with download of files from the datastore #347
  • Fixes an issue with the addition of protagonist in cases
  • Fixes an issue with case edition modal

Improved

  • Improved timeline rendering
  • Improved security in Datatables

Full Changelog

"},{"location":"changelog/#v236-december-7-2023","title":"v2.3.6 December 7, 2023","text":""},{"location":"changelog/#whats-changed_3","title":"What's Changed","text":"

Fixed

  • Fixes an error preventing the proper generation of reports
  • Fixes an issue with filtering in the overview tab
  • Adds more filtering options in the overview tab

Full Changelog

"},{"location":"changelog/#v235-november-30-2023","title":"v2.3.5 November 30, 2023","text":""},{"location":"changelog/#whats-changed_4","title":"What's Changed","text":"

Fixed

  • Fixes an issue introduced in v2.3.4 where the cases metadata are not properly saved.

Full Changelog

"},{"location":"changelog/#v234-november-29-2023","title":"v2.3.4 November 29, 2023","text":"

A severe bug has been introduced in this version. Please upgarde to v2.3.5.

"},{"location":"changelog/#whats-changed_5","title":"What's Changed","text":"

Added

  • Added support for evidences types
  • Added support for cases severity
  • Improved search in context switcher

Fixed

  • Fixed overview page
  • Fixed dashboard filtering

\u2757 The layout of the reporting has slightly changed. Custom report templates might not work anymore. You can use https://<server>/case/export?cid=<case_id> to get all the possible fields.

Full Changelog

"},{"location":"changelog/#v233-october-5-2023","title":"v2.3.3 October 5, 2023","text":""},{"location":"changelog/#whats-changed_6","title":"What's Changed","text":"

Fixed

  • Fixed breaking of manage case list if percentage in title
  • Fixed broken title search in overview
  • Fixed sorting of owners in overview
  • Fixed quick look in overview
  • Fixed alert page breaking if username contains trailing space
  • Fixed IrisVTModule links
  • Fixed IrisWebhookModule
  • Fixed refresh after closing of notes

@Scriptception made their first contribution in 313

Full Changelog

"},{"location":"changelog/#v232-august-2-2023","title":"v2.3.2 August 2, 2023","text":""},{"location":"changelog/#whats-changed_7","title":"What's Changed","text":"

Fixed

Patches a critical issue corrupting files uploaded to the DataStore via the IOC option or when a password is set

Full Changelog

"},{"location":"changelog/#v231-july-23-2023","title":"v2.3.1 July 23, 2023","text":""},{"location":"changelog/#whats-changed_8","title":"What's Changed","text":"

Improved

  • Overview page and quick view layout
  • Auto assignment of alerts when not assigned
  • Possibility to filter tags by clicking on them in alerts

Fixed

  • Call of modules when done from the modals
  • UI

Full Changelog

"},{"location":"changelog/#v230-july-09-2023","title":"v2.3.0 July 09, 2023","text":""},{"location":"changelog/#whats-changed_9","title":"What's Changed","text":"

Added

  • Collaborative editor in notes
  • Possibility to add case peer-reviews
  • Alerts resolution status
  • Auto closing of alerts with resolution for linked alerts
  • New webhook module
  • Enhanced overview page
  • Attributed open cases in dashboard
  • Assets and IOCs multi-additions from the UI
  • New UI design

Fixed

  • Password change for users
  • Description breaking in alerts and events
  • Missing icons in MD rendering for know links
  • Alerts rendering

Full Changelog

"},{"location":"changelog/#v223-june-19-2023","title":"v2.2.3 June 19, 2023","text":""},{"location":"changelog/#whats-changed_10","title":"What's Changed","text":"

Added

  • Possibility to use LDAP and local auth as fallback
  • Possibility to add multiple IOCs at once from the UI
  • Possibility to add multiple assets at once from the UI
  • Support for hooks and module calls in alerts
  • URL redirection after login

Fixed

  • Similarities in alerts when no assets are provided
  • Assertion of data in marshmallow
  • MD editor new lines handling
  • Unicode in datastore
  • Alerts share links
  • Modules info when registering a module
  • UI fixes

Full Changelog

"},{"location":"changelog/#v222-may-30-2023","title":"v2.2.2 May 30, 2023","text":""},{"location":"changelog/#whats-changed_11","title":"What's Changed","text":"

Added

  • Possibility to pivot on assets and IOCs from the alerts graph

Fixed - Delete character escaping for passwords by @juadde in #253 - Case template of tasks without tags - Shortening of case names during updates - Bad handling of certain requests without CID - Deletion of assets related to alerts once merge into a case

Full Changelog

"},{"location":"changelog/#v221-may-24-2023","title":"v2.2.1 May 24, 2023","text":""},{"location":"changelog/#whats-changed_12","title":"What's Changed","text":"

Note 1: This version contains a security fix for iris-web (see CVE-2023-30615) Note 2: on_postload_case_info_update hook has been renamed to on_postload_case_update

Added

  • Add newly created users after a LDAP authentication to group Analysts by @c8y3 in #247

Fixed

  • Security fix of CVE-2023-30615 - GHSA-gc6j-6276-2m49 impacting iris-web < v2.2.1
  • Deletion of cases with assigned tasks
  • Merge of multiple alerts
  • Import of IOCs and Assets in case multiple alerts are merged

Full Changelog

"},{"location":"changelog/#v220-may-22-2023","title":"v2.2.0 May 22, 2023","text":""},{"location":"changelog/#whats-changed_13","title":"What's Changed","text":"

Added

  • Basic csv events file import (with default options) by @realsec in #240
  • New endpoints to search for manageable objects such as assets types etc,
  • New search by asset IDs, IOC IDs and events IDs in the timeline

Fixes

  • Some configuration checks when LDAP and automatic user creation are set by @c8y3 in #246
  • Ensure database connectivity before trying to create tables by @weslambert in #248
  • Merge of multiple alerts in one case not merging the IOCs and assets
  • Bug allowing to add an asset to a timeline not belonging to the same case
  • UI bug fixes

New Contributors

  • @realsec made their first contribution in #240
  • @weslambert made their first contribution in #248

Full Changelog

"},{"location":"changelog/#v210-may-15-2023","title":"v2.1.0 May 15, 2023","text":"

If you are using custom SSL certificates, please read the upgrade instructions when upgrading from previous versions.

"},{"location":"changelog/#whats-changed_14","title":"What's Changed","text":"

Added

  • Full support of alerts
  • Case templates
  • Provisioning of users
  • Service accounts
  • New permissions

Fixed

  • Variable LDAP_AUTHENTICATION_TYPE in .env.model by @c8y3 in #217
  • Automatic creation of users with ldap authentication by @c8y3 in #227
  • Update nginx.conf for Security HTTP headers to work. by @oikuda in #216
  • Columns in manage cases #205
  • Customer contact deletion #239
  • Search permissions #237
  • Customer permissions #235
  • Toast split #226
  • Assets exporting #224
  • Assets IOC filtering #223
  • ADM username not enforced #218
  • JIT provisioning of users in LDAP #203

New Contributors

  • @c8y3 made their first contribution in #217
  • @oikuda made their first contribution in #216

Full Changelog

"},{"location":"changelog/#v202-april-18-2023","title":"v2.0.2 April 18, 2023","text":""},{"location":"changelog/#whats-changed_15","title":"What's Changed","text":"

Fixed * Update case_notes_db.py for bug fix #200 by @LoneWolf-96 in #208 * Do not escape_filter_chars for NTLM username by @juadde in #212 * docker-compose cleanup by @juadde in #213 * Listening port not being propagated in nginx docker

New Contributors * @LoneWolf-96 made their first contribution in #208 * @juadde made their first contribution in #212

Full Changelog

"},{"location":"changelog/#v201-april-05-2023","title":"v2.0.1 April 05, 2023","text":""},{"location":"changelog/#whats-changed_16","title":"What's Changed","text":"

Fixed [FIX] Additional table header in case management breaking proper loading of data in #206

Full Changelog

"},{"location":"changelog/#v200-march-26-2023","title":"v2.0.0 March 26, 2023","text":""},{"location":"changelog/#whats-changed_17","title":"What's Changed","text":"

In addition to the features listed below, we are changing the way we are issuing releases. From now on, IRIS follows the Semantic Versioning 2.0 guidelines. The code ready for production is always tagged with a version number. alpha and beta versions are not production-ready.

Do not use the master branch in production.

A website with the current development version is also provided and freely accessible. It serves as a beta before public releases.

Added

  • Groups management
  • Case access control and basic permissions
  • Comments support on a call objects
  • Markdown editors in all case objects
  • Customers dedicated pages with additional information and cases stats
  • LDAP authentication
  • Markdown reporting
  • Case owners, classifications, outcome and tags
  • Possibility to update case basic infornations
  • Case overview page
  • Unique UUID on all case objects
  • Multiple assignees support in case tasks
  • Deletion confirmation prompt on all case objects as an option
  • IOC in events plus optional synchronization with assets
  • Events flagging in the timeline
  • MD links on every case objects

Improved

  • Dark mode
  • Uniformity of modals
  • Overall UI and UX
  • Compromised status in assets
  • Error reporting in the UI

Fixed

  • Manual call of modules when multiple modules are availables
  • Multiples bugs fixes
  • Security fixes

Full Changelog

"},{"location":"changelog/#v145-june-9-2022","title":"v1.4.5 June 9, 2022","text":"

What's Changed

  • Added a datastore in #115, fixes #30 :
    • Upload and store any files on IRIS
    • Password protect them as an option
    • Download
    • Add to IOC and/or evidences automatically
    • Reference to files in notes, summary or any textual input
    • Copy/paste of images directly in notes and summary
    • Virtual folders to arrange files
  • Ability to configure password policy in #117, fixes #116
  • Dark mode improved, flickering removed
  • Multiples bugs fixes
  • Security fixes

Full Changelog

Notes: Changes are made to the Nginx docker to allow upload of big files, hence specific upgrades are needed and auto-updates is not yet supported for this version. Please see the upgrades instruction for more details.

"},{"location":"changelog/#v144-may-18-2022","title":"v1.4.4 May 18, 2022","text":"

What's Changed

  • Implementation of bulk events editing by @sebastiandemmer in #110
  • Fixes context switch button doesn't load cases by @DevJoost in #112
  • Fixes multiple minor bugs

Full Changelog

"},{"location":"changelog/#v143-may-13-2022","title":"v1.4.3 May 13, 2022","text":"

What's changed

  • Managed IRIS updates from itself
  • Custom icons for assets - fixes #44 by @sebastiandemmer
  • IOCs link in timeline and graph - fixes #50
  • History of modifications in timeline
  • User id in timeline export as an option - fixes #65
  • Backup of database from the interface
  • Minimisation of modals in cases
  • New UI improvements in timeline
  • New minimal notifications for almost all activities
  • Improved overall responsiveness and speed
  • Improved error feedbacks to users
  • Improved load of tasks results by x10
  • Code cleaning
  • Multiple bug fixes

Full Changelog

"},{"location":"changelog/#v142-april-22-2022","title":"v1.4.2 April 22, 2022","text":"

Improvements :

  • Possibility to duplicates events in timeline - #91
  • Possibility to filter timeline with basic query - #94

Fixes :

  • Integer limit on file size in evidences - #89
  • Gradient in closed cases
  • on-preload hooks list handling - #92
  • tags issue - #88
  • Case info modal from case - #93
  • Multiple UI issues
"},{"location":"changelog/#v141-april-8-2022","title":"v1.4.1 April 8, 2022","text":"
  • Fixes a scrolling issue of the timeline when events are being popped
"},{"location":"changelog/#v140-april-6-2022","title":"v1.4.0 April 6, 2022","text":"

A bug fixe exists for this version. See v1.4.3

  • Hooks, adding the ability for modules to react on almost anything happening on the plateform in #75
  • New type of modules that can handles hooks
  • VirusTotal beta integration as a processor module
  • MISP beta integration as a processor module
  • Custom attributes on all case objects allowing to extend the default fields
  • A compact timeline view for better visbility
  • Premises of a dark theme
  • Resiliency of docker volume in #80
  • Minor improvements in #69, #79
  • Bug fixes in #70, #73, #77
  • Security fixes
"},{"location":"changelog/#v131-march-19-2022","title":"v1.3.1 March 19, 2022","text":"
  • Fixes wheel issue preventing proper build of the docker, as described in #83
"},{"location":"changelog/#v130-january-24-2022","title":"v1.3.0 January 24, 2022","text":"
  • Added the ability to batch upload IOC from a CSV file in #26
  • Added the ability to batch upload assets from a CSV
  • Screenshot - Export contents of any case pages as PNG in #35
  • Export timeline as CSV in #47
  • Improved timeline loading time by x10 - loads thousands of events in a sec
  • New auto parsing of dates in events addition/updates
  • Brand new timeline visualisations
  • Improved assets loading time
  • Shared links - easily share any case objects with your collaborators
  • Right panel now offers last activities for user's current case
  • Added assets tags in #37
  • New API endpoints in #53
  • Auto migration of database for next releases
  • Indication of mandatory fields in forms
  • General bug fixes, stability and UI improvement
"},{"location":"changelog/#v121-december-31-2021","title":"v1.2.1 December 31, 2021","text":"
  • Added ATT&CK tactics by @ecapuano in #9
  • Added screenshot and video link in readme in #12
  • Fixed duplicated path to add customer in #4
  • Fixed asset description data validation client side in #7
  • Fixed tooltip in #10
  • Add a per-column filtering field in the case view by in #15
"},{"location":"contact/","title":"Contacting us","text":"

You can directly contact us, should you need direct support, a demo, further information or anything else related to the project.

contact@dfir-iris.org

Discord

Twitter

"},{"location":"credits/","title":"Credits","text":"

IRIS uses dozen of OS modules and this list is not exhaustive. If you developped something which is used in IRIS and does not figures here, you can contact us.

  • Flask
  • SQLAlchemy
  • PostgreSQL
  • Celery
  • RabbitMQ
  • Docker
  • Atlantis
  • Flaticon
  • Font Awesone
  • Datatables
  • JQuery
  • MkDocs
  • MkDocs Materials
  • Tailwind
  • MISP module for Cortex
  • Virus Total Apis
"},{"location":"getting_started/","title":"Quick Start","text":"

The most straightforward and recommended way to use IRIS is with Docker. This is presented here.

Disclaimer

IRIS is in its early stage. It can already be used in production, but please set backups of the database and DO NOT expose the interface on the Internet. We highly recommended the use of a private dedicated and secured network.

"},{"location":"getting_started/#pre-requisites","title":"Pre-requisites","text":""},{"location":"getting_started/#hardware","title":"Hardware","text":"

IRIS does not require a lot of resources, and it can be run on a small laptop (4 cores, 8Gb of RAM). However, for large a organization and heavy usage, it will need to be significantly scaled up. We don't have benchmarks yet, but keep in mind that the database can grow rapidly and modules can require more resources depending on their purposes.

"},{"location":"getting_started/#docker","title":"Docker","text":"

Docker and docker compose are needed to build and run the project. Depending on the OS you will find all the information to install them on the official website of Docker.

The platform is officially supported on most Linux and MacOS. While it should work on Windows, some path needed by the containers to store permanent files might need to be changed in the dockerfiles.

"},{"location":"getting_started/#versioning","title":"Versioning","text":"

Starting from version 2.0.0, Iris is following the Semantic Versioning 2.0 guidelines. The code ready for production is always tagged with a version number. alpha and beta versions are not production-ready.

Do not use the master branch in production.

"},{"location":"getting_started/#build-and-run","title":"Build and Run","text":"

To build and run IRIS, follow these steps:

  1. Clone the iris-web repository:

    git clone https://github.com/dfir-iris/iris-web.git\ncd iris-web\n

  2. Check out the latest non-beta tagged version: 

    git checkout v2.4.7\n

  3. Copy the environment file 

    cp .env.model .env\n

    Warning

    The default configuration is suitable for testing only. To configure IRIS for production, see the configuration section.

  4. Build the Docker containers:

    docker-compose build\n

  5. Start IRIS:

    docker-compose up\n

IRIS should now be available on the host interface, port 443, using HTTPS protocol by default. You can access it by navigating to https://hostip in your web browser.

By default, an administrator account is created when IRIS is started for the first time. The password is printed in the console output. You can search for WARNING :: post_init :: create_safe_admin :: >>> in the logs to find the password. Running docker compose logs app | grep 'admin' should help to find it.

If you want to define an admin password at the first start, you can create and define the environment variable IRIS_ADM_PASSWORD in the .env. This has no effect once the administrator account is created.

Note that IRIS is split into five Docker services, each with a different role:

  • app - iris_webapp: The core, including web server, database management, module management, etc.
  • db: A PostgreSQL database
  • RabbitMQ: A RabbitMQ engine to handle job queuing and processing
  • worker: A job handler relying on RabbitMQ
  • nginx: A NGINX reverse proxy

Each service can be built independently, which is useful when developing. In this QuickStart, all services are built at once.

"},{"location":"getting_started/#additional-configuration","title":"Additional configuration","text":"

Please see configuration for more details.

"},{"location":"getting_started/#kubernetes","title":"Kubernetes","text":"

For enterprises wishing to run their instance of IRIS, utilizing the projects official Helm charts and/or Kustomize manifests, allows them to significantly enhance their deployment and management, presenting a powerful solution to streamline their IRIS deployment and management processes, efficiently running across a cluster of machines, ensuring high availability and seamless scaling as demand fluctuates.

The deploy directory in the iris-web GitHub repository provides a practical starting point for deploying IRIS on their preferred managed k8s platform. We've created two variants: eks and gke, feel free to customize each with your own values.

For more details, please visit the deploy directory on GitHub: deploy

"},{"location":"resources/","title":"Resources","text":"

This page is a collection of external resources to help you get started with IRIS and integrate it into your workflow. Please note that some of these resources may be outdated. If you want to add your own resources, please open a pull request or contact us.

"},{"location":"resources/#blog-posts","title":"Blog posts","text":"
  • Building a FOSS SOC by nateuribe
  • Integrating Wazuh with IRIS by stasis - Please note that Wazuh needs to send alerts on port 443 by default, not 8000 as specified in the article
  • IRIS and a bit of MISP by vanimpe
"},{"location":"resources/#iris-modules","title":"IRIS Modules","text":"
  • SOC Fortress on Github
"},{"location":"resources/#videos","title":"Videos","text":"
  • SOC Fortress: IRIS
"},{"location":"resources/#misc","title":"MISC","text":"
  • Integrating IRIS with Tines by Michael Tolan
"},{"location":"roadmap/","title":"Roadmap","text":"

Note of 25-05-2023

IRIS is growing both in code and interestes. To future-proof the project, we have decided to pause the development of new features and focus on the core functionalities and stability for a while. This includes a major refactoring of the codebase. We will still fix bugs and security issues.

We do not provide a long-term roadmap to prevent any frustration and unmet expectations. It is constantly evolving with feedbacks we receive.

