Skip to main content

IRIS DFIR

This Integration is part of the IRIS DFIR Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.10.0 and later.

IRIS is a collaborative platform aiming to help incident responders to share technical details during investigations. It's free and open-source. This integration was integrated and tested with version v2.3.6 of IRIS DFIR

Configure IRIS DFIR in Cortex#

ParameterDescriptionRequired
Server IP or Host Name (e.g., https://192.168.0.1)True
API Key for authenticationTrue
Trust any certificate (not secure)False
Use system proxy settingsFalse
Fetch incidentsFalse
Incidents Fetch IntervalFalse
Incident typeFalse
Incident Last Case IDFetch all the cases starting from this value, not including it.False

Commands#

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

iris-get-last-case-id#

IRIS Command to get the last case information

Base Command#

iris-get-last-case-id

Input#

Argument NameDescriptionRequired

Context Output#

PathTypeDescription
IRIS.case_soc_idstringSOC ID ticket case
IRIS.case_idnumbercase ID ticket number
IRIS.case_descriptionstringcase description
IRIS.opened_byunknowncase opened by
IRIS.ownerunknowncase owner
IRIS.classification_idnumbercase classification ID
IRIS.state_namestringcase state name
IRIS.case_open_dateunknowncase open date
IRIS.case_namestringcase name
IRIS.client_namestringcase client name
IRIS.classificationstringcase classification
IRIS.case_uuidstringcase uuid
IRIS.state_idstringcase state ID
IRIS.access_levelstringcase access level

Command example#

!iris-get-last-case-id

Context Example#

{
"IRIS": {
"access_level": 4,
"case_close_date": "",
"case_description": "TEST 7",
"case_id": 32,
"case_name": "#32 - TEST 7",
"case_open_date": "12/18/2023",
"case_soc_id": "",
"case_uuid": "47ae5435-4c25-4408-bf86-98277807b2fa",
"classification": "malicious-code:dialer",
"classification_id": 9,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
}
}

Human Readable Output#

Command successfully sent to IRIS DFIR"#

access_levelcase_descriptioncase_idcase_namecase_open_datecase_uuidclassificationclassification_idclient_nameopened_byopened_by_user_idownerowner_idstate_idstate_name
4TEST 732#32 - TEST 712/18/202347ae5435-4c25-4408-bf86-98277807b2famalicious-code:dialer9CERT-EUnouser21nouser213Opened

iris-get-all-cases#

Return a list of all IRIS DFIR cases

Base Command#

iris-get-all-cases

Input#

Argument NameDescriptionRequired

Context Output#

PathTypeDescription
IRIS.case_soc_idunknownSOC ID ticket case
IRIS.case_idnumbercase ID ticket number
IRIS.case_descriptionunknowncase description
IRIS.opened_byunknowncase opened by
IRIS.ownerunknowncase owner
IRIS.classification_idnumbercase classification ID
IRIS.state_nameunknowncase state name
IRIS.case_open_dateunknowncase open date
IRIS.case_nameunknowncase name
IRIS.client_nameunknowncase client name
IRIS.classificationunknowncase classification
IRIS.case_uuidunknowncase uuid
IRIS.state_idunknowncase state ID
IRIS.access_levelunknowncase access level