We've thus moved it within a Github project. You can check it here.

"},{"location":"security-advisories/","title":"Security Advisories","text":"

This page lists all security advisories that have been published for the code released by DFIR-IRIS.

"},{"location":"security-advisories/#cve-2023-50712-dec-18-2023","title":"CVE-2023-50712 Dec 18, 2023","text":"CVE ID Github ID Severity Impacted product CVE-2023-30615 GHSA-593r-747g-p92p Moderate - CVSS3 4.6/10 iris-web"},{"location":"security-advisories/#description","title":"Description","text":"

A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.3.7. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities.

An attacker need to be authenticated on the application to exploit this vulnerability.

"},{"location":"security-advisories/#affected-versions","title":"Affected versions","text":"
  • iris-web < 2.3.7
"},{"location":"security-advisories/#fixed-versions","title":"Fixed versions","text":"
  • iris-web >= 2.3.7
"},{"location":"security-advisories/#workarounds","title":"Workarounds","text":"

No workaround is available.

"},{"location":"security-advisories/#acknowledgment","title":"Acknowledgment","text":"

Thanks to Leonard Rapp (G DATA Advanced Analytics GmbH) for the responsible disclosure.

"},{"location":"security-advisories/#cve-2023-30615-may-24-2023","title":"CVE-2023-30615 May 24, 2023","text":"CVE ID Github ID Severity Impacted product CVE-2023-30615 GHSA-gc6j-6276-2m49 Moderate - CVSS3 4.6/10 iris-web"},{"location":"security-advisories/#description_1","title":"Description","text":"

A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.2.1. The vulnerability allows an attacker to inject malicious scripts into the application, which are then executed when a user visits the affected locations. This can lead to unauthorized access, data theft, or other related malicious activities.

An attacker need to be authenticated on the application to exploit this vulnerability.

"},{"location":"security-advisories/#affected-versions_1","title":"Affected versions","text":"
  • iris-web < 2.2.1
  • iris-web > 2.0.0 and < 2.2.1 while not using the alerting feature are not impacted.
"},{"location":"security-advisories/#fixed-versions_1","title":"Fixed versions","text":"
  • iris-web >= 2.2.1
"},{"location":"security-advisories/#workarounds_1","title":"Workarounds","text":"

No workaround is available.

"},{"location":"support/","title":"Getting support","text":"

We understand the importance of having robust support and training to maximize the effectiveness of our tools in your IR efforts. Here's how we can assist:

  • Getting started
  • Support and implementation
  • Trainings

We're flexible and can accommodate needs through our OpenCollective page.

Please get in touch with us at contact@dfir-iris.org for further details.

"},{"location":"support_us/","title":"Support us","text":"

As a free and open source project, we rely on the support of our community to continue development and improve our platform. If you find the platform useful and would like to help us sustain and grow, you may consider supporting us financially through OpenCollective.

Support us

"},{"location":"zqa/","title":"Q & A","text":""},{"location":"zqa/#general-questions","title":"General questions","text":""},{"location":"zqa/#which-version-should-i-install","title":"Which version should I install?","text":"

The master branch is stable as all the development is done under the develop branch and merged once ready. To ease the identification, each new version is tagged and a new release is published. We recommend using these. git checkout <tagged_version>

"},{"location":"zqa/#is-the-project-maintained","title":"Is the project maintained?","text":"

Yes, IRIS is under heavy development. We are adding more and more features, led by feedbacks from the community.

"},{"location":"zqa/#what-is-the-future-of-the-project","title":"What is the future of the project?","text":"

We aim to make it evolve as much as possible with the help of the community. We have long term goals to integrate it seamlessly with project like MISP and other OS project, but we don't provide any commitment on how and when to avoid any unmet expectations. For a short term roadmap, you can head to the Github project.

"},{"location":"zqa/#how-can-i-contact-the-dfir-iris-team","title":"How can I contact the DFIR-IRIS team?","text":"

You can reach us on discord, Twitter or by email.

"},{"location":"zqa/#cases","title":"Cases","text":""},{"location":"zqa/#can-i-recover-a-deleted-case","title":"Can I recover a deleted case?","text":"

No. Cases are deleted from the database and changes are committed. There is no coming back unless you have made backups of the database (which we recommend).

"},{"location":"zqa/#can-i-recover-a-deleted-case-object","title":"Can I recover a deleted case object?","text":"

No. Every object such as IOCs, assets, events, notes, etc are immediately deleted from the database and changes are committed.

"},{"location":"zqa/#can-i-add-a-new-asset-type","title":"Can I add a new asset type?","text":"

Yes. With a user that have administrative rights, go to Advanced > Case Objects.

"},{"location":"zqa/#can-i-add-a-new-ioc-type","title":"Can I add a new IOC type?","text":"

Yes. Starting from v1.3.0, IOC types can be manipulated. Head to Advanced > Case Objects

"},{"location":"zqa/#can-i-add-new-fields-to-case-objects-such-as-iocs-assets-etc","title":"Can I add new fields to case objects such as IOCs, Assets, etc?","text":"

Yes. Starting from v1.4.0, all case objects can be extended thanks to custom attributes. With a user that have administrative rights, go to Advanced > Custom Attributes.

"},{"location":"zqa/#can-i-search-into-custom-attributes-fields","title":"Can I search into custom attributes fields?","text":"

Not for now. The searches in each case objects page are done client-side, and the attributes are not fetched. We will however implement a server side search in next releases.

"},{"location":"zqa/#can-i-create-two-cases-with-the-same-name-for-the-same-customer","title":"Can I create two cases with the same name for the same customer?","text":"

Yes. Cases are identified with a unique number, so they can have the same name.

"},{"location":"zqa/#can-i-restrict-the-view-of-case-to-a-set-of-users","title":"Can I restrict the view of case to a set of users?","text":"

Yes it is since v2.0.0. See Access control.

"},{"location":"zqa/#can-i-change-the-name-or-customer-of-an-existing-case","title":"Can I change the name or customer of an existing case?","text":"

Yes it is since v2.0.0.

"},{"location":"zqa/#operations","title":"Operations","text":""},{"location":"zqa/#what-is-the-password-policy-can-it-be-changed","title":"What is the password policy? Can it be changed?","text":"

Before v1.4.5, the password policy is hardcoded and cannot be changed. It should be 12 characters minimum and contains a capital letter and a number.

"},{"location":"zqa/#can-i-change-my-profile-picture","title":"Can I change my profile picture?","text":"

No, not for now. This wasn't a priority for us, it will be released in future versions.

"},{"location":"zqa/#i-lost-the-administrator-password-can-i-recover-it","title":"I lost the administrator password, can I recover it?","text":"

Passwords are hashed so they can't be recovered. But you can change it. Please see changing a lost password.

"},{"location":"zqa/#can-i-delete-a-user","title":"Can I delete a user?","text":"

No. To keep consistencies in the database, users unfortunately cannot be deleted if they have done some activities. You can however disable them to prevent them appearing in the UI and connecting to the plafeform.

"},{"location":"zqa/#can-i-delete-a-customer","title":"Can I delete a customer?","text":"

No. To keep consistencies in the database, customers unfortunately cannot be deleted if they are linked to cases.

"},{"location":"zqa/#can-i-prevent-backrefs-of-assets-and-iocs","title":"Can I prevent backrefs of assets and IOCs?","text":"

No. It might be possible in future versions but for now it is better to spin up a new instance for restricted cases. The backref is however automatically disabled for performance reasons, for cases with more than 300 assets. We are working on a more efficient way to backref.

"},{"location":"zqa/#my-report-template-is-not-generated-and-generates-an-error","title":"My report template is not generated and generates an error","text":"

Please triple check typos in tags as there is no fault tolerance. You can reach us in case of troubles.

"},{"location":"zqa/#integration","title":"Integration","text":""},{"location":"zqa/#can-i-enrich-iocs-with-external-sources","title":"Can I enrich IOCs with external sources?","text":"

Starting from v1.4.0, it is now possible to easily develop module to enrich case objects. A module Iris VT and IRIS MISP are already provided.

"},{"location":"zqa/#is-there-an-api-client","title":"Is there an API client?","text":"

Yes, you can find it on our Github.

"},{"location":"zqa/#security","title":"Security","text":""},{"location":"zqa/#can-i-restrict-cases","title":"Can I restrict cases?","text":"

Yes it is since v2.0.0. See Access control.

"},{"location":"zqa/#can-i-expose-iris-on-the-internet","title":"Can I expose IRIS on the Internet?","text":"

NO! Please don't. This platform should only be accessible in a restricted environment.

"},{"location":"zqa/#i-found-a-security-issue-can-i-have-a-bounty","title":"I found a security issue, can I have a bounty?","text":"

No - IRIS is free and open source so there is no bounty. Please report it as soon as possible so we can fix it.

"},{"location":"zqa/#misc","title":"MISC","text":""},{"location":"zqa/#what-does-iris-stand-for","title":"What does IRIS stand for?","text":"

Originally Incident Response Investigation System. But it can be whatever you want really.

"},{"location":"development/","title":"Development","text":"

This section is under construction and more elements will be added over time

This documentation is not a detailed how-to develop IRIS. It gives some insights to help understand the basic code of the project and how to contribute.

"},{"location":"development/#general-repositories-conventions","title":"General repositories conventions","text":""},{"location":"development/#branches","title":"Branches","text":"

We are using the Gitflow Workflow to manage our git branches. In a nutshell :

  • master contains only \"production-ready\" code
  • develop contains the major development code. When ready it is tagged and merged into master
  • The sub-branches of develop contains either :
    • A new feature in development, in which case the naming convention is new_feature
    • An issue fixe, in which case the name convention is iXX_issue_title, with XX being the issue number
"},{"location":"development/#commits","title":"Commits","text":"

The commits convention is the following :

  • Create commits as small as possible, i.e atomic commits
  • If it's not related to an issue, the format [action] Commit message is used, with action being a 3 letters action related to the commit, eg ADDfor additions, DEL for deletions, IMP for improvements, etc.
  • If it's related to an issue, prepend with the issue ID, i.e [#issue_id][action] Commit message
"},{"location":"development/#sections","title":"Sections","text":"

The following sections are available in this documentation :

  • Structure overview : general structure of IRIS code
  • Environment setup : guide to setup a development environment
  • Coding tips : basic codes hints
  • DB migration : things to consider if the code changes the DB schema
  • Hooks : an introduction to IRIS hooks
  • Modules : a guide to develop modules
"},{"location":"development/code-tips/","title":"Coding tips","text":""},{"location":"development/code-tips/#routes","title":"Routes","text":"

IRIS does not defines a separate API for users, meaning the HTML pages are actually using the API themselves. Routes don't need to handle the authentication and roles. These are handles by wrappers (see snippets below).

"},{"location":"development/code-tips/#page-route","title":"Page route","text":"

A page returns an HTML content and should use the following code structure : Example of page route

@blueprint.route('/a/good/route', methods=['GET']) # (1)\n@login_required # (2)\ndef view_a_good_route(caseid, url_redir):  # (3)\nif url_redir:\nreturn redirect(url_for('bluprintname.method_name', cid=caseid))  # (4)\n# route code \nreturn render_template(\"a_good_route.html\", variable_1=var_1, ...)  # (5)\n

  1. This defines which URI the route is handling as well as the methods it supports (ie GET, POST, etc). In IRIS, we try to limit one method per route.
  2. This defines the security of the endpoint. @login_required is used for users page and @admin_login_required is used for admin restricted pages.
  3. caseid and url_redir are variable provided by @login_required and @admin_login_required wraps. caseid indicates which case ID the user tried to access the route with. url_redir indicates the caseid provided wasn't valid and a redirection is needed.
  4. In case a redirection is needed, provide the URL to which the redirection should be done. It's often the page method itself except for modales.
  5. A page route needs to return an HTML template. variable_1 is a value that can be accessed from within the template itself. More variables can be added, or not at all.
"},{"location":"development/code-tips/#api-route","title":"API route","text":"

An API route returns a JSON content. Two types are pre-defined and should be used : Standard API returns

response_success(msg=\"A success message\", data=<data associated with the success feedback>)\nresponse_error(msg=\"An error message\", data=<data associated with the error feedback>, status=<status code, by default 400>)\n

Below is an example of standard API route. Example of page route

@blueprint.route('/a/good/api_route', methods=['GET']) # (1)\n@api_login_required # (2)\ndef view_a_good_route(caseid):  # (3)\n# API route code \nreturn response_success(\"ok\", data=my_data_object)  # (4)\n

  1. This defines which URI the route is handling as well as the methods it supports (ie GET, POST, etc). In IRIS, we try to limit one method per route.
  2. This defines the security of the endpoint. @api_login_required is used for users API endpoints and @api_admin_required is used for admin restricted endpoints.
  3. caseid is provided @api_login_required and @api_admin_required wraps. It indicates which case ID the user tried to access the endpoint with.
  4. One of the standard return defined above.
"},{"location":"development/db-migration/","title":"DB Migrations","text":"

In case a DB migration is needed, you need to provide an alembic migration script.

Test your migration

Please try out your migration as this is an important piece of the upgrades. Spin up an old version of IRIS, input some data and then try to start your new version. Ensure that everything is migrated as expected.

In a terminal and from within the IRIS virtual env :

  1. Go to source
  2. Issue the following command : alembic -c app/alembic.ini revision -m \"A few words to describe your changes\"

This creates a new revision file source > app > alembic > versions. It's a Python file that basically describes what needs to be updated DB-wise. You can take example from the ones we already have generated in the same folder.

Hint

During your tests you might face the issue that Alembic does not apply your changes after you executed it once. It's because it keeps tracks of the latest applied revision in a table alembic_version. It doesn't know you changed the revision file. In that case the trick is to connect to the DB, and then delete the entry in the alembic_version. This will force it to reapply all revisions at startup. If you're using the DB docker you can use the following:

  • docker exec -it <db_container_id> /bin/sh
  • su postgres
  • psql
  • \\c iris_db;
  • DELETE FROM alembic_version;
  • Restart the IRIS web app - your changes should be applied
"},{"location":"development/environment/","title":"Setup","text":"

It follows an issue raised on the Github of the project.

It recommends the use of a hybrid development environment, as most of the time only the web-app needs to be changed:

  • Pycharm or any Python IDE for the web-app
  • Docker for db, nginx, celery and worker. The three later are even optional if you don't develop modules.
"},{"location":"development/environment/#web-app","title":"Web-app","text":"

For the webapp configuration, a specific .ini need to be created.

  • Create config.priv.ini in source/app by copying the config.docker.inipresent in the same directory.
  • Change PG_SERVER = db to PG_SERVER = 127.0.0.1 or whatever IP is the Postgresql/docker running with

That's the only configuration change needed for the app to run outside docker. The docker.priv.ini is already excluded in gitignore.

Then Pycharm need to be setup with a dedicated environment, by adding a new configuration:

  • Script path : source/run.py
  • Python interpreter 3.9
  • Working directory: source

To have pylint, right click on source in the directory tree and mark directory as > sources root. The requirements then need to be installed. Pycharm should detect the requirements.txt and propose to install the dependencies. Otherwise they can be installed with the following command (issued in the virtual environment) : pip3 install -r source\\requirements.txt

"},{"location":"development/environment/#run","title":"Run","text":"
  1. Spin up the docker db docker-compose up db
  2. Run the Pycharm configuration you created
  3. The interface should be accessible on http://127.0.0.1:8000 (and https://127.0.0.1:4433 if you started the nginx docker)

IRIS can now be developed and debugged on the fly.

"},{"location":"development/environment/#tests-in-docker","title":"Tests in docker","text":"

Once the code is working by running on Pycharm, we highly recommend testing it on Docker. To do so, the app docker need to be erased and rebuilt.

  1. docker-compose rm app
  2. docker-compose build app
  3. docker-compose up db app

Development considerations If the development results in DB modification, please use Alembic and add a migration script so users don't loose their data when they upgrade.

"},{"location":"development/hooks/","title":"Hooks","text":"

Introduced in IRIS v1.4.0

Hooks are a mean for modules to react on specific events that occurs on IRIS. By subscribing to a hook, a module is automatically notified when the associated event occurs. This offers a multitude of possibilities, from adding insight to IRIS objects, to pushing information to another platform or even changing how IRIS works.

"},{"location":"development/hooks/#types","title":"Types","text":"

There are 3 types of hooks.

  • On preload: Triggered before an object is processed and committed to database. It is triggered right after a request is received, and the data associated with the hook is usually the request content itself. In most of the cases, modules should not subscribe to these hooks.
  • On postload: Triggered after an object is processed and committed to database. It is triggered after IRIS processed the request and the data associated with the hook is usually a list of SqlAlchemy objects (such as IOC, Assets, etc).
  • Manual: Triggered by manual action of a user. When a module subscribes to these hooks, it needs to provide a \"menu option name\" which will be displayed to users. When they click this option, the associated hook is triggered for this module only. Multiple manual hooks can be registered for one module.

Danger

on_preload hooks must run synchronously, i.e not queued in RabbitMQ. This effectively blocks the current user request until the module finishes the processing. We highly recommend to only use on_postload hooks for a better user experience. These hooks are transparent for users and rely on already verified and committed data. Handling on_preload hooks implies the received data is unsafe - directly coming from remote clients - and the module needs to process the data as fast as possible.

"},{"location":"development/hooks/#subscribing-and-unsubscribing","title":"Subscribing and unsubscribing","text":"

Two methods are provided by IrisModuleInterface to subscribe and unsubscribe to hooks. 

  def register_to_hook(module_id: int, \niris_hook_name: str, \nmanual_hook_name: str = None, \nrun_asynchronously: bool = True)\ndef deregister_from_hook(module_id: int, \niris_hook_name: str)\n

The registration method expects the following arguments:

  • module_id: The ID of the calling module. This information is given by IRIS when the register_hooks method is called.
  • iris_hook_name: The name of the hook to which subscribe. This must be one of the hook listed in the section below.
  • manual_hook_name: The name of the UI menu that is provided to users if the registration concerns a manual hook. If nothing is provided, IRIS will create a name composed as follows: <module_name>::<hook_name>. This value is ignored if the signal is not manual.
  • run_asynchronously: Set to True (default) to run the module in a RabbitMQ task upon hook triggering. If set to False, the module is called immediately, which have for effect to effectively block the current user request until the module finishes. This is the behavior to use for on_preload hooks. However, we strongly recommend the use of on_postload hooks to prevent any unwanted (see warning section above).

The deregistration method expects the following arguments:

  • module_id: The ID of the calling module. This information is given by IRIS when the register_hooks methods is called.
  • iris_hook_name: The name of the hook to which unsubscribe. If the module is not subscribed to the specified hook the function returns without errors.

Please see the modules documentation for more details on how to implement these methods.

"},{"location":"development/hooks/#available-hooks","title":"Available hooks","text":"

The following hooks are natively available for subscription.

Hook name Description on_preload_case_create Triggered on case creation, before commit in DB on_postload_case_create Triggered on case creation, after commit in DB on_preload_case_delete Triggered on case deletion, before commit in DB on_postload_case_delete Triggered on case deletion, after commit in DB on_postload_case_update Triggered on case update, before commit in DB on_manual_trigger_case Triggered upon user action on_postload_alert_create Triggered on alert creation, after commit in DB on_postload_alert_update Triggered on alert update, after commit in DB on_postload_alert_delete Triggered on alert deletion, after commit in DB on_postload_alert_escalate Triggered on alert escalation, after commit in DB on_postload_alert_merge Triggered on alert merge, after commit in DB on_postload_alert_unmerge Triggered on alert unmerge, after commit in DB on_preload_asset_create Triggered on asset creation, before commit in DB on_postload_asset_create Triggered on asset creation, after commit in DB on_preload_asset_update Triggered on asset update, before commit in DB on_postload_asset_update Triggered on asset update, after commit in DB on_preload_asset_delete Triggered on asset deletion, before commit in DB on_postload_asset_delete Triggered on asset deletion, after commit in DB on_manual_trigger_asset Triggered upon user action on_preload_note_create Triggered on note creation, before commit in DB on_postload_note_create Triggered on note creation, after commit in DB on_preload_note_update Triggered on note update, before commit in DB on_postload_note_update Triggered on note update, after commit in DB on_preload_note_delete Triggered on note deletion, before commit in DB on_postload_note_delete Triggered on note deletion, after commit in DB on_manual_trigger_note Triggered upon user action on_preload_ioc_create Triggered on ioc creation, before commit in DB on_postload_ioc_create Triggered on ioc creation, after commit in DB on_preload_ioc_update Triggered on ioc update, before commit in DB on_postload_ioc_update Triggered on ioc update, after commit in DB on_preload_ioc_delete Triggered on ioc deletion, before commit in DB on_postload_ioc_delete Triggered on ioc deletion, after commit in DB on_manual_trigger_ioc Triggered upon user action on_preload_event_create Triggered on event creation, before commit in DB on_preload_event_duplicate Triggered on event duplication, before commit in DB. This event only received the event ID which will be duplicated on_postload_event_create Triggered on event creation, after commit in DB on_preload_event_update Triggered on event update, before commit in DB on_postload_event_update Triggered on event update, after commit in DB on_preload_event_delete Triggered on event deletion, before commit in DB on_postload_event_delete Triggered on event deletion, after commit in DB on_manual_trigger_event Triggered upon user action on_preload_evidence_create Triggered on evidence creation, before commit in DB on_postload_evidence_create Triggered on evidence creation, after commit in DB on_preload_evidence_update Triggered on evidence update, before commit in DB on_postload_evidence_update Triggered on evidence update, after commit in DB on_preload_evidence_delete Triggered on evidence deletion, before commit in DB on_postload_evidence_delete Triggered on evidence deletion, after commit in DB on_manual_trigger_evidence Triggered upon user action on_preload_task_create Triggered on task creation, before commit in DB on_postload_task_create Triggered on task creation, after commit in DB on_preload_task_update Triggered on task update, before commit in DB on_postload_task_update Triggered on task update, after commit in DB on_preload_task_delete Triggered on task deletion, before commit in DB on_postload_task_delete Triggered on task deletion, after commit in DB on_manual_trigger_task Triggered upon user action on_preload_global_task_create Triggered on global task creation, before commit in DB on_postload_global_task_create Triggered on global task creation, after commit in DB on_preload_global_task_update Triggered on task update, before commit in DB on_postload_global_task_update Triggered on global task update, after commit in DB on_preload_global_task_delete Triggered on task deletion, before commit in DB on_postload_global_task_delete Triggered on global task deletion, after commit in DB on_manual_trigger_global_task Triggered upon user action on_preload_report_create Triggered on report creation, before generation in DB on_postload_report_create Triggered on report creation, before download of the document on_preload_activities_report_create Triggered on activities report creation, before generation in DB on_postload_activities_report_create Triggered on activities report creation, before download of the document on_postload_asset_commented Triggered on asset comment, after commit in DB on_postload_asset_comment_update Triggered on asset comment update, after commit in DB on_postload_asset_comment_delete Triggered on asset comment deletion, after commit in DB on_postload_evidence_commented Triggered on evidence comment, after commit in DB on_postload_evidence_comment_update Triggered on evidence comment update, after commit in DB on_postload_evidence_comment_delete Triggered on evidence comment deletion, after commit in DB on_postload_task_commented Triggered on task comment, after commit in DB on_postload_task_comment_update Triggered on task comment update, after commit in DB on_postload_task_comment_delete Triggered on task comment deletion, after commit in DB on_postload_ioc_commented Triggered on ioc comment, after commit in DB on_postload_ioc_comment_update Triggered on ioc comment update, after commit in DB on_postload_ioc_comment_delete Triggered on ioc comment deletion, after commit in DB on_postload_event_commented Triggered on event comment, after commit in DB on_postload_event_comment_update Triggered on event comment update, after commit in DB on_postload_event_comment_delete Triggered on event comment deletion, after commit in DB on_postload_note_commented Triggered on note comment, after commit in DB on_postload_note_comment_update Triggered on note comment update, after commit in DB on_postload_note_comment_delete Triggered on note comment deletion, after commit in DB on_postload_alert_commented Triggered on alert comment, after commit in DB on_postload_alert_comment_update Triggered on alert comment update, after commit in DB on_postload_alert_comment_delete Triggered on alert comment deletion, after commit in DB"},{"location":"development/structure/","title":"Structure overview","text":""},{"location":"development/structure/#flask","title":"Flask","text":"

IRIS uses Flask for the web engine.

"},{"location":"development/structure/#routes-and-blueprints","title":"Routes and blueprints","text":"

Each page and API endpoints (eg /login, /dashboard, /case/assets/list, etc) refers to a route in the IRIS Flask app. They define what the application should do when Flask receives a request on an URI. To keep structure in the projects, these routes are grouped by Blueprints. The Blueprints reflects the structure shown in the IRIS UI left menu. For instance there is a case and an activities Blueprint.

The Blueprints and thus routes are defined in source > app > blueprints. All the blueprints are registered in source > app > views.py.

"},{"location":"development/structure/#templates","title":"Templates","text":"

IRIS uses dynamic page templating when an URI is visited. These Jinja2 templates are filled at runtime with the needed information and then returned to the client. Each route offering a page (i.e non-API endpoints) thus relies on a template. These are set in a folder named templates in each Blueprint. For instance, for the dashboard template : source > app > blueprints > dashboard > templates > index.html.

"},{"location":"development/structure/#static-contents","title":"Static contents","text":"

Static content is served from a common folder under source > app > static > assets. It contains CSS, JS and images. These can be accessed by pages using \"/static/assets/<the-resource>\".

"},{"location":"development/structure/#sqlalchemy","title":"SQLAlchemy","text":"

For the database management, the application uses SQLAlchemy with a PostgreSQL backend. There is - normally - no need to directly deal with PostgreSQL, everything goes through SQLAlchemy. It provides a Python overlay which allows to talk to the DB with objects.

"},{"location":"development/structure/#models","title":"Models","text":"

Each table of the app is defined by a model. These are defined in source > app > model. When IRIS starts, it looks for the already created tables and creates the missing ones if needed. If changes are done on a table or field, then a migration is needed. This is explained in Alembic migrations.

"},{"location":"development/structure/#requests","title":"Requests","text":"

To help structuring the code, we are trying to move the DB code from the routes code. This is partially done and work in progress. If your route requests the DB, please put the DB code in source > app > datamgmt.

"},{"location":"development/structure/#alembic","title":"Alembic","text":"

To apply schema migration without the need to rebuild the DB, IRIS uses Alembic. It allows to define migration scheme and IRIS calls it when it starts so users can upgrade without too much hassles.

"},{"location":"development/structure/#hooks-modules-and-tasks","title":"Hooks, modules and tasks","text":"

Modules are handled via tasks thanks to Celery and RabbitMQ. More info here and here.

"},{"location":"development/structure/#iris-startup","title":"IRIS startup","text":"

When starting-up, IRIS initiates a bunch of DB objects, whether it is started for the first time or just restarted. Objects already created are not recreated, but the missing ones are applied. This ensure a smooth migration between versions. These are defined in source > app > post_init.py. The scripts also contains the code that runs th DB migration with Alembic.

"},{"location":"development/modules/","title":"Modules","text":""},{"location":"development/modules/#introduction","title":"Introduction","text":"

A DFIR-IRIS Module (DIM) is a Python package allowing to extend IRIS features. DIMs are not running constantly and are only called following specific actions done by users.

We distinct two types of modules:

  • Pipeline modules: Allow uploading and processing of evidences through modular pipelines (eg: EVTX parsing and injection into a database or data visualiser). These are called when a user queries Update case and select evidences to process.
  • Processor modules: Allow processing of IRIS data upon predefined actions / hooks. (eg: be notified when a new IOC is created and get VT/MISP insights for it). These are either called automatically upon specific events, or if a user manually triggers them.

Except for some triggers for processor modules, all tasks provided by DIMs are run asynchronously in RabbitMQ tasks, so they don't impact the UI.

Both types of DIMs have the same structure, they only differ in their configurations and how they handle the data they receive. For that purpose, every DIM inherit from a common class named IrisModuleInterface - available here - which provides the basic structure and methods of a module.

Hint

To quickly start writing a new module, one can follow these tutorials.

"},{"location":"development/modules/#overview","title":"Overview","text":"

Modules are instantiated upon actions (hooks, triggers, user actions) and this occurs each time the said actions occur. It implies the initiation of a module has to be very quick. In most of the case, the __init__ method should not even be overwritten.

They can live either in the worker or the web-app, depending on their type and action they are handling. They can also live in both. This implies multiple instances of the same module can run at the same time.

The graph below shows two modules of different types running in the worker and interacting with external elements.

Modules don't have to handle the task creations or resource locks. This is handled by IRIS. They just need to process the data they received and return results in a predefined manner.

"},{"location":"development/modules/#common-structure","title":"Common structure","text":"

The section below describes the common structure of modules.

"},{"location":"development/modules/#directory-structure","title":"Directory structure","text":"
setup.py                # Setup configuration to build the module \nREADME.md               # README \niris_example_name       # Name of the package \n    __init__.py              # Declaration of the package and main class\n    IrisExampleConfig.py     # Configuration of the module to help keep the main file clean \n    IrisExampleInterface.py  # Main class of the module \n    module_helper            # Sub module containing the helper functions of the module \n      helper.py              # for instance access to ext resource, manipulation of data \n      helper2.py             # etc. \n
"},{"location":"development/modules/#the-initpy-file","title":"The init.py file","text":"

Iris loads the modules dynamically. To do so, it needs to know the name of the main class of the module and relies on __init__.py to find this information. 

__iris_module_interface = \"IrisEXAMPLEInterface\"\n

Where IrisEXAMPLEInterface is the main class of the module and inherits of the base class IrisModuleInterface.

Caution

Failing to provide the main class in __init__.py or having the main class inherit from IrisModuleInterface will make IRIS fail each time it attempts to load the module.

"},{"location":"development/modules/#the-module-configuration","title":"The module configuration","text":"

Iris needs to know what the module is doing and what services it is providing. This is done via the attributes of the main class (let's say IrisEXAMPLEInterface). The attributes are :

  • _module_name : string - \"human\" name presented to users.
  • _interface_version : float - version of IrisModuleInterface used. If the version is not supported, the server will refuse to register the module.
  • _module_version : float - version of the module itself to help users keep tracks of evolutions.
  • _module_type: string - Type of module. The available modules types are listed in IrisModuleInterface.IrisModuleTypes
  • _pipeline_support : bool - should be set to True if it implements a pipeline process (aka module of type pipeline_module).
  • _pipeline_info : dict - contains the configuration of the pipeline. The following structure must be followed:
pipeline_info = {\n# Name of the pipeline used for internal tracking. This \n# must be unique among all modules so pick something really unique \n\"pipeline_internal_name\": \"example_pipeline\",\n# The name of the pipeline presented to the user. Use something \n# that will help the users to identify the right pipeline\n\"pipeline_human_name\": \"Example Pipeline\",\n# Arguments presented to the users when they select the pipeline\n\"pipeline_args\": [\n['some_index', 'required'],\n['example_argument', 'optional']\n]\n}\n
  • _module_configuration : A list of dict. The list contains each field needed by the module. This list is shown in the Iris webpage of the module configuration. Each field in an entry is mandatory. 
_module_configuration = [\n{\n\"param_name\": \"vt_api_key\",\n\"param_human_name\": \"VT API Key\",\n\"param_description\": \"Virus total API key\",\n\"default\": None,\n\"mandatory\": True,\n\"type\": \"sensitive_string\"\n},\n{\n\"param_name\": \"vt_key_is_premium\",\n\"param_human_name\": \"VT Key is premium\",\n\"param_description\": \"Set to True if the VT key is premium\",\n\"default\": False,\n\"mandatory\": True,\n\"type\": \"bool\"\n},\n{\n\"param_name\": \"vt_ip_assign_asn_as_tag\",\n\"param_human_name\": \"Assign ASN tag to IP\",\n\"param_description\": \"Assign a new tag to IOC IPs with the ASN fetched from VT\",\n\"default\": True,\n\"mandatory\": True,\n\"type\": \"bool\"\n}\n]\n

The above example results in the following.

"},{"location":"development/modules/quick_start/processor/","title":"Processor modules","text":"

In this tutorial, we demonstrate the steps to write a basic processor module which subscribes to a hook, and log what it receives when the hook is triggered. We will also add a configuration setting to offer our users the ability disable this feature.

We'll call it IrisDummyModule.

"},{"location":"development/modules/quick_start/processor/#project-structure-overview","title":"Project structure overview","text":"

As described in the development module main page, the module should have the following structure. 

setup.py                # Setup configuration to build the module \nREADME.md               # README \niris_dummy_module       # Name of the package \n__init__.py              # Declaration of the package and main class\nIrisDummyConfig.py       # Configuration of the module to help keep the main file clean \nIrisDummyModule.py    # Main class of the module \n

While the module could have only one main file IrisDummyModule.py, we recommend splitting its configuration into a new configuration file (here IrisDummyConfig.py) to keep the code clear.

There is no mandatory naming convention for the files or the class or the methods. We chose this one to keep things clear, and we recommend following the same. But it's up to you really.

We will walk over these files one by one during this tutorial.

"},{"location":"development/modules/quick_start/processor/#creating-the-interface","title":"Creating the interface","text":"

The interface is the code that talks with IRIS. It implements methods that call and are called by the server. It needs to inherit IrisModuleInterface class from the IrisModuleInterface package. This module handles most of the methods needed by IRIS to recognize, set up and call the module. By inheriting this class in our interface, we avoid writing that part ourselves.

Let's write our basic interface class. The name of the file has to be the name of the main class, that's the only constraint. We'll see later on why.

iris_dummy_module/IrisDummyModule.py
#!/usr/bin/env python3\n# Import the IrisInterface class\nfrom iris_interface.IrisModuleInterface import IrisModuleInterface\n# Create our module class\nclass IrisDummyModule(IrisModuleInterface):\npass \n

That's it! Actually this class is not doing anything right now. We'll need to add a few methods to register our hook later.

But first we need to indicate to IRIS what is our main interface class. Remember, there is no convention restriction, so IRIS has no way to know which class it should instantiate to call our module.

To do so, we need to set a specific variable in our __init__.py.

iris_dummy_module/__init__.py
# Set the __iris_module_interface variable to the name of our main class. \n# When IRIS instantiates the python module, it looks for \"module.__iris_module_interface\"\n# And then tries to instantiate the class \"__iris_module_interface.__iris_module_interface\", here 'IrisDummyModule.IrisDummyModule'. \n# That's why the python file must have the same name as the class.  \n__iris_module_interface = \"IrisDummyModule\"\n

Our module is now recognizable by IRIS Pretty simple right?

"},{"location":"development/modules/quick_start/processor/#writing-the-configuration","title":"Writing the configuration","text":"

The next step is to describe what the module is doing, its name, its configuration, etc. This is done by overwriting predefined variables of the IrisModuleInterface class.

Let's create our Python configuration file and go through each variables.

iris_dummy_module/IrisDummyConfig.py
# Import the module types list,  so we can indicate the type of our module \nfrom iris_interface.IrisModuleInterface import IrisModuleTypes \n# Human name displayed in the GUI Manage > Modules. This can be anything, \n# but try to put something meaningful, so users recognize your module. \nmodule_name = \"IrisDummy\"\n# Description displayed when editing the module configuration in the UI. \n# This can be anything, \nmodule_description = \"Provides a dummy module that replies to one hook\"\n# Set the interface version used. This needs to be the version of \n# the IrisModuleInterface package. This version is check by the server to\n# to ensure our module can run on this specific server \ninterface_version = 1.1\n# The version of the module itself, it can be anything \nmodule_version = 1.0\n# The type of the module, here processor \nmodule_type = IrisModuleTypes.module_processor\n# Our module is a processor type, so it doesn't offer any pipeline \npipeline_support = False\n# Provide no pipeline information as our module don't implement any \npipeline_info = {}\n# The configuration of the module that will be displayed and configurable \n# by administrators on the UI. This describes every parameter that can \n# be set. \nmodule_configuration = [\n{\n\"param_name\": \"log_received_hook\",\n\"param_human_name\": \"Log received hook\",\n\"param_description\": \"Logs a message upon hook receiving if set to true. Otherwise do nothing.\",\n\"default\": True,\n\"mandatory\": True,\n\"type\": \"bool\"\n}\n]\n

The module configuration parameters are the following :

  • param_name : The internal parameter name. This will be used by the module itself to fetch the value when needed.
  • param_human_name : The name displayed on the UI for this specific parameter
  • param_description: A description explaining what this parameter is doing to help administrators
  • default: The default value of our parameter. Here we set to True, so after install our module is already configured and ready to log the hook.
  • mandatory: Indicates whether the parameter is mandatory or not. If set to True and no value is provided (either by admin or by default), the module is automatically disabled by IRIS
  • type: The type of parameter. Here a boolean, which will be rendered under the form of a checkbox.

A module can have as many parameters as it needs.

We now need to update our main class to set this configuration.

iris_dummy_module/IrisDummyModule.py
#!/usr/bin/env python3\n# Import the IrisInterface class\nfrom iris_interface.IrisModuleInterface import IrisModuleInterface\n# Create our module class\nclass IrisDummyModule(IrisModuleInterface):\n# Set the configuration\n_module_name = interface_conf.module_name\n_module_description = interface_conf.module_description\n_interface_version = interface_conf.interface_version\n_module_version = interface_conf.module_version\n_pipeline_support = interface_conf.pipeline_support\n_pipeline_info = interface_conf.pipeline_info\n_module_configuration = interface_conf.module_configuration\n_module_type = interface_conf.module_type\npass \n

Done! The module is now providing enough information to IRIS, so it knows exactly what our module do and what needs to be called to run it.

However, our module is still doing nothing. Let's make it subscribe to an IRIS hook.

"},{"location":"development/modules/quick_start/processor/#subscribing-to-a-hook","title":"Subscribing to a hook","text":"

Hooks allow to be notified by IRIS when a specific event occurs (IOC creation, deletion, etc). For a comprehensive description of hooks, please see the Hooks section of this documentation.

The registration (or subscription) to a hook occurs at two moments during the life of a module:

  • When the module is added to IRIS
  • When the configuration of the module is changed by an Admin. This allows dynamic subscription and deregistration of hooks depending on the config.

These registration/deregistration events are triggered by IRIS, and are propagated to modules through the IrisModuleInterface method register_hooks [ref].

To register to a hook, we need to override this method and register our hook within this method. To do so, IrisModuleInterface offers us another method register_to_hook [ref], which we can call for each hook we want to subscribe.

Here is a summary of the events:

  1. IRIS calls register_hooks of our module. This indicates it is time for us to register our hooks.
  2. Within this method, we call register_to_hook for each hook we want to subscribe

Let's add this to our main class and register to the on_postload_ioc_create. This will notify use each time a new IOC is created and committed to the database.

iris_dummy_module/IrisDummyModule.py
#!/usr/bin/env python3\n# Import the IrisInterface class\nfrom iris_interface.IrisModuleInterface import IrisModuleInterface\n# Create our module class\nclass IrisDummyModule(IrisModuleInterface):\n# Set the configuration\n_module_name = interface_conf.module_name\n_module_description = interface_conf.module_description\n_interface_version = interface_conf.interface_version\n_module_version = interface_conf.module_version\n_pipeline_support = interface_conf.pipeline_support\n_pipeline_info = interface_conf.pipeline_info\n_module_configuration = interface_conf.module_configuration\n_module_type = interface_conf.module_type\ndef register_hooks(self, module_id: int):\n\"\"\"\n        Called by IRIS indicating it's time to register hooks.  \n        :param module_id: Module ID provided by IRIS.\n        \"\"\"\n# Call the hook registration method. We need to pass the \n# the module_id to this method, otherwise IRIS won't know \n# to whom associate the hook. \n# The hook name needs to be a well known hook name by IRIS. \nstatus = self.register_to_hook(module_id, iris_hook_name='on_postload_ioc_create')\nif status.is_failure():\n# If we have a failure, log something out \nself.log.error(status.get_message())\nelse:\n# Log that we successfully registered to the hook \nself.log.info(f\"Successfully subscribed to on_postload_ioc_create hook\")\n

That's it! Our module has now officially subscribed to a hook and will be notified each time an IOC is created.

So how the module is notified? Once again this is done by a method named hooks_handler [ref] that IrisModuleInterface provides, and we need to overwrite.

This method is called each time one of the event associated to the hook we subscribed is triggered. It provides the name of the hook and as well as the data associated to it. By overwriting this method, we can process the hook and the data!

We will add a condition in this method, that is if the administrator sets the module parameter log_received_hook to False, then the module won't log anything and simply return the data.

Hint

The current configuration of the module can be accessed with the attribute self._dict_conf.

iris_dummy_module/IrisDummyModule.py
#!/usr/bin/env python3\n# Import the IrisInterface class\nfrom iris_interface.IrisModuleInterface import IrisModuleInterface\n# Create our module class\nclass IrisDummyModule(IrisModuleInterface):\n# Set the configuration\n_module_name = interface_conf.module_name\n_module_description = interface_conf.module_description\n_interface_version = interface_conf.interface_version\n_module_version = interface_conf.module_version\n_pipeline_support = interface_conf.pipeline_support\n_pipeline_info = interface_conf.pipeline_info\n_module_configuration = interface_conf.module_configuration\n_module_type = interface_conf.module_type\ndef register_hooks(self, module_id: int):\n\"\"\"\n        Called by IRIS indicating it's time to register hooks.  \n        :param module_id: Module ID provided by IRIS.\n        \"\"\"\n# Call the hook registration method. We need to pass the \n# the module_id to this method, otherwise IRIS won't know \n# to whom associate the hook. \n# The hook name needs to be a well known hook name by IRIS. \nstatus = self.register_to_hook(module_id, iris_hook_name='on_postload_ioc_create')\nif status.is_failure():\n# If we have a failure, log something out \nself.log.error(status.get_message())\nelse:\n# Log that we successfully registered to the hook \nself.log.info(f\"Successfully subscribed to on_postload_ioc_create hook\")\ndef hooks_handler(self, hook_name: str, data):\n\"\"\"\n    Called by IRIS each time one of our hook is triggered. \n    \"\"\"\n# read the current configuration and only log the call if \n# our parameter is set to true \nif self._dict_conf.get('log_received_hook') is True:\nself.log.info(f'Received {hook_name}')\nself.log.info(f'Received data of type {type(data)}')\n# Return a standardized message to IRIS saying that everything is ok. \n# logs=list(self.message_queue) is needed, so the users can see the logs \n# our module generated during its execution.  \nreturn InterfaceStatus.I2Success(data=data, logs=list(self.message_queue))\n

We are done! Our module is now fully ready to register, subscribe to a hook and act when notified.

"},{"location":"development/modules/quick_start/processor/#installing-and-registering-the-module","title":"Installing and registering the module","text":"

We need now need to build and install the module. To do so, you'll need this script and an IRIS docker instance running on the same machine.

The script will build the module, copy it to the docker instances, install it within them and restart the dockers.

  1. From within the root directory of the module, paste the script
  2. Make it executable chmox +x buildnpush2iris.sh
  3. Execute it ./buildnpush2iris.sh -a

The module should now be installed. We can register it in IRIS as explained here.

"},{"location":"operations/alerts/","title":"Alerts","text":"

Introduced in IRIS v2.1.0

Alerts can be fed directly into IRIS using the Alerts API. Any source can inject alerts into IRIS, as long as it can send HTTP requests and respects the alert format.

A service account with the alert_read and alert_write permission can be used to send alerts to IRIS.

Warning

This section is only available for users with the alert_read and alert_write permissions.

"},{"location":"operations/alerts/#viewing-alerts","title":"Viewing alerts","text":"

Alerts can then be viewed in the Alerts section of IRIS. Analysts can then triage the alerts and create cases from them.

Each alert can be expanded to show more details.

"},{"location":"operations/alerts/#alerts-assignment","title":"Alerts assignment","text":"

Alerts can be assigned to analysts. This can be done directly from the alert view.

To self-assign an unassigned alert, click on the hand icon on the left.

Clicking again on the hand icon will prompt with a list of analysts to assign the alert to.

The right button Assign, when hovering above an alert, can also be used to assign the alert to an analyst.

"},{"location":"operations/alerts/#merge-escalation-operations","title":"Merge / escalation operations","text":""},{"location":"operations/alerts/#creating-cases-from-alerts","title":"Creating cases from alerts","text":"

Alerts can be escalated/merged into a new case. When hovering above an alert, a Merge button will appear.

Once clicked, a new window appears, requesting additional information. In this window, the analyst can:

  • Set the name of the case
  • Select the case template
  • Select the IOCs to import
  • Select the assets to import
  • Add an escalation note
  • Set the case tags
  • Choose if the alert should be imported in the timeline as an event
"},{"location":"operations/alerts/#merge-alerts-into-an-existing-case","title":"Merge alerts into an existing case","text":"

Alerts can also be escalated/merged into an existing case. When hovering above an alert, a Merge button will appear.

Once clicked, a new window appears requesting additional information. The button Merge into existing case needs to be clicked. A new dropdown appears and allows to select the case to merge the alert into.

Similar to the case creation, the analyst can:

  • Select the IOCs to import
  • Select the assets to import
  • Add an escalation note
  • Choose if the alert should be imported in the timeline as an event

The selected IOCs and assets are then added to the selected case.

"},{"location":"operations/alerts/#unmerge-alerts-from-a-case","title":"Unmerge alerts from a case","text":"

Alerts can be unmerged from a case.

Info

When unmerging an alert, the alert is not deleted. It is only removed from the case. The alert state is not changed. The IOCs and assets are not removed from the case.

When a case is merged, a new link appears on the alert and mentions the case it was merged into. Clicking on this link allows to browse the case or to unmerge the alert.

"},{"location":"operations/alerts/#alerts-relationships","title":"Alerts relationships","text":"

Each alert have a Relastionships section. This section shows the relationships between the alert and other objects in IRIS. This feature is in preview and might report false relationships.

The relationships are computed using the following logic:

  • Same IOC, based on the IOC type and value
  • Same Asset, based on the asset type and name

By default the view limits the relationships to 100 nodes and looks back 7 days. This can be updated directly in the alert view.

"},{"location":"operations/api/","title":"API","text":"

IRIS is meant to be plug-able and be integrated with the existing environments.

Through the REST API, one can do almost as much as it is possible to do through the web interface. Under the hood, the web interface is actually talking to the API.

The API endpoints are reachable on the same port as the web interface, i.e 443/HTTPS by default.

Hint

A Python client is available here to ease the automation.

"},{"location":"operations/api/#api-keys","title":"API Keys","text":"

The first step is to obtain an API key. Each user is automatically attributed one when it is created. It can be found on the left panel, under username and My Settings.

Token exposure

In case the token is exposed and needs to be changed, a new one can be generated with the Renew option. Renewing a token revokes the previous.

"},{"location":"operations/api/#references","title":"References","text":"

The API constantly evolves with IRIS and thus multiple versions exists. Use the references below to check which API version applies to your IRIS version. Starting from IRIS v1.4.0, the supported API version can also be checked in the UI Advanced > Server settings.

IRIS Version API Version & Reference v1.2.0 API v1.0.0 v1.2.1 API v1.0.0 v1.3.0 API v1.0.1 v1.3.1 API v1.0.1 v1.4.0 API v1.0.2 v1.4.1 API v1.0.2 v1.4.2 API v1.0.2 v1.4.3 API v1.0.3 v1.4.4 API v1.0.3 v1.4.5 API v1.0.3 v2.0.x API v2.0.0 v2.1.x API v2.0.1 v2.2.x API v2.0.1 v2.3.x API v2.0.2 v2.4.x API v2.0.4"},{"location":"operations/api/#how-to-use","title":"How to use","text":"

The API token is used as a Bearer and needs to be present in the header Authorization when issuing requests. For example, to list all the cases: 

   curl --request GET \\\n--url http://<yourserver_ip>/manage/cases/list?cid=1 \\\n--header 'Authorization: Bearer mWpCUVNzBMU5EnbIAK50jLPhYjKBTHZjobdogc_n_yixpJTmt9tzAf8WYDI7m5XgB9wCJnlaXlHIh9RZjtp2fA' \\\n--header 'Content-Type: application/json'\n

The only way to revoke a token is to renew the current one. Once done, the previous API token does not exist anymore in the database and it becomes ineffective.

"},{"location":"operations/case_templates/","title":"Case templates","text":"

Introduced in IRIS v2.1.0

Case templates are a way to pre-configure a case with a set of predefined informations. The case templates can be managed in Advanced > Case templates.

Info

This section is only available for users with the administrator role.

Case templates are made of a set of informations that will be used to pre-fill the case creation form. The following elements can be set:

  • Title prefix: A prefix to add to case title,
  • Summary: content to prefill the summary,
  • Classification: The classification of the case. Should be a lowercase name matching an existing classification in IRIS,
  • Tags: A list of case tags,
  • Tasks: A list of dictionaries defining tasks. Tasks are defined by title (required), description, and list of tags,
  • Notes: A list of dictionaries defining note directories. Note directories are defined by title (required), and list of notes. Notes have title (required) and content

Looking for case templates?

We are providing a set of case templates in the IRIS Resources repository.

"},{"location":"operations/case_templates/#structure-of-templates","title":"Structure of templates","text":"

The following defines the structure of a case template: 

{\n\"name\": \"ransomware_infection\",\n\"display_name\": \"Ransomware Infection Template\",\n\"description\": \"This case template describes first-response tasks to handle information system compromised by a ransomware.\",\n\"author\": \"DFIR-IRIS\",\n\"classification\": \"malicious-code:ransomware\",\n\"title_prefix\": \"[RANS]\",\n\"summary\": \"# Context \\n\\n\\n# Contact \\n\\n\\n# Actions \\n\\n\\n\",\n\"tags\": [\"ransomware\",\"malware\"],\n\"tasks\": [\n{\n\"title\": \"Identify the perimeter\",\n\"description\": \"The perimeter of compromise must be identified\",\n\"tags\": [\"identify\"]\n},\n{\n\"title\": \"Collect compromised hosts\",\n\"description\": \"Deploy Velociraptor and start collecting evidence\",\n\"tags\": [\"collect\", \"velociraptor\"]\n},\n{\n\"title\": \"Containment\"\n}\n],\n\"note_directories\": [\n{\n\"title\": \"Identify\",\n\"notes\": [\n{\n\"title\": \"Identify the compromised accounts\",\n\"content\": \"# Observations\\n\\n\"\n}\n]\n},\n{\n\"title\": \"Collect\",\n\"notes\": [\n{\n\"title\": \"Velociraptor deployment\"\n},\n{\n\"title\": \"Assets collected\",\n\"content\": \"# Assets collected\\n\\n# Assets not collected\"\n}\n]\n}\n]\n}\n
"},{"location":"operations/case_templates/#using-case-templates","title":"Using case templates","text":"

Case templates can be used when creating a new case. On the UI, when creating a case, select the case template to use in the Case template dropdown. The case will then automatically use the informations defined in the template.

"},{"location":"operations/configuration/","title":"Configuration","text":"

Since v2.0.0 the entire configuration is done through the .env file at the root of the IRIS directory.

"},{"location":"operations/configuration/#default-configuration","title":"Default configuration","text":"

The default configuration is provided through a .env.model file at the root of the IRIS directory. One need to copy this file to .env and modify it if needed.

The default configuration is suitable for testing only. See the section below to configure IRIS for production.

"},{"location":"operations/configuration/#production-configuration","title":"Production configuration","text":""},{"location":"operations/configuration/#secrets","title":"Secrets","text":""},{"location":"operations/configuration/#required-changes","title":"Required changes","text":"

The following secrets in the .env need to be changed for production. We recommend using OpenSSL to generate different values from each secret: openssl rand -base64 64

  • POSTGRES_PASSWORD: Password of the postgres user
  • POSTGRES_ADMIN_PASSWORD: Password of the db admin user
  • IRIS_SECRET_KEY: Key used by Flask to secure the session cookies
  • IRIS_SECURITY_PASSWORD_SALT: A salt used for password encryption in the DB

Critical configuration

These settings are critical and need to be set properly otherwise authentication bypass may occur.

"},{"location":"operations/configuration/#optionnal-changes","title":"Optionnal changes","text":"

To automate the provisionning of IRIS, one might need to set the default administrator API token and password. This can be achieve with the following environment variables. If those variables are not set, random ones are generated during the very first boot of the application.

Warning

The administrator password is printed in the logs. It is recommended to change it as soon as possible. The set of the following environment variables has no effect once the administrator account is created, i.e after the very first boot.

  • IRIS_ADM_PASSWORD: Password of the administrator account. The password need to match the default password policy or the administrator won't be able to login,
  • IRIS_ADM_API_KEY: API key of the administrator. A random long string. No verification for the complexity is done. We recommend using openssl rand -base64 64
"},{"location":"operations/configuration/#certificates","title":"Certificates","text":"

IRIS is configured to use a self-signed certificate by default. This is suitable for testing only. To use your own certificate, you need to set the following environment variables:

  • KEY_FILENAME: The filename of the key file in the certificates/web_certificates directory at the root of the IRIS directory
  • CERT_FILENAME: The filename of the certificate file in the certificates/web_certificates directory at the root of the IRIS directory

Once the changes are done, nginx docker container need to be rebuilt with the following command:

docker-compose stop nginx\ndocker-compose build nginx --no-cache\ndocker-compose up
"},{"location":"operations/configuration/#authentication","title":"Authentication","text":""},{"location":"operations/configuration/#ldap","title":"LDAP","text":"

IRIS can be configured to use LDAP authentication. See the Authentication section for more details.

"},{"location":"operations/configuration/#available-settings","title":"Available settings","text":"

These environment variables are availabled to be set.

Key Section Opt Description SERVER_NAME Nginx No Passed to the server_name in NGINX configuration KEY_FILENAME Nginx No SSL Cert key filename passed to the NGINX configuration CERT_FILENAME Nginx No SSL Cert filename passed to the NGINX configuration INTERFACE_HTTPS_PORT Nginx Yes Listening interface of IRIS POSTGRES_USER DB No Name of the POSTGRES user POSTGRES_PASSWORD DB No Password of the POSTGRES user POSTGRES_ADMIN_USER DB No Name of the admin user POSTGRES_ADMIN_PASSWORD DB No Password of the ADMIN user POSTGRES_DB DB No Name of the DB used by IRIS POSTGRES_SERVER DB No Hostname or IP of the DB POSTGRES_PORT DB No Port of the DB server DOCKERIZED IRIS Yes Set to 1 when using dockers (default) IRIS_SECRET_KEY IRIS No Secret key used to secure sessions - needs to be random IRIS_SECURITY_PASSWORD_SALT IRIS No Secret used to salt the passwords in DB - needs to be random IRIS_UPSTREAM_SERVER IRIS No WebApp upstream server - used to configure nginx reverse proxy IRIS_UPSTREAM_PORT IRIS No WebApp upstream server port - used to configure nginx reverse proxy IRIS_ORGANISATION_NAME IRIS No Name of the company / organisation. Used on the UI IRIS_LOGIN_BANNER_TEXT IRIS No Text displayed on the login page IRIS_LOGIN_PTFM_CONTACT IRIS No Contact information displayed on the login page IRIS_UPLOADED_PATH IRIS No Path to store uploaded data. IRIS_BACKUP_PATH IRIS No Path to store backup files. IRIS_TEMPLATES_PATH IRIS No Path of the templates IRIS_DATASTORE_PATH IRIS No Path of the datastore files IRIS_DEMO_ENABLED Demo No Set to True to switch IRIS to Demo mode IRIS_DEMO_DOMAIN Demo No URL of the demonstration server IRIS_DEMO_USER_SEED Demo No Random seed to generate demo users IRIS_DEMO_ADM_SEED Demo No Random seed to generate admin users for demo CELERY_BROKER Celery No Broker URL used to handle IRIS tasks IRIS_AUTHENTICATION_TYPE Auth No IRIS auth mode : local or ldap IRIS_ADM_PASSWORD Auth Yes Set to use as initial password of the administrator account. Only works for the very first run of IRIS. Needs to match the password policy IRIS_ADM_API_KEY Auth Yes Set to use as initial API Key of the administrator IRIS_ADM_EMAIL Auth Yes Set to use as initial email of the administrator IRIS_ADM_USERNAME Auth Yes Set to use as initial username of the administrator LDAP_SERVER Auth Yes LDAP server IP or domain LDAP_PORT Auth Yes LDAP server port LDAP_USER_PREFIX Auth Yes Prefix to search the users within LDAP_USER_SUFFIX Auth Yes Suffix to search the users within LDAP_USE_SSL Auth Yes Set to True to use LDAPS LDAP_VALIDATE_CERTIFICATE Auth Yes Set to True to verify the server certificate validity LDAP_TLS_VERSION Auth Yes TLS version to use LDAPS LDAP_SERVER_CERTIFICATE Auth Yes Path of the LDAP server certificate LDAP_PRIVATE_KEY Auth Yes Path of the LDAP private certificate LDAP_PRIVATE_KEY_PASSWORD Auth Yes Password of the private key LDAP_AUTHENTICATION_TYPE Auth Yes Simple, SASL or NTLM LDAP_CUSTOM_TLS_CONFIG Auth Yes If set to true, the TLS configuration is not set by IRIS and taken from the defined environment. Default to False"},{"location":"operations/custom_attributes/","title":"Custom Attributes","text":"

Introduced in IRIS v1.4.0

All the case objects can be extended with custom attributes. These attributes can be added by :

  • Administrators via the GUI
  • Modules (for instance, the VT module adds a VT Report attribute to each objects it analyses)

Attributes offer the ability to :

  • Add inputs for analysts to fill additional details
  • Add static/dynamic content such as HTML/JS for enhanced possibilities.

This section only describes how an administrator can add or delete attributes to an object.

Tip

We have publish a detailed article of custom attributes with advanced usage on our blog.

"},{"location":"operations/custom_attributes/#management-page","title":"Management page","text":"

Custom attributes can be changed in the Advanced > Custom Attributes section on the left panel.

The page lists the objects for which custom attributes can be added or modified.

  • Cases
  • Customers
  • Evidences
  • Notes
  • Tasks
  • Assets
  • Events
  • IOC
"},{"location":"operations/custom_attributes/#attributes-structure","title":"Attributes structure","text":"

Attributes are defined in JSON which describes tabs and fields that makes the attributes. 

  {\n\"Tab Name 1\": {                     // Defines a new tab \n\"Field 1\": {                    // Defines a new field within the Tab Name 1\n\"type\": \"input_string\",     // Defines the type of field, here a standard string input\n\"mandatory\": true,          // Indicates whether the field is mandatory upon saving\n\"value\": \"\"                 // Default value if any, else empty\n},\n\"Field 2\": {                    // Defines a second field within the tab Tab Name 1\n\"type\": \"input_checkbox\",   // Defines an input checkbox\n\"mandatory\": false,         // Indicates whether the field is mandatory upon saving\n\"value\": false              // Default value - must be set for booleans\n}\n},\n\"VT report\": {                      // Defines a second tab named VT report\n\"Content\": {                    // Defines a new field Content within the VT Report\n\"type\": \"html\",             // Defines an HTML interpreted content\n\"value\": \"\"                 // Default value if any, else empty\n}\n}\n}\n

The code above would be rendered as :

With :

  1. The native information of the object. This cannot be changed or updated
  2. The new attribute Tab Name 1
  3. The other new attribute VT report
"},{"location":"operations/custom_attributes/#attributes-taxonomy","title":"Attributes taxonomy","text":"

The available fields type are available for rendering :

  • input_string: Standard input text
  • input_textfield: Standard input textfield
  • input_checkbox: Standard checkbox
  • input_date: Standard date input
  • input_datetime: Standard date and time input
  • input_select: Standard select input. Need \"options\" tag to describe the available options, as a list of string.
  • raw: A static content rendered in raw text. HTML is not be interpreted.
  • html: A static content rendered as HTML. This is by nature prone to abuse, but at the same time allows adding custom JS scripts.
"},{"location":"operations/custom_attributes/#updating-resetting-attributes","title":"Updating / resetting attributes","text":"

When an attribute is updated, it will try to update all the existing objects with the new attributes. To prevent any data loss from previous attributes and attributes pushed by modules, the update is only made on attributes which don't have any values set or are type-compatibles (ie string to textfield).

The migration of an attribute can however be forced in two ways, both resulting in potential attributes data loss.

Good to know

Migrating or overwriting attributes never change the native information of an object. It only applies to custom attributes.

Partial overwrite basically resets all the values of every target objects that matches the current attribute definition. All associated values are lost. This does not impact attributes pushed by modules or previous configuration.

Complete overwrite resets all attributes of every target objects, including the ones created by modules, and then applies the current attributes. All associated values are lost.

"},{"location":"operations/custom_attributes/#example","title":"Example","text":"

Custom attributes can be more complex than what presented above. With the html type, it is possible to build almost anything. Below is an example of the custom attributes used in the IrisVT module. The {{ }} are used withing the module to generates the page with data received from VT.

Note : This example won't work as is, the value field is expanded here for reability.

IrisVT default custom attribute
{\n\"VT report\": {                      \"Content\": {                    \"type\": \"html\",             \"value\": \"<div class='row'>\n                    <div class='col-12'>\n                        <h3>Basic information</h3>\n                        <dl class='row'>\n                            {% if results.as_owner %}\n                            <dt class='col-sm-3'>AS owner</dt>\n                            <dd class='col-sm-9'>{{ results.as_owner }}</dd>\n                            {% endif %}\n                            {% if country %}\n                            <dt class='col-sm-3'>Country</dt>\n                            <dd class='col-sm-9'>{{ results.country }}</dd>\n                            {% endif %}\n                        </dl>\n                    </div>\n                </div>    \n                {% if nb_detected_urls %}\n                <div class='row'>\n                    <div class='col-12'>\n                        <h3>Detected URLS</h3>\n                        <dl class='row'>\n                            <dt class='col-sm-3'>Total detected URLs</dt>\n                            <dd class='col-sm-9'>{{ nb_detected_urls }}</dd>\n                            <dt class='col-sm-3'>Average detection ratio</dt>\n                            <dd class='col-sm-9'>{{ avg_urls_detect_ratio }}</dd>\n                        </dl>\n                    </div>\n                </div>    \n                {% endif %}\n                {% if nb_detected_samples %}\n                <div class='row'>\n                    <div class='col-12'>\n                        <h3>Detected communicating samples</h3>\n                        <dl class='row'>\n                            <dt class='col-sm-3'>Total detected samples</dt>\n                            <dd class='col-sm-9'>{{ nb_detected_samples }}</dd>\n                            <dt class='col-sm-3'>Average detection ratio</dt>\n                            <dd class='col-sm-9'>{{ avg_samples_detect_ratio }}</dd>\n                        </dl>\n                    </div>\n                </div>    \n                {% endif %}\n                <div class='row'>\n                    <div class='col-12'>\n                        <div class='accordion'>\n                            <h3>Additional information</h3>\n                            {% if results.resolutions %}\n                            <div class='card'>\n                                <div class='card-header collapsed' id='drop_res' data-toggle='collapse' data-target='#drop_resolutions' aria-expanded='false' aria-controls='drop_resolutions' role='button'>\n                                    <div class='span-icon'>\n                                        <div class='flaticon-file'></div>\n                                    </div>\n                                    <div class='span-title'>\n                                        Resolutions history\n                                    </div>\n                                    <div class='span-mode'></div>\n                                </div>\n                                <div id='drop_resolutions' class='collapse' aria-labelledby='drop_res' style=''>\n                                    <div class='card-body'>\n                                        <ul>\n                                            {% for resolution in results.resolutions %} \n                                            <li>{{ resolution.hostname }} ( Last resolved on {{resolution.last_resolved}} )</li>\n                                            {% endfor %}\n                                        </ul>\n                                    </div>\n                                </div>\n                            </div>\n                            {% endif %}\n                        </div>\n                    </div>\n                </div>\n                <div class='row'>\n                    <div class='col-12'>\n                        <div class='accordion'>\n                            <h3>Raw report</h3>\n                            <div class='card'>\n                                <div class='card-header collapsed' id='drop_r' data-toggle='collapse' data-target='#drop_raw' aria-expanded='false' aria-controls='drop_raw' role='button'>\n                                    <div class='span-icon'>\n                                        <div class='flaticon-file'></div>\n                                    </div>\n                                    <div class='span-title'>\n                                        Raw report\n                                    </div>\n                                    <div class='span-mode'></div>\n                                </div>\n                                <div id='drop_raw' class='collapse' aria-labelledby='drop_r' style=''>\n                                    <div class='card-body'>\n                                        <div id='vt_raw_ace'>{{ results| tojson(indent=4) }}</div>\n                                    </div>\n                                </div>\n                            </div>\n                        </div>\n                    </div>\n                </div> \n                <script>\n                var vt_in_raw = ace.edit('vt_raw_ace',\n                {\n                    autoScrollEditorIntoView: true,\n                    minLines: 30,\n                });\n                vt_in_raw.setReadOnly(true);\n                vt_in_raw.setTheme('ace/theme/tomorrow');\n                vt_in_raw.session.setMode('ace/mode/json');\n                vt_in_raw.renderer.setShowGutter(true);\n                vt_in_raw.setOption('showLineNumbers', true);\n                vt_in_raw.setOption('showPrintMargin', false);\n                vt_in_raw.setOption('displayIndentGuides', true);\n                vt_in_raw.setOption('maxLines', 'Infinity');\n                vt_in_raw.session.setUseWrapMode(true);\n                vt_in_raw.setOption('indentedSoftWrap', true);\n                vt_in_raw.renderer.setScrollMargin(8, 5);\n                </script>\"                 }\n}\n}\n
"},{"location":"operations/datastore/","title":"Datastore","text":"

Introduced in IRIS v1.4.5

The datastore offers a way to store files directly in the context of a case. Documents, IOCs, evidences, etc, anything can be uploaded and managed through IRIS.

"},{"location":"operations/datastore/#accessing-the-datastore","title":"Accessing the datastore","text":"

The datastore can be accessed from any page with the top-right shortcut.

A new pane will open, with a default folder tree created for the case.

"},{"location":"operations/datastore/#files","title":"Files","text":""},{"location":"operations/datastore/#adding-a-file","title":"Adding a file","text":"

To add a file to a folder, press the + button near a folder where you want to place it, and select Add file.

A new window appear and allows to upload the file. The following fields are available :

  • Filename : Name of the file to upload. Automatically detected when a file is selected,
  • Description : An optional description of the file,
  • Password : An optional password to encrypt the file in a zip with. Files marked as IOC are automatically protected with infected unless specified otherwise in this field,
  • Tags : Optional tags to help filtering later on,
  • File is IOC : If set, the file is stored on a separate folder on the server and is automatically protected with infected unless specified otherwise in the password field. The file is also added to the IOC tab of the case,
  • File is evidence : If set, the file is stored on a separate folder on the server and is added to the Evidences tab of the case.

A file can be both IOC and Evidence, in which case it is handled as an IOC and also added to the Evidence tab of the case.

Depending on the file size, the upload might take some time. We are aware that the Nginx introduces a delay compared to a direct upload. We have not yet found a configuration that does not impact the speed upload.

Once uploaded, and depending on the options selected, the file appear in the target folder with specific icons. A mouse hover explains what each icon means.

"},{"location":"operations/datastore/#files-operations","title":"Files operations","text":"

Once a file is added, a left-click on it shows a dropdown with multiple options.

  • Link : Copies in the clipboard a direct link to the file,
  • Markdown link : Copies in the clipboard a link in markdown format for direct use in a note or summary. If the file is an image, the copied link is an image tag,
  • Download : Download the file. If the file is password protected, the resulting file is a password protected zip,
  • Info : Shows multiple information on the file such as password, file size, hash, internal name, ID, UUID, etc,
  • Edit : Allows to edit the file information. Uploading a new file replaces the original, the link stays the same. It is however not possible to set a password after the initial upload,
  • Move : Move file to another directory. Once selected, click on the target directory and validate the move,
  • Delete : Delete the file entry and the file from the server. The potential entries added in IOC and Evidences are not updated.

Batch operations such as moving and deleting are also available by clicking on Select at the top right, and then selecting the files.

"},{"location":"operations/datastore/#pasting-in-notes-and-summary","title":"Pasting in notes and summary","text":"

Images can now be directly pasted in notes an summary. Only images are supported. Once an image is pasted, the file is automatically uploaded in the datastore in the folder Notes Upload and a link to the file is inserted.

Example of pasted image

The image is by default sized to 40%. Changing the end of the link =SIZE%xSIZE% allows to resize the image.

The file is now available in the DS and can be replaced if needed. The ID of the file is the one provided in the link, which can help finding out when names are updated.

Note

Under certain conditions (browser, version, OS) the image copy/paste cannot be done directly. This is a known issue, not directly linked to IRIS but related to how browsers handle files in clipboards. If you face this issue, try to open the image and copy it from there instead of the file manager. Otherwise you need to upload it via the Datastore and then get a link from it.

"},{"location":"operations/datastore/#folders","title":"Folders","text":""},{"location":"operations/datastore/#adding-a-folder","title":"Adding a folder","text":"

To add folder, press the + button near a folder where you want to place it, and select Add subfolder.

A new window appear requesting the name of the folder to create. Validate and the new folder appears in the folder tree. Files can then be added to it.

"},{"location":"operations/datastore/#moving-folders","title":"Moving folders","text":"

Folders can be moved within other folders. When doing so, every files and subfolders are also moved, like we are used to with files managers.

Click on the + near the folder to move, and then select Move. The target folder is underlined in blue. Select then the target folder which should appear underline in orange. Then validate the move.

The folder and all its children are moved in the target directory.

"},{"location":"operations/datastore/#searching","title":"Searching","text":"

When dozens of files are added, the filtering bar can be used to quickly find a file. The filtering mechanism is similar to the one in the timeline.

The query schema is : target_element:search_value AND target_element2:search_value2. There is no OR condition and searching without target does not work.

The following target elements can be used to filter :

  • name: Name of the file
  • id: ID of the file
  • uuid: UUID of the file
  • storage_name: Name of the file on the FS
  • tag: Tag of the file
  • description: Description of the file
  • is_ioc : Set to any value to filter files which are IOCs
  • is_evidence: Set to any value to filter files which are evidences
  • has_password: Set to any value to filter files which have passwords
  • sha256: SHA256 to filter files with

"},{"location":"operations/datastore/#under-the-hood","title":"Under the hood","text":"

Here a are a few concepts to better understand how the datastore is working.

Folders represented on the datastore are virtual and do not represent the folders on the system. This is to ensure smooth files operations. The files are never touched again (unless overwritten or deleted) once uploaded. When a file or directory is moved or renamed, only its parent references are updated.

Files are saved by GUID instead of their real names on the system. They are saved under the mapped volume /home/iris/server_data/datastore by default. Then three directories are created :

  • Evidences
  • IOCs
  • Regulars

Within each of these, a new subdirectory with the case ID is created when a file is uploaded. This is ensure IOC, which can be harmful, are formally identified on the server itself. Files can be found on the system by looking up the Storage UUID of the file (eg: dsf-f86926ec-513d-4e47-88fa-02110e7fb412) in these directories.

"},{"location":"operations/logging/","title":"Logging","text":"

All components of IRIS offers by-default logging in the docker instances. Depending on the OS of the hosts, the location of these logs may differ.

For Debian-based distributions, the logs are usually in /var/lib/docker/containers/. The usually interesting logs in IRIS are the following:

  • iriswebapp_app : Contains the logs of core of IRIS, including major stack traces and access control output
  • iriswebapp_worker: Contains the logs of the worker and output of modules
  • iriswebapp_nginx: Contains the logs of the reverse proxy. Every request to IRIS is logged there.
"},{"location":"operations/logging/#setting-up-forwarding","title":"Setting up forwarding","text":"

Logs of IRIS can be forwarded to a SIEM for monitoring. Below is discussed how to setup Splunk forwarding. Other drivers are available and detailed on the docker website.

  1. Enable HEC and get an HEC token from Splunk. See the Splunk documentation
  2. On the host where docker is running, create a file /etc/docker/daemon.json and specify the following content: 
    {\n\"log-driver\": \"splunk\",\n\"log-opts\": {\n\"splunk-insecureskipverify\": \"true\", \"splunk-index\": \"iris\",\n\"splunk-token\": \"YOUR HEC TOKEN\",\n\"splunk-url\": \"https://SPLUNK_SERVER:8088\"\n}\n}\n
  3. Reload the docker daemon: systemctl reload docker. The logs should appear in the Splunk instance.
"},{"location":"operations/reports/","title":"Reports","text":"

IRIS has the ability to generate reports based on the data of an investigation. The reports templates can be managed in Advanced > Templates.

Info

This section is only available for users with the Admin role.

There is two types of reports :

  • Investigation; these contains the investigation data and can produces a custom-ready document
  • Activities; these contains activities done on the case and can be used as a follow-up
"},{"location":"operations/reports/#supported-formats","title":"Supported formats","text":"

The following report formats are supported:

  • docx
  • markdown (.md)
  • html
"},{"location":"operations/reports/#structure-of-templates","title":"Structure of templates","text":"

Reports templates are made of tags, which are then processed and filed by the template engine of IRIS. The templates can have any forms as soon as they respect the tags. We are providing two example of reports.

  • Example of investigation template : Download
  • Example of activities report template : Download

Info

The templates includes a few lines that describes how to handle styles. These should not be removed. They are be present in the generated reports and need to be removed manually.

"},{"location":"operations/reports/#available-tags","title":"Available tags","text":"

The following tags are available. None are mandatory. If a tag is mistyped, the generation step will produce an error message.

Hint

To get the list of available tags for a specific IRIS version, head to /case/export?cid=1.

Hint

Standard objects are accessible with {{ objectname }}. List objects can be looped:

  {% for object in object_list %}\n    {{ object.attribute }}\n  {% endfor %} \n
  • case.name: Name of the case
  • case.description: Description of the case
  • case.open_date: Case open date
  • case.close_date: Case close date
  • case.opened_by: User that initially opened the case
  • case.for_customer: Customer linked to the case
  • case.soc_id: SOC ID number linked to the case

  • evidences: List of evidence objects (see below - given evidence as loop variable)

    • evidence.filename: File name of the evidence
    • evidence.date_added: Date of registration
    • evidence.file_hash: Hash of the evidence
    • evidence.added_by: User who added the evidence
    • evidence.custom_attributes: Custom attributes of the evidence

  • iocs: List of IOCs objects (see below - given ioc as loop variable)

    • ioc.ioc_value: Value of the IOC
    • ioc.ioc_description: Description of the IOC
    • ioc.ioc_type: Type of IOC
    • ioc.ioc_tags: Tags linked to the IOC
    • ioc.custom_attributes: Custom attributes of the IOC

  • notes: List of notes objects (see below - given note as loop variable)

    • note.note_title: Title of the note
    • note.note_content: Content of the note
    • note.note_creationdate: Creation date of the note
    • note.note_lastupdate: Date of last update
    • note.custom_attributes: Custom attributes of the note

  • tasks: List of tasks objects (see below - given task as loop variable)

    • task.task_title: Title of the task
    • task.task_description: Description of the task
    • task.task_open_date: Open date of the task
    • task.task_last_update: Last update of the task
    • task.task_close_date: Date of closure
    • task.task_status: Status of the task
    • task.task_tags: Task for the tags
    • task.custom_attributes: Custom attributes of the task

  • timeline: List of events objects (see below - given event as loop variable)

    • event.event_title: Title of the event
    • event.event_content: Content of the event
    • event.event_raw: Raw content of the event
    • event.event_date: Date when the event happened
    • event.event_source: Source of the event
    • event.category: Category of the event
    • event.event_tags: Tags of the events
    • event.last_edited_by: User who last edited the event
    • event.assets: List of assets names linked to the event
    • event.custom_attributes: Custom attributes of the event
"},{"location":"operations/reports/#examples","title":"Examples","text":""},{"location":"operations/reports/#full-documents","title":"Full documents","text":"

We are providing two example of full reports.

  • Example of investigation template : Download
  • Example of activities report template : Download
"},{"location":"operations/reports/#snippets","title":"Snippets","text":"

The following snippets aimed to be placed directly in the DOCX documents.

"},{"location":"operations/reports/#loops-and-tables","title":"Loops and tables","text":""},{"location":"operations/reports/#standard-loops","title":"Standard loops","text":"

A loop needs to be used for list objects. Loop on IOC example

The IOCs of this case are : \n\n{% for ioc in case.iocs %}\n    - {{ ioc.ioc_value }}\n    - {{ ioc.ioc_description }}\n{% endfor %}\n

"},{"location":"operations/reports/#table-loops","title":"Table loops","text":"

To use a loop in a table, a tr tag needs to be added to the loop and the loop directly integrated in the table. Loop on IOC table example

The IOCs of this case are in the following table : \n\n{%tr for ioc in case.iocs %}\n    {{ ioc.ioc_value }}\n    {{ ioc.type_name }}\n    {{ ioc.ioc_description }}\n{%tr endfor %}\n
Such as :

"},{"location":"operations/reports/#nested-loops","title":"Nested loops","text":"

Loops can be nested. Don't forget to close each loop.

Nested loop
{%for ioc in case.iocs %}\n\n    Custom attributes of {{ ioc.ioc_value }} :\n\n    {% for attribute in ioc.custom_attributes %}\n\n        - {{ attribute }}\n\n    {% endfor %}\n\n{% endfor %}\n
"},{"location":"operations/reports/#conditions","title":"Conditions","text":""},{"location":"operations/reports/#standard","title":"Standard","text":"Check if asset is compromised
{% for asset in assets %} \n\n    {% if asset.compromised %}\n        Asset {{ asset.asset_name }} is compromised\n    {% endif %}\n\n{% endfor %}\n
"},{"location":"operations/reports/#list-is-not-empty","title":"List is not empty","text":"

To check if a list of objects is not empty, use the processor tag count.

Check if case has assets
{% if assets|count %} \n    The case has assets\n{% endif %}\n
"},{"location":"operations/reports/#markdown-handling","title":"Markdown handling","text":"

The case summary and notes are in markdown. A processor tag should thus be added |markdown. Summary as markdown

This is an example of summary : \n\n{{ case.description|markdown }}\n

Loop over notes
This is an example of recursive notes  : \n\n{% for note in case.notes %}\n\n    My note named {{ note.note_title }} : \n    {{ note.note_content|markdown }}\n\n{% endfor %}\n
"},{"location":"operations/reports/#troubleshoot","title":"Troubleshoot","text":"

Most of the time an error of generation is due to misspelled tag or a missing closing tag ({% endfor %}, {% endif %}, etc). In case you cannot figure out what is going wrong, don't hesitate to reach us on Discord.

"},{"location":"operations/server_settings/","title":"Server settings","text":"

Some basic settings can be set in the section Advanced > Server settings.

  • Proxy : These settings can be inherited by modules. This avoid setting proxy for each modules. This is not enforced and is up to the module to use it or not.

  • Behavior :

    • Prevent post-init step to register default modules again during boot: By default if a module is deleted and the server is restart, the module will be registered again. Setting this will prevent this behavior.
    • Prevent post-init step to register default case objects again during boot: By default if case objects are deleted and the server is restart, the case objects will be registered again. Setting this will prevent this behavior.

  • Password policy : the password policy can be changed and is applied for the new users and next changes of users password

"},{"location":"operations/tutorials/","title":"Tutorials","text":"

The tutorials have been discared as we now provide a free demonstration instance on v200.beta.dfir-iris.org. Should you need more information or assistance to use IRIS, you can contact us here.

"},{"location":"operations/upgrades/","title":"Upgrades","text":"

Most of the time, Iris handles upgrades of the database automatically when a new version is started, thus no specific actions are required. However, some breaking changes might need manual intervention. Please use the selectors below to assess if a manual action is required.

Your current version: --Please choose current version-- v1.2.1 v1.3.0 v1.3.1 v1.4.0 v1.4.1 v1.4.2 v1.4.3 v1.4.4 v1.4.5 v2.0.0 v2.0.1 v2.0.2 v2.1.0 v2.2.0 v2.2.1 v2.2.2 v2.2.3 v2.3.0 v2.3.1 v2.3.2 v2.3.3 v2.3.4 v2.3.5 v2.3.6 v2.3.7 v2.4.5 v2.4.6 v2.4.7

Upgrading to: --Please choose target version-- v1.2.1 v1.3.0 v1.3.1 v1.4.0 v1.4.1 v1.4.2 v1.4.3 v1.4.4 v1.4.5 v2.0.0 v2.0.1 v2.0.2 v2.1.0 v2.2.0 v2.2.1 v2.2.2 v2.2.3 v2.3.0 v2.3.1 v2.3.2 v2.3.3 v2.3.4 v2.3.5 v2.3.6 v2.3.7 v2.4.5 v2.4.6 v2.4.7

Check upgrades conditions

For production environments, it is highly recommended to make backups of the DB in case any issues occur during upgrades.

"},{"location":"operations/upgrades/#backing-up-db","title":"Backing-up DB","text":"

Only if you run in production and/or data is critical.

  1. List the current running docker containers docker container list
  2. Spot the IRIS DB container name or ID, and execute the backup
  docker exec <container> pg_dump -U postgres iris_db | \\ \ngzip > ../iris_db_backup.gz\n
  1. Ensure the backup was successful by looking at the gz file 
  zcat ../iris_db_backup.gz | less
"},{"location":"operations/upgrades/#upgrading","title":"Upgrading","text":"

  1. Stop the dockers 

    docker-compose stop\n

  2. Remove the application dockers 

    docker-compose rm app worker\n

  3. Get the last version of Iris 

    git checkout <last_tagged_version>\n

    eg git checkout v2.4.7

  4. Build the new versions 

    docker-compose build --no-cache app worker\n

  5. Run IRIS again. The app will handle the DB migration automatically. 

    docker-compose up\n

"},{"location":"operations/upgrades/#rolling-back","title":"Rolling back","text":"

In case something went wrong, you can rollback to your previous version and restore data.

  1. Remove the faulty docker DB docker-compose down db --volumes
  2. Checkout to the previous version working of IRIS
  3. Rebuild the images docker-compose build --no-cache
  4. Spin up the docker DB, and ONLY this one. docker-compose up db
  5. Get the ID or name of the docker DB docker container list
  6. Restore the DB data zcat ../iris_db_backup.gz | docker exec -i <container> psql -U postgres -d iris_db
  7. Spin up the rest of the dockers docker-compose up
  8. Your data should back.
"},{"location":"operations/upgrades/#version-specific-upgrades","title":"Version specific upgrades","text":""},{"location":"operations/upgrades/#v24x","title":"v2.4.x","text":"

Warning

v2.4.0 to v2.4.6 contains bugs. Please upgrade to v2.4.7 directly.

The update from previous versions to this one is done automatically. However it introduces a number of changes in the API and access control. It may thus break integrations.

Danger

Access control has been updated. Starting from this version, all users have by-default access deny to all the cases, expect explicitely specified otherwise by group membership or automatic access rights. Users can also now be linked to customers, which automatically give them access to the related alerts and cases.

  • The migration to the new access control system is done automatically.
  • New users will not have access to any cases until they are explicitely granted access.
  • Existing users will keep their previous access rights.
  • Existing users will not be linked to any customer. They will need to be linked to a customer to have access to the new cases.
  • Existing users not linked to customers will not see any alerts. They need to be added to the corresponding customer to see the alerts.

Please refer to the API documentation to update any integration which may use the following features:

  • Notes
  • Timeline
  • Acccess control

The layout of the reporting has been updated as well. Refer to the https://<server>/case/export?cid=<case_id> endpoint to get all the possible fields.

"},{"location":"operations/upgrades/#v234","title":"v2.3.4","text":"

\u2757 The layout of the reporting has slightly changed. Custom report templates might not work anymore. You can use https://<server>/case/export?cid=<case_id> to get all the possible fields.

No other impact is to be expected.

"},{"location":"operations/upgrades/#v210","title":"v2.1.0","text":"

The default location of the SSL certificates have been changed from dockers/nginx/dev_certs to certificates/nginx/web_certificates. The docker-compose.yml has thus been updated to mount this volume on the nginx Docker.

Except these changes, users in v2.0.x can upgrade to v2.1.0 without any manual intervention. Users in v1.4.x need to follow the v2.0.0 upgrade instructions before upgrading to v2.1.0.

"},{"location":"operations/upgrades/#v200","title":"v2.0.0","text":""},{"location":"operations/upgrades/#breaking-changes","title":"Breaking changes","text":"

This version brings breaking changes on the following:

  • API
  • Modules
  • Python Client
  • Environment variables in the .env configuration
  • Default listening ports of IRIS WebApp

Warning

Custom made modules need to be upgraded to IRIS Module Interface v1.2.0. Please see modules upgrade for v2.0.0

"},{"location":"operations/upgrades/#instance-migration","title":"Instance migration","text":"

To migrate an instance from v1.4.5, one can use the script in upgrades/upgrade_to_2.0.0.py located in the repository. These commands needs to be run from the root of the repository (pwd should return something like /iris-web): 

# Pull the lastest version \ngit pull # Checkout to iris v2.0.0\ngit checkout v2.0.0 # Check if upgrades possible\npython3 upgrades/upgrade_to_2.0.0.py --check\n\n# Run the upgrade\npython3 upgrades/upgrade_to_2.0.0.py --install\n

The script will take care of migrating the environment variables to reflect the changes in v2.0.0. Please review the .env file afterward.

The port have been changed 443. The script asks if the previous port should be kept or migrated to the new one.

Once validated, one can proceed with the usual upgrade methodology. 

docker-compose stop \ndocker-compose build --no-cache \ndocker-compose up -d\n
"},{"location":"operations/upgrades/#v200-modules-upgrades","title":"v2.0.0 modules upgrades","text":"

This only concerns custom modules not shipped with IRIS Web App. The IRIS module interface has been upgraded to v1.2.0. No breaking changes are associated. One need to change the iris_module_interface dependency to 1.2.0 in the requirements and rebuild the module.

"},{"location":"operations/upgrades/#python-client","title":"Python client","text":"

The client has been updated to reflect the latest changes of the API. It also integrates features that were missing previously, such as Datastore Management. Some methods have been deprecated and some other modified. The easiest way to upgrade is to increase the version in the requirements and test. Each deprecated method will produce a warning or raise an exception.

"},{"location":"operations/upgrades/#v145","title":"v1.4.5","text":"

If you are coming from IRIS <= v1.3.1 please read this. Changes have been made to the NGINX docker to allow upload of big files for the datastore. It is hence necessary to also rebuild the NGINX docker this time.

  1. Stop the dockers docker-compose stop
  2. Remove the application dockers docker-compose rm app worker
  3. Get the last version of Iris git checkout <last_tagged_version> - eg git checkout v1.4.5
  4. Build the new versions docker-compose build --no-cache app worker nginx
  5. Run IRIS again. docker-compose up
"},{"location":"operations/upgrades/#v144","title":"v1.4.4","text":"

This only applies if you are coming from IRIS <= v1.3.1.

This version brings breaking changes in the DB docker by adding a named volume instead of the default one. This implies that previous existing database is ignored as the new docker won't know which volume was previously used. To prevent this, please strictly follow the guide below. This will copy the data of the existing volume, to the new named one.

  1. Spot the IRIS DB container with docker container list. It should look like iris-web-db-x
  2. Fetch the current db volume ID (name field with the command below)

docker inspect <iris_db> | grep -A5 \"Mounts\"\n# Example of output\n\"Mounts\": [\n{\n\"Type\": \"volume\",\n      \"Name\": \"a90b9998a3233a68438c8e099bd0ba98d9f62c9734e40297b8067f9fdb921eb9\",\n      \"Source\": \"/var/lib/docker/volumes/a90b9998a3233a68438c8e099bd0ba98d9f62c9734e40297b8067f9fdb921eb9/_data\",\n      \"Destination\": \"/var/lib/postgresql/data\",\n
3. Stop all the IRIS dockers : docker-compose stop 4. Create a new empty volume : docker volume create --name iris-web_db_data 5. Run a volume copy via a dummy image : 
docker run --rm -it -v <previous_db_volume_id>:/from:ro -v iris-web_db_data:/to alpine ash -c \"cd /from ; cp -av . /to\"\n# With the example of 2., this gives \ndocker run --rm -it -v a90b9998a3233a68438c8e099bd0ba98d9f62c9734e40297b8067f9fdb921eb9:/from:ro -v iris-web_db_data:/to alpine ash -c \"cd /from ; cp -av . /to\"\n
6. Pull the last changes from the repository, checkout to v1.4.4, build and run. 

git pull origin git checkout v1.4.4\ndocker-compose build docker-compose up
7. The data should be successfully transferred.

Do not forget to clear out your browser cache, many JS files were changed.

"},{"location":"operations/upgrades/#v143","title":"v1.4.3","text":"

A patch exists for this version. Please directly upgrade to v1.4.4

"},{"location":"operations/upgrades/#v142","title":"v1.4.2","text":"

A patch exists for this version. Please directly upgrade to v1.4.4

"},{"location":"operations/upgrades/#v141","title":"v1.4.1","text":"

A patch exists for this version. Please directly upgrade to v1.4.4

"},{"location":"operations/upgrades/#v140","title":"v1.4.0","text":"

A patch exists for this version. Please directly upgrade to v1.4.4

"},{"location":"operations/access_control/","title":"Access control","text":"

Changes in v2.4.0

Starting from IRIS v2.4.0 the default access control is deny_all for all users. When upgrading, existing users keep their rights on the existing cases.

IRIS offers a granular access control for cases and management features. Two types of access control are available :

  • Permissions (RBAC): Allows control the access to specific management features on the platform (adding users, cases etc.)
  • Cases access (ACL): Allows segregate cases between users

To ease the access control, users can be managed in :

  • Customers: Provides cases and alerts access controls
  • Groups: Provides permissions and cases access controls
  • Users: Provides granular per-user cases access control

A user can be in one or multiple groups and customers. The effective case access control of a user is deduced from its group and customer membership and its own cases access control. The effective permissions are deduced from its groups membership.

"},{"location":"operations/access_control/#cases-access-control-overview","title":"Cases access control overview","text":"

Cases access control offer three levels:

  • deny_all: No access to the case. The user don't even see the case listed,
  • read_only: Read-only access to the case. The user can see everything related to the case but cannot edit,
  • full_access: Read-write access to the case. The user can see and edit everything related to the case, including closing and deleting the case.

Cases access control can be applied through customers, groups and users. It starts with the customers, groups and ends with atomic user access control.

For example, the following configuration gives no access to the user since the atomic user access prevail upon the rest. 

stateDiagram-v2\n    DefaultPermission --> Group_prevail: DenyAll\n\n    state join_groups <<join>>\n    Group1 --> join_groups: ReadOnly\n    Group2 --> join_groups: DenyAll\n    join_groups --> Group_prevail: ReadOnly\n    Group_prevail --> Effective_DenyAll: ReadOnly \n\n    Effective_DenyAll: Resulting Deny All access for user\n    User_Access --> Effective_DenyAll: DenyAll

In the next configuration, the user has Read Only access to the case because the atomic user access is not set, so the access is inherited from the group ownership. 

stateDiagram-v2\n    DefaultPermission --> Group_prevail: DenyAll\n\n    state join_groups <<join>>\n    Group1 --> join_groups: ReadOnly\n    Group2 --> join_groups: DenyAll\n    Group3 --> join_groups: DenyAll\n    join_groups --> Group_prevail: ReadOnly\n\n    Effective_ReadOnly: Resulting Read Only access for user\n    Group_prevail --> Effective_ReadOnly: ReadOnly \n\n    User_Access --> Effective_ReadOnly: Not set

This notably allows to create groups which can join a set of people from different organisations to work on the same case.

In the next configuration, the user pertains to a customer, which give automatically Full Access access to all the cases of the customer. 

stateDiagram-v2\n    DefaultPermission --> Customer_prevail: DenyAll\n\n    Customer1 --> Customer_prevail: FullAccess\n    Group1 --> Effective_FullAccess: Not set\n\n    Effective_FullAccess: Resulting Full Access access for user\n    Customer_prevail --> Effective_FullAccess: FullAccess \n\n    User_Access --> Effective_FullAccess: Not set

In case the user pertains to a customer but is also in a group, the group access prevail upon the customer access. 

stateDiagram-v2\n    DefaultPermission --> Customer_prevail: DenyAll\n\n    Customer1 --> Customer_prevail: FullAccess\n    Group1 --> Group_prevail: ReadOnly\n\n    Customer_prevail --> Group_prevail: FullAccess\n\n    Group_prevail --> Effective_FullAccess: ReadOnly\n\n    Effective_FullAccess: Resulting Read only Access access for user\n\n    User_Access --> Effective_FullAccess: Not set

Finally, the atomic user access prevail upon the rest. 

stateDiagram-v2\n    DefaultPermission --> Customer_prevail: DenyAll\n\n    Customer1 --> Customer_prevail: FullAccess\n    Group1 --> Group_prevail: ReadOnly\n\n    Customer_prevail --> Group_prevail: FullAccess\n\n    User_access --> User_prevail: DenyAll\n    Group_prevail --> User_prevail: ReadOnly\n    User_prevail --> Effective_FullAccess: DenyAll\n\n    Effective_FullAccess: Resulting Deny all Access access for user

"},{"location":"operations/access_control/#permissions-control","title":"Permissions control","text":"

Permissions allow to control the access to specific management features on the platform (adding users, cases etc.). A set of permissions are available:

  • standard_user: which includes the basic access to the interface and create cases
  • server_administrator: which includes managing users, groups
  • alerts_read: which includes access to the alerts
  • alerts_write: which includes access to the alerts and the ability to add new ones
  • alerts_delete: which includes the ability to delete the alerts
  • search across cases: which includes the ability to search across cases
  • customers_read: which includes the ability to read customers
  • customers_write: which includes the ability to add and edit customers
  • case_templates_read: which includes the ability to read case templates
  • case_templates_write: which includes the ability to add and edit case templates
  • activities_read: which includes the ability to read activities
  • all_activities_read: which includes the ability to read all activities of all cases
"},{"location":"operations/access_control/authentication/","title":"Authentication","text":"

IRIS supports local and LDAP authentication. In both cases, users need to be declared in IRIS.

"},{"location":"operations/access_control/authentication/#local-authentication","title":"Local authentication","text":"

Local authentication is the default setting. The password is validated against the local IRIS database. Passwords are stored salted and hashed, it is thus not possible to retrieve them in case they are lost. It is however possible to change them.

"},{"location":"operations/access_control/authentication/#changing-a-lost-password","title":"Changing a lost password","text":"

If another administrative user exists : Being logged as this user, head to the Advanced > Access Control > Users section, and change the administrator password.

If no other administrative user exists : the change cannot be done via IRIS and an access to the backend is needed.

Danger

Do not delete and recreate any users directly from the DB! This will create inconsistencies in the relations and certainly corrupt everything.

  1. Generate the hash of the new password with Python BCrypt in Python prompt

    import bcrypt\nprint(bcrypt.hashpw('<new_password>'.encode('utf-8'), bcrypt.gensalt()))\n

  2. Connect to the DB docker then the Postgresql database iris_db and update the password 

    docker exec -ti <db_docker_id> /bin/bash\n/ # su postgres\n/ # psql\npostgres=# \\c iris_db \npostgres=# UPDATE \"user\" SET password = '<hash>' WHERE \"user\".name = 'administrator';\npostgres=# \\q\nexit\nexit\n
"},{"location":"operations/access_control/authentication/#ldap-authentication","title":"LDAP authentication","text":"

LDAP authentication rely on a LDAP server to verify the password of a user. The user needs to be declared in IRIS. 

graph LR\n    A[User] -->|Authenticate| B(IRIS WebApp)\n    B --> C{User exists in DB?}\n    C -->|Yes| D{LDAP accepted password?}\n    C -->|No| E[Authentication failed]\n    D -->|Yes| F[Authentication succeeded]\n    D -->|No| E[Authentication failed]
"},{"location":"operations/access_control/authentication/#settings","title":"Settings","text":"

The LDAP settings are present in the .env. Once the LDAP server information is set, reboot the Iris WebApp docker needs to be restarted. 

docker-compose restart app\n
"},{"location":"operations/access_control/authentication/#setting-up-ldap-for-the-first-runtime-of-iris","title":"Setting up LDAP for the first runtime of IRIS","text":"

To set up LDAP without having run IRIS priorly, and as the app needs the accounts to be created first before using LDAP, one has to set the IRIS_ADM_EMAIL environment with the LDAP Email of the administrator user.

Example of LDAP configuration for first run
IRIS_AUTHENTICATION_TYPE=ldap\n\n## IP address or FQDN of the ldap server\nLDAP_SERVER=dc1.domain.local\n\n## Port of the LDAP server\nLDAP_PORT=636\n## LDAP Authentication type\nLDAP_AUTHENTICATION_TYPE=SIMPLE\n\n## Prefix to search the users within \nLDAP_USER_PREFIX=uid=\n## Suffix to search the users within\nLDAP_USER_SUFFIX=ou=people,dc=example,dc=com\n\n## Set to True to use LDAPS\nLDAP_USE_SSL=True\n\n## Set to True to verify the server certificate validity\nLDAP_VALIDATE_CERTIFICATE=True\n\n## TLS version to use LDAPS\nLDAP_TLS_VERSION=1.2\n\n## LDAP TLS configuration \nLDAP_CUSTOM_TLS_CONFIG=False\n\n# Set email address of the first user, that will be the admin \nIRIS_ADM_EMAIL=adm@example.com
"},{"location":"operations/access_control/authentication/#setting-up-for-active-directory","title":"Setting up for Active Directory","text":"

To use LDAP with an Active Directory, the following settings can be used:

Example of LDAP configuration for first run with Active Directory
IRIS_AUTHENTICATION_TYPE=ldap\n\n## IP address or FQDN of the ldap server\nLDAP_SERVER=dc1.domain.local\n\n## Port of the LDAP server\nLDAP_PORT=636\n## LDAP Authentication type\nLDAP_AUTHENTICATION_TYPE=SIMPLE\n\n## Prefix to search the users within\nLDAP_USER_PREFIX=DOMAIN\\\n## Suffix to search the users within\nLDAP_USER_SUFFIX=\n## Set to True to verify the server certificate validity\nLDAP_VALIDATE_CERTIFICATE=True\n\n## TLS version to use LDAPS\nLDAP_TLS_VERSION=1.2\n\n## LDAP TLS configuration \nLDAP_CUSTOM_TLS_CONFIG=False\n\n# Set email address of the first user, that will be the admin\nIRIS_ADM_EMAIL=adm@example.com
"},{"location":"operations/access_control/authentication/#setting-up-ldap-after-iris-already-ran","title":"Setting up LDAP after IRIS already ran","text":"

To set up LDAP after IRIS was already run, one only needs to set up the settings described previously without # Set email address of admin IRIS_ADM_EMAIL=adm@example.com and restart the docker.

Usernames in IRIS have to match the ones set in LDAP for the authentication to succeed.

"},{"location":"operations/access_control/authentication/#ldap-certificates","title":"LDAP certificates","text":"

If the LDAP server uses a self-signed certificate, it is possible to add it to the trusted certificates of the IRIS WebApp docker.

  1. Copy the certificate to the certificates/ldap folder of the IRIS root directory.
  2. Set the LDAP_VALIDATE_CERTIFICATE environment variable to True in the .env file.
  3. Set the LDAP_CUSTOM_TLS_CONFIG environment variable to False in the .env file.
  4. Set the LDAP_CA_CERTIFICATE environment variable certificate path used by the LDAP server in the .env file.

If the LDAP server requires a client certificate, it is possible to add it to the trusted certificates of the IRIS WebApp docker.

  1. Copy the certificate and key to the certificates/ldap folder of the IRIS root directory.
  2. Set the LDAP_VALIDATE_CERTIFICATE environment variable to True in the .env file.
  3. Set the LDAP_CUSTOM_TLS_CONFIG environment variable to True in the .env file.
  4. Set the LDAP_PRIVATE_KEY environment to the file name of the key in the .env file
  5. Set the LDAP_PRIVATE_KEY_PASSWORD environment variable to the password of the key in the .env file - if needed
"},{"location":"operations/access_control/groups/","title":"Groups","text":"

Groups offer the possibility to set case access as well as permissions. By default two groups are created:

  • Administrator: users in this group hold the server_administrator permission,
  • Analysts: users in this group hold the standard_user permission

Both groups are set to give full cases access to the users.

"},{"location":"operations/access_control/groups/#setting-up-a-new-group","title":"Setting up a new group","text":"

Head to the Access Control page and click Add group.

Fill the form. All the fields can be changed later on. The field Group name has to be unique on the IRIS instance. Access control and members can be set once the group is created.

"},{"location":"operations/access_control/groups/#configuring-the-group","title":"Configuring the group","text":"

The group can be configured once created by clicking on it in the list.

"},{"location":"operations/access_control/groups/#users","title":"Users","text":""},{"location":"operations/access_control/groups/#adding-users-to-a-group","title":"Adding users to a group","text":"

To add users to the group, go to the Members tab and click Manage.

The User Manager should load and offers a list of users that can be added to the group. Select all the users you want to add to the group and press Save.

Permissions computation

When a user is added/removed to a group, its effective cases access are recomputed. Depending on the number of cases and users added/removed this can take some time. This process helps reducing the DB load when using IRIS during normal operation.

"},{"location":"operations/access_control/groups/#removing-users-from-a-group","title":"Removing users from a group","text":"

To remove users from the group, go to the Members tab and click Manage.

The User Manager should load and present a list of both users already in the group as well as the ones that can be added. To remove one or more users, un-tick them from the list and press Save.

Alternatively, a user can be directly removed from within the group manager. Click on the red trash next to the user to remove and confirm the deletion.

"},{"location":"operations/access_control/groups/#cases","title":"Cases","text":""},{"location":"operations/access_control/groups/#adding-cases-to-the-group","title":"Adding cases to the group","text":"

Access to one or multiple existing cases can be granted to a group. From within the Group Manager, go to the Cases Access tab and click Set case access.

The Cases Access Manager loads and gives the possibility to set the access to one or more cases.

Three choices of access are offered:

  • deny_all: No access at all to the case. The users won't even see the case listed,
  • read_only: Read-only access to the case. The users can see everything related to the case(s) but cannot change anything,
  • full_access: Read-Write access to the case. The users can see and change everything related to the case.

Once the desired access is selected, press Set access.

Permissions computation

As for the addition of users, when a case is added/removed to a group, all the users' effective cases access are recomputed. Depending on the amount of cases added/removed and number of users this can take some time. This process helps reducing the DB load when using IRIS during normal operation.

"},{"location":"operations/access_control/groups/#removing-cases-from-the-group","title":"Removing cases from the group","text":"

From within the Group Manager, go to the Cases Access tab. Click on the red trash next to the case to remove and confirm the deletion.

"},{"location":"operations/access_control/groups/#removing-a-group","title":"Removing a group","text":"

A group can be deleted by clicking on its name in the list and then Delete at the bottom of the Info tab.

"},{"location":"operations/access_control/users/","title":"Users","text":"

Authentication

Looking for authentication settings? It's here

Whatever the authentication mechanism used (Local or LDAP), the users have to be declared in IRIS. This is done in Advanced > Access Control > Users.

"},{"location":"operations/access_control/users/#adding-a-user","title":"Adding a user","text":"

Head to Advanced > Access Control > Users and click Add user. All fields of the form are required. All information can be changed after the creation.

Note

Permissions and groups can be set once the user is created.

  • Full Name : Name of the user to add
  • Login : Username used to login in IRIS. Has to be unique on the instance
  • Email : Email of the user to add. Has to be unique on the instance
  • Password: Password respecting the policy defined in Advanced > Server settings. The password also has to be set when using LDAP, it is then however not used for the authentication. A random password can be set when using LDAP. No password is required when the user is set as a service account.
  • Is service account : If the user is a server account, check this box. Server accounts are used to connect to the API. They cannot login to the UI.

Service accounts

Service accounts users can use the API to perform any actions on the instance. They cannot login to the UI and they don't have a password.

"},{"location":"operations/access_control/users/#editing-a-user","title":"Editing a user","text":"

A user can be edited by clicking on its name or ID in Advanced > Access Control > Users. A window opens and display the user's information. Tabs at the top allow to configure multiple settings related to the user.

"},{"location":"operations/access_control/users/#setting-permissions","title":"Setting permissions","text":"

Permissions of a user cannot be set directly. They are inherited from the groups membership. The tab Permissions only displays the permissions the user has from its groups memberships. See Groups for more info.

"},{"location":"operations/access_control/users/#setting-groups","title":"Setting groups","text":"

Groups can be set by clicking on the Groups tab of the user's window and then Manage.

A new window appears with the possibility to select the groups the user should belong to.

After saving, the permissions of the user are updated. This can be verified in the Permissions tab.

"},{"location":"operations/access_control/users/#setting-customers","title":"Setting customers","text":"

Customers can be set by clicking on the Customers tab of the user's window and then Manage.

A new window appears with the possibility to select the customers the user should belong to.

"},{"location":"operations/access_control/users/#setting-cases-access","title":"Setting cases access","text":"

Cases access are usually set through groups membership. However for granularity they can be set per user. To set the access of a user on a case, click on the Cases access tab of the user's window and then Set case access.

As for the Groups, a selector appears and allows to select one or multiple cases and the access to associate.

Info

Application of a case access is immediate, even if the user is logged in and browsing the case.

Info

Granular case access can also be set from a case itself, in Summary > Manage > Access.

"},{"location":"operations/access_control/users/#deactivating-a-user","title":"Deactivating a user","text":"

A user can be deactivated, which has the following impact:

  • User cannot login anymore
  • User cannot use its API key anymore
  • User is not proposed in tasks assignees anymore

"},{"location":"operations/access_control/users/#deleting-a-user","title":"Deleting a user","text":"

It is usually not possible to delete a user. This is to keep consistency in the database. A user can be deleted if it has done absolutely no actions on the platform. If a user leaves the organisation, it is recommended to rename the user and deactivate it.

"},{"location":"operations/cases/case_operations/","title":"Case operations","text":""},{"location":"operations/cases/case_operations/#opening-a-case","title":"Opening a case","text":"

To open a case anywhere, press the + button in the top right corner. A popup appears and allows to fill the basic information of the new case.

A new window appears, requesting additional information. The following information are required:

  • Customer: Name of the customer the case is related to
  • Case name: Name of the case
  • Short description: Short description of the case - this will be set as the summary of the case

The following information is optional:

  • Case template: Template to use for the case. If not set, the case will be created empty
  • Case classification: The classfication of the case
  • SOC ticket ID: The ID of the ticket in the SOC ticketing system

Once Create is clicked, the case is created and a popup ask whether to the get redirected to the case or to add a new one.

"},{"location":"operations/cases/case_operations/#switching-between-cases","title":"Switching between cases","text":"

Each case has its own context. To switch between cases/context, either click on the name of the current case at the top left, or click on the switch button on the top right.

A popup appears and allows to select the case to switch to. By default the last 100 cases are displayed. To look further in the past, one can use the search bar. Press Save to validate the switch. The page reloads with the new context.

"},{"location":"operations/cases/case_operations/#updating-a-case","title":"Updating a case","text":"

A case metadata can be updated by going switching the case context and heading to Case > Summary. Clicking on Manage brings up a new window with the case metadata. The right pencil button allows to edit the metadata.

The following information can be updated:

  • Case name: Name of the case
  • SOC ticket ID: The ID of the ticket in the SOC ticketing system
  • Case classification: The classfication of the case
  • Case owner: The owner of the case - by default set to the user who created the case
  • Case state: State of the case - by default set to Open. This defines the state of the case (open, closed, etc.).
  • Case outcome: Outcome of the case - by default set to Unknown. This defines if the case is a true positive, false positive, etc.
  • Case customer: Customer of the case
  • Case reviewer: Reviewer of the case
  • Case severity: Severity of the case - by default set to Medium
  • Case tags: Tags of the case - by default set to Open
  • Protagonists: Protagonists of the case - by default none. Those are the actors involved in the case.
"},{"location":"operations/cases/case_operations/#updating-the-access-of-a-case","title":"Updating the access of a case","text":"

The access of a case can be updated by going to Case > Summary > Manage, and from the popup, clicking on the Access tab.

Changes of access are immediately applied.

"},{"location":"operations/cases/case_operations/#closing-a-case","title":"Closing a case","text":"

A case can be closed by going to Case > Summary > Manage, and from the popup, clicking on the Close case button. Closing a case doesn't delete it and it can be reopened at any time. The case can also be modified after it has been closed.

"},{"location":"operations/cases/case_operations/#getting-modifications-history-of-a-case","title":"Getting modifications history of a case","text":"

The modifications history of a case can be retrieved by going to Case > Summary > Manage, and from the popup, clicking on the history icon next to the case name.

"},{"location":"operations/cases/iocs/","title":"IOCs","text":"

IOCs are observables that were identified during the investigation, or that led to the case creation upon monitoring activities.

"},{"location":"operations/cases/iocs/#add-an-ioc","title":"Add an IoC","text":"

An IoC object could be created by going to Case > IOC. Clicking on Add IOC in the top right corner brings up a new window for the IoC creation.

A new window appears, requesting additional information. The following information is required:

  • Type: Type of the IOC. This will have an impact on available modules.
  • IOC Value: The actual IoC.
  • TLP: Traffic Light Protocol value. (Amber by default)

The following information is optional:

  • Description: A .md formatted description of the IoC.
  • Task tags: List of tags.

Once Save is clicked, the ioc is created.

"},{"location":"operations/cases/iocs/#update-an-ioc","title":"Update an IoC","text":"

IoC object data can be updated by clicking on the IoC value in the Case > IOC table. A popup appears and allows to change required and non-required fields.

Once Update is clicked, the IoC is updated.

"},{"location":"operations/cases/iocs/#enrich-an-ioc","title":"Enrich an IoC","text":"

IoC objects can be enriched in order to add valuable information to it.

"},{"location":"operations/cases/iocs/#comment-an-ioc","title":"Comment an IoC","text":"

To comment an IoC, one can right click on it, in the Case > IOC menu, and select Comment. A new pop-up appears and allows to leave comments. This is also achievable by clicking on the IoC value in the Case > IOC table, and by clicking on the Comment button.

"},{"location":"operations/cases/iocs/#launch-a-module-on-an-ioc","title":"Launch a module on an IoC","text":"

To have more information about modules, see the Modules section.

A set of modules can be launched to enrich IoCs. To do so, one can right click on the IoC , in the Case > IOC table, and select the module of choice. This is also achievable by clicking on the IoC value in the Case > IOC table, by clicking the Option button, and selecting the desired module.

The results of the module will appear in newly created tabs, in the IoC details. To view the tabs, click on the the IoC value.

"},{"location":"operations/cases/iocs/#delete-an-ioc","title":"Delete an IoC","text":"

This will permanently delete the IoC and its attributes

To delete an IoC, one could either right click on the IoC, and select Delete, or click on the IoC value, and click on the Delete button.

The IOC is only unlinked from the case if it references other cases

"},{"location":"operations/cases/notes/","title":"Notes","text":"

Attention

The notes layout has been updated in IRIS 2.4.0. The following documentation is valid for IRIS 2.4.0 and above.

IRIS allows analysts to add notes to cases. Notes can be added to a case from the Notes tab. Notes are organized by directories. A note has to live within a directory.

"},{"location":"operations/cases/notes/#adding-a-directory","title":"Adding a directory","text":"

To add a directory, click on the + directory icon on the left side of the Notes tab. A new directory is added to the list and asks for a name.

The title of the directory can be edited by right clicking on it and selecting Rename.

"},{"location":"operations/cases/notes/#adding-a-note","title":"Adding a note","text":"

To add a note, right click on the directory and select Add note. A new note is added to the list.

To rename the note, double click on the title and press enter to confirm.

"},{"location":"operations/cases/notes/#operations","title":"Operations","text":"

Notes and directories can be moved. Right click on the note or directory and select Move. A popup appears and allows to select the destination directory.

"},{"location":"operations/cases/tasks/","title":"Tasks","text":"

Tasks allow incident handlers to split the workload into unit tasks, and to assign them to the team members.

"},{"location":"operations/cases/tasks/#add-a-task","title":"Add a task","text":"

A task can be created by going to Case > Tasks. Clicking on Add Task in the top right corner brings up a new window for the task creation.

A new window appears, requesting additional information. The following information is required:

  • Status: Status of the task.
  • Task Title: Title of the tasks

The following information is optional:

  • Assigned to: The one who should perform the task.
  • Description: A .md formatted description of the task.
  • Task tags: List of tags.

Once Save is clicked, the task is created.

"},{"location":"operations/cases/tasks/#update-a-task","title":"Update a task","text":"

Task metadata can be updated by clicking on the task title in the Case > Tasks table. A popup appears and allows to change required and non-required fields.

Once Update is clicked, the task is updated.

"},{"location":"operations/cases/tasks/#comment-a-task","title":"Comment a task","text":"

Tasks can be commented. This provide the ability for analysts to give more in-deepth information on the task execution (what did they do, how did they do, what are the results, etc.)

To comment a task, one can either right click on the task line and select Comment, or click on the task title, and click on the Comment button. A new windows appears and allows to add comments to the task.

Once Comment is clicked, in the last window, a comment is added to the task. Comments are editable and removable.

"},{"location":"operations/modules/","title":"Introduction","text":"

New types of modules are introduced in IRIS v1.4.0

IRIS can be extended with modules. They can be split in two types:

  • Pipeline modules : Allow upload and process of evidences through modular pipelines (eg: EVTX parsing and injection into a database or data visualiser)
  • Processor modules : Allow processing of IRIS data upon predefined actions / hooks. (eg: be notified when a new IOC is created and get VT/MISP insights for it).

Modules (or DIM - DFIR-IRIS Modules) are actually Python packages which must be installed in the Python environment of iris-webapp and the worker (see Quick Start). Once installed in the Python environment, modules can be managed in Advanced > Modules.

Info

This section is only available for users with the Admin role.

By default IRIS is shipped with multiple modules.

  • IrisVTModule : Processor module offering VirusTotal insights (installed and registered)
  • IrisMispModule : Processor module offering MISP insights (installed and registered)
  • IrisWebHooksModule : Processor module offering webhooks support (manual installation)
  • IrisCheckModule : A basic processor module logging every hooks. Used to check the good functionning. (installed and registered)
  • IrisEVTXModule : A pipeline module offers EVTX import into Splunk through IRIS (installed but not registered)
"},{"location":"operations/modules/mod_management/","title":"Management","text":"

To add a module, the user can click on the \"+\" button:

Then the user must enter the name of the pre-installed module. The name of the pip package must be used.

If everything is ok, the module will appear on the list. It is currently disabled, and needs configuration before it can be enabled. To do so, the user can click on the module's name:

A new text box appears, showing information about the module, and a list of parameters to configure. Each mandatory parameter must be configured to enable the module.

After configuring all the mandatory parameters, the \"Enable button\" is revealed and the user can finally enable the module.

That's all! The user can confirm in the summary that the module is indeed enabled and ready to use.

Finally, the user can either disable or remove the module by clicking on the according buttons.

Now that the module is configured and enabled, let's see how we can use it!

NB: As a temporary fix, after adding and configuring a module, one must restart the IRIS services (dockers) else the worker won't have the module installed properly.

"},{"location":"operations/modules/mod_management/#how-to-use-the-module","title":"How to use the module","text":"

As stated in the beginning, a module extends the capabilities of IRIS. For now, it allows importing evidences of your needs into what we call a pipeline, where data will be handled in the module (checking, parsing, ingestion...). In our provided module, IrisEVTXModule ingest EVTX files, parse them as JSON, and send the results to a Splunk instance using its HTTP event collector (HEC) endpoint.

In IRIS, the files are always imported in the context of a case. To import a file, the user can click on Manage cases then Update tab.

In Processing pipeline, the user can pick a pipeline that will send the files to the wanted module. In our example, EVTX pipeline refers to the IrisEVTXModule module. Below, the user can fill the arguments needed by the according pipeline. Arguments can be optional. Finally, the user can import one or several files and click Update to start their processing by the module.

You can see in the picture below that the user will import four EVTX files.

The user can follow the upload of the different files with their respective progress bars.

Once uploaded, the status of the task can be observed on the DIM Tasks page.

Clicking on a Task ID shows information on the task processing.

After the processing of the files by the module, the list of the imported files is stored in the Evidences tab of the according case.

"},{"location":"operations/modules/natives/IrisMISP/","title":"Module IRIS MISP","text":"

Introduced in IRIS v1.4.0

This module offers an interface with MISP and IRIS to automatically enrich IOCs with MISP insight.

The source code is available here. It is installed by default but needs to be configured to be enabled.

Note

The module is in its early stage and new features will be added over time.

"},{"location":"operations/modules/natives/IrisMISP/#features","title":"Features","text":"

Two types of enrichement mecanism are proposed :

  • Manual : right-click on one or more IOCs and select Get MISP insight. This sends the targets IOCs to the module and insights will be fetched and applied.
  • Automatic:
    • On create : This automatically fetch MISP insight for newly created IOC
    • On update : This automatically fetch MISP insight upon updates of an IOC

The following types of IOCs are handled by the module :

  • ip-*
  • domain
  • hashes of types md5, sha224, sha256, sha512

The insight request on an IOC not handled is simply ignored.

The insights take the form of attributes added to the IOC. They are based on configurable templates.

"},{"location":"operations/modules/natives/IrisMISP/#configuration","title":"Configuration","text":"

The behavior of the module can be configured as needed. Head to the Advanced > Modules > IrisMISP to change it.

  • MISP configuration : A JSON describing the MISP access. See below for the structure.
  • Add MISP report as new IOC attribute : If set to true, the module adds a new attribute with the MISP insight.
  • Domain report template : Provides a right-click menu option on IOCs to trigger the MISP module on selected elements.
  • Triggers automatically on IOC create: If set to true, the module runs each time an IOC is created. Disabled by default.
  • Triggers automatically on IOC update: If set to true, the module runs each time an IOC is updated. Disabled by default.
  • Domain report template: Jinja2 report template for domain IOCs. Refers to the raw report to assess which fields are available.
  • IP report template: Jinja2 report template for IP IOCs. Refers to the raw report to assess which fields are available.
  • Hash report template: Jinja2 report template for hash IOCs. Refers to the raw report to assess which fields are available.
"},{"location":"operations/modules/natives/IrisMISP/#misp-configuration","title":"MISP configuration","text":"

At the time, only one MISP can be added. Future version might handled more than one MISP. The expected structure is the following : 

{\n\"name\": \"Public_MISP\", \"type\":\"public\", \"url\":[\"https://testmisp\"],\n\"key\":[\"<apikey>\"], \"ssl\":[false]\n}\n
"},{"location":"operations/modules/natives/IrisVT/","title":"Module IRIS VT","text":"

Introduced in IRIS v1.4.0

This module offers an interface with VirusTotal and IRIS to automatically enrich IOCs with VT insight. The source code is available here. It is installed by default but needs to be configured to be enabled.

"},{"location":"operations/modules/natives/IrisVT/#features","title":"Features","text":"

Two types of enrichment mechanism are proposed :

  • Manual : right-click on one or more IOCs and select Get VT insight. This sends the targets IOCs to the module and insights will be fetched and applied.
  • Automatic:
    • On create : This automatically fetch VT insight for newly created IOC
    • On update : This automatically fetch VT insight upon updates of an IOC

The following types of IOCs are handled by the module :

  • ip-*
  • domain
  • hashes of types md5, sha224, sha256, sha512

The insight request on an IOC not handled is simply ignored.

Two types of insights are proposed :

  • tags : This adds a vt:malicious or vt:suspicious tag if the detection thresholds are met (configurable). For domains, an ASN tag can also be added.
  • new attribute : This adds a new attribute to the IOC with the VT insight. It is based on a configurable template.
"},{"location":"operations/modules/natives/IrisVT/#configuration","title":"Configuration","text":"

The behavior of the module can be configured as needed. Head to the Advanced > Modules > IrisVT to change it.

  • VT API Key : API key used by the module to connect to VT
  • VT Key is premium : Set to True to indicate the provided API Key is premium.
  • Manual triggers on IOCs : Provides a right-click menu option on IOCs to trigger the VT module on selected elements.
  • Triggers automatically on IOC create: If set to true, the module runs each time an IOC is created. Disabled by default.
  • Triggers automatically on IOC update: If set to true, the module runs each time an IOC is updated. Disabled by default.
  • Assign ASN tag to IP : If set to true, creates a new tag with ASN info on the target IP IOC.
  • IOC tag malicious threshold : Float detection ratio above which the module adds a vt:malicious. To disable, add a value > 100.
  • IOC tag suspicious threshold: Float detection ratio above which the module adds a vt:suspicious. To disable, add a value > 100.
  • Add VT report as new IOC attribute: Creates a new attribute on the IOC, base on the VT report. Templates define on this configuration are used.
  • Domain report template: Jinja2 report template for domain IOCs. Refers to the raw report to assess which fields are available.
  • IP report template: Jinja2 report template for IP IOCs. Refers to the raw report to assess which fields are available.
  • Hash report template: Jinja2 report template for hash IOCs. Refers to the raw report to assess which fields are available.
"},{"location":"operations/modules/natives/IrisWebHooks/","title":"Module IRIS Webhooks","text":"

This module offers webhooks support for IRIS. It can be configured to send almost any events to to an external service supporting webhooks, such as Discord, Slack or Microsoft Teams. It can also be used with automation tools such as Tines and Shufle to further automate IRIS. The source code is available here.

"},{"location":"operations/modules/natives/IrisWebHooks/#features","title":"Features","text":"
  • Support multiple webhooks receivers thanks to its configurable payload
  • Support multiple webhooks receivers at the same time
  • Allows to send one, multiple or all events to an external service

Slack Example

"},{"location":"operations/modules/natives/IrisWebHooks/#configuration","title":"Configuration","text":"

The expected configuration is a JSON file, following the structure : 

{   \"instance_url\": \"<IRIS_INSTANCE_URL>\",\n\"webhooks\": [\n{\n\"name\": \"Name of the webhook for internal reference only\",\n\"active\": false,\n\"trigger_on\": [<LIST OF HOOKS TO LISTEN TO>],\n\"request_url\": \"<URL OF THE WEBHOOK>\",\n\"use_rendering\": true,\n\"request_rendering\": \"<RENDERING TYPE OF THE MESSAGE>\", \"request_body\": {<BODY OF THE REQUET TO SEND>}\n},\n{\n\"name\": \"Another hook\",\n\"active\": false,\n\"use_rendering\": false,\n\"trigger_on\": [<LIST OF HOOKS TO LISTEN TO>],\n\"request_url\": \"<URL OF THE WEBHOOK 2>\",\n\"request_rendering\": \"<RENDERING TYPE OF THE MESSAGE>\", \"request_body\": {<BODY OF THE REQUEST TO SEND 2>}\n}\n]\n}\n
  • instance_url: Base URL of IRIS. This is used to set the links in the messages
  • webhooks: A list of JSON describing the webhooks For each webhook:
    • name: Internal name of the webhook, this can be anything
    • active: Optional - Set to false to disable the webhook
    • trigger_on: List of IRIS hooks for which the webhook should be triggered. Only the on_postload_XX hooks are supported. To enable a set of hooks without writing them all, the following keywords can be used :
      • all: Includes all on_postload hooks
      • all_create: Includes all on_postload_XX_create hooks
      • all_update: Includes all on_postload_XX_update hooks
    • request_url: The URL provided by the webhook receiver. For instance for Slack : see how to get one
    • request_rendering: URLs rendering may be specific from one receiver to another. The modules supports the following :
      • markdown: Format the message as markdown. This can be used with Discord for instance
      • markdown_slack: Format the message as markdown, with some specificities of Slack.
      • html: Format the message as HTML.
    • request_body: The request body to be sent to the webhook receiver. If use_rendering is true, then two markups can be used to set the content of the webhook. The request has to be in JSON format and is sent as-is after replacements of the markups.
      • %TITLE%: Is replaced with name of the case and event title, e.g \"[#54 - Ransomware] IOC created\"
      • %DESCRIPTION%: Description of the event, e.g \"UserX created IOC mimi.exe in case #54\" If use_rendering is false, then a raw json representation of the object related to the hook is available. See examples for more details.
    • manual_trigger_name: The name of the manual trigger in the UI. This should be set if the registered hook is of type on_manual_trigger. This name is displayed as a new menu option in the UI for the target object.
    • use_rendering: Whether the data should be formated in Markdown or not. If set to false, then the request body field can use the raw data such as assets. This will result in a request with the body containing the assets JSON representation related to the call of the hook. See examples for more details.
"},{"location":"operations/modules/natives/IrisWebHooks/#checking-iris-hooks-registration","title":"Checking IRIS hooks registration","text":"

Each time a webhook is added, the module subscribes to the specified hooks. After saving the configuration, one can check the registration was successful by filtering the Registered hooks table (don't forget to refresh the table).

"},{"location":"operations/modules/natives/IrisWebHooks/#examples-without-rendering","title":"Examples without rendering","text":"

The following example is a combination of webhooks that can be used to further automate IRIS. It uses Tines as an example, but this is reproductible with any automation tool that can sent HTTP requests. A Tines story is created and is set up to receive a webhook, such as https://anothertest.tines.io/webhook/xxxx/xxxxx. In this scenario, two IRIS webhooks are added:

  • One to add an option to publish an IOC on MISP from the UI. This is an on_manual_trigger_ioc_update hook.
  • Another one to send a message on Mattermost each time a new case is created. This is an on_postload_case_create hook.

We use the same Tines story and thus Tines webhook for both and dispatch the incoming request depending on its parameters.

"},{"location":"operations/modules/natives/IrisWebHooks/#todo","title":"TODO","text":""},{"location":"operations/modules/natives/IrisWebHooks/#examples-using-rendering","title":"Examples using rendering","text":"

The following is an example of combined webhooks configuration. It can be directly imported in the module with the import feature. Please note that after import, the configuration should be opened and change to match your URL webhook receiver.

Download webhooks combined configuration example

"},{"location":"operations/modules/natives/IrisWebHooks/#discord","title":"Discord","text":"Discord webhook example - selection of events
{   \"instance_url\": \"https://iris.local\",\n\"webhooks\": [\n{\n\"name\": \"Discord\",\n\"trigger_on\": [\n\"on_postload_ioc_create\",\n\"on_postload_ioc_update\",\n\"on_postload_note_create\",\n\"on_postload_note_update\"\n],\n\"request_url\": \"https://discord.com/api/webhooks/XXXX/XXXX\",\n\"request_rendering\": \"markdown\", \"request_body\": {\n\"embeds\": [{\n\"description\" : \"%DESCRIPTION%\",\n\"title\" : \"%TITLE%\"\n}]\n}\n}\n]\n}\n
"},{"location":"operations/modules/natives/IrisWebHooks/#slack","title":"Slack","text":"Slack webhook example - all events
{   \"instance_url\": \"https://iris.local\",\n\"webhooks\": [\n{\n\"name\": \"Slack\",\n\"trigger_on\": [\n\"all\"\n],\n\"request_url\": \"https://hooks.slack.com/services/<XXX>/<XXX>/<XXX>\",\n\"request_rendering\": \"markdown_slack\",\n\"request_body\": {\n\"text\": \"%TITLE%\",\n\"blocks\": [\n{\n\"type\": \"section\",\n\"text\": {\n\"type\": \"mrkdwn\",\n\"text\": \"*%TITLE%*\"\n}\n},\n{\n\"type\": \"section\",\n\"block_id\": \"section567\",\n\"text\": {\n\"type\": \"mrkdwn\",\n\"text\": \"%DESCRIPTION%\"\n}\n}\n]\n}\n}\n]\n}\n
"},{"location":"operations/modules/natives/IrisWebHooks/#troubleshooting","title":"Troubleshooting","text":"

Webhooks receivers are expecting specific message formatting to successfully process them. Please carefully read their documentations.

The module only handles JSON POST for the moment. If the target webhook receiver needs another type of request, please contact us so we can add it.

As any IRIS module, IrisWebhooks is logged into DIM Tasks. You can check the status of the requests made in these. Go to DIM Tasks and then filter with webhooks. You can then check details info by clicking in the Task ID. More info might be available in the Docker worker logs depending on the situation.

"},{"location":"operations/modules/natives/IrisWebHooks/#important-notes-and-know-issues","title":"Important Notes and know issues","text":"
  • The module is in beta and will improve over time. More customization should be brought on the messages.
  • For a complete experience, some features are missing on the server side - such as case info and user info passed to modules. They will be added in the next release and this module will be updated. For instance, IOC events do not hold case info, assets update events do not hold the user info who made the change.
"},{"location":"python_client/","title":"Introduction","text":"

dfir_iris_client offers a Python interface to communicate with IRIS.

It relies exclusively on the API, which means output of the methods are the same as specified in the API reference.

"},{"location":"python_client/#installation","title":"Installation","text":"

It can be easily with pip : pip3 install dfir_iris_client.

The source code of the project is available here.

"},{"location":"python_client/#versions","title":"Versions","text":"

The Python client version follows the API versions (until the patch level). Meaning for API v1.0.1, one need to install dfir_iris_client-1.0.1.

"},{"location":"python_client/#examples","title":"Examples","text":"

Examples of usage are available here.

"},{"location":"python_client/#documentation","title":"Documentation","text":"

The documentation of the client is available on client.docs.dfir-iris.org.

"}]} \ No newline at end of file diff --git a/2.4.7/sitemap.xml b/2.4.7/sitemap.xml index 64df66ad..c1e282ce 100644 --- a/2.4.7/sitemap.xml +++ b/2.4.7/sitemap.xml @@ -2,222 +2,222 @@ https://dfir-iris.org/2.4.7/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/changelog/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/contact/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/credits/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/getting_started/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/resources/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/roadmap/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/security-advisories/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/support/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/support_us/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/zqa/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/development/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/development/code-tips/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/development/db-migration/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/development/environment/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/development/hooks/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/development/structure/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/development/modules/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/development/modules/quick_start/processor/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/alerts/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/api/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/case_templates/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/configuration/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/custom_attributes/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/datastore/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/logging/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/reports/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/server_settings/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/tutorials/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/upgrades/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/access_control/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/access_control/authentication/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/access_control/groups/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/access_control/users/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/cases/case_operations/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/cases/iocs/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/cases/notes/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/cases/tasks/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/modules/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/modules/mod_management/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/modules/natives/IrisMISP/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/modules/natives/IrisVT/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/operations/modules/natives/IrisWebHooks/ - 2024-03-25 + 2024-04-02 daily https://dfir-iris.org/2.4.7/python_client/ - 2024-03-25 + 2024-04-02 daily \ No newline at end of file diff --git a/2.4.7/sitemap.xml.gz b/2.4.7/sitemap.xml.gz index 29f6038e..42ea9692 100644 Binary files a/2.4.7/sitemap.xml.gz and b/2.4.7/sitemap.xml.gz differ