Command example#

!iris-get-all-cases

Context Example#

{
"IRIS": [
{
"access_level": 4,
"case_close_date": "",
"case_description": "TEST 7",
"case_id": 32,
"case_name": "#32 - TEST 7",
"case_open_date": "12/18/2023",
"case_soc_id": "",
"case_uuid": "47ae5435-4c25-4408-bf86-98277807b2fa",
"classification": "malicious-code:dialer",
"classification_id": 9,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "TEST 5",
"case_id": 31,
"case_name": "#31 - TEST 5",
"case_open_date": "12/18/2023",
"case_soc_id": "",
"case_uuid": "5d5e6bc6-2c83-4c77-9f87-fb12d82e1e35",
"classification": "malicious-code:ransomware",
"classification_id": 6,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "case null 0000f\n\n### dsdsdsd",
"case_id": 29,
"case_name": "#29 - case null 0000f",
"case_open_date": "12/14/2023",
"case_soc_id": "",
"case_uuid": "e7ed6439-799a-4eaf-b16c-cde8f7a10ffc",
"classification": "malicious-code:dialer",
"classification_id": 9,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "malware byte you\n\ntest22222",
"case_id": 28,
"case_name": "#28 - malware byte you",
"case_open_date": "12/14/2023",
"case_soc_id": "test-eu-111",
"case_uuid": "2aeb9026-7b1d-4caa-a22d-b95e7507eec8",
"classification": "abusive-content:harmful-speech",
"classification_id": 2,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 4,
"state_name": "Containment"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "test jira fields\n\n### 12244434",
"case_id": 27,
"case_name": "#27 - test jira fields",
"case_open_date": "11/30/2023",
"case_soc_id": "",
"case_uuid": "6b8d5e9a-e27b-4a6a-b27d-059b235f0814",
"classification": "malicious-code:spyware-rat",
"classification_id": 8,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "Evil rootkit\n## \nmachine evil\n\n",
"case_id": 26,
"case_name": "#26 - Evil rootkit",
"case_open_date": "11/22/2023",
"case_soc_id": "CERT-EU-846327",
"case_uuid": "dec1a169-37cf-44b0-8e9d-78b51efebbc0",
"classification": "malicious-code:rootkit",
"classification_id": 10,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 5,
"state_name": "Eradication"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "mail spam \n\nspam 1234444",
"case_id": 25,
"case_name": "#25 - mail spam",
"case_open_date": "11/22/2023",
"case_soc_id": "CERT-EU-8213423",
"case_uuid": "83317f2e-72df-4934-a283-500fecd0e758",
"classification": "abusive-content:spam",
"classification_id": 1,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 4,
"state_name": "Containment"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "Evil spyware\n\ndark 123 machine local",
"case_id": 24,
"case_name": "#24 - Evil spyware",
"case_open_date": "11/22/2023",
"case_soc_id": "CERT-EU-896492",
"case_uuid": "c63dc059-b8a7-4595-bc2b-833e4798e3ac",
"classification": "malicious-code:spyware-rat",
"classification_id": 8,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "Scanning VIP\n\n\nfdsfdsfsdfsdfsdfsdf",
"case_id": 23,
"case_name": "#23 - Scanning VIP",
"case_open_date": "11/22/2023",
"case_soc_id": "CERT-EU-2316346",
"case_uuid": "cd85ed04-fa5a-4f47-8a3f-0280297a3d53",
"classification": "information-gathering:scanner",
"classification_id": 11,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "virus id 2244\n\ntesting 123\n\nmachine 10.0.0.1",
"case_id": 20,
"case_name": "#20 - virus id 2244",
"case_open_date": "11/22/2023",
"case_soc_id": "CERT-EU-55",
"case_uuid": "6e71ba63-ad61-4c7e-8b4e-10f16a65cb36",
"classification": "malicious-code:virus",
"classification_id": 4,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "rootkit blabla\n\nmachine.dark.local malware baisfldasnfadsf",
"case_id": 19,
"case_name": "#19 - rootkit blabla",
"case_open_date": "09/29/2023",
"case_soc_id": "CERT--EU-444",
"case_uuid": "a48eed36-cc03-4a42-a13b-3af41a76dccb",
"classification": "malicious-code:rootkit",
"classification_id": 10,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "09/28/2023",
"case_description": "Phishing EU member\n\nblabla",
"case_id": 18,
"case_name": "#18 - Phishing EU member",
"case_open_date": "09/28/2023",
"case_soc_id": "CERT-EU-77",
"case_uuid": "a9803459-461b-4442-a11e-b6440a91cd85",
"classification": "fraud:phishing",
"classification_id": 30,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 9,
"state_name": "Closed"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "Phishing EU official\n\ntest ticket !!!",
"case_id": 17,
"case_name": "#17 - #17 case custom attrib test",
"case_open_date": "08/09/2023",
"case_soc_id": "soc_id_demo",
"case_uuid": "c034f0fa-d19c-480a-8b1d-045b558915d0",
"classification": "abusive-content:harmful-speech",
"classification_id": 2,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "Natasha Carl",
"owner_id": 2,
"state_id": 4,
"state_name": "Containment"
},
{
"access_level": 4,
"case_close_date": "09/25/2023",
"case_description": "spam test ticket\n\nblah",
"case_id": 16,
"case_name": "#16 - spam test ticket",
"case_open_date": "07/13/2023",
"case_soc_id": "CERT-EU-21",
"case_uuid": "71636b85-ef58-4d45-a5bf-faa2ac00031a",
"classification": "abusive-content:spam",
"classification_id": 1,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 9,
"state_name": "Closed"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "dark.local\n\ntesting notes",
"case_id": 15,
"case_name": "#15 - Virus detected on VM dark.local",
"case_open_date": "07/13/2023",
"case_soc_id": "CERT-EU-20",
"case_uuid": "94e4a63a-3c8b-4a4e-ae02-b32c0c1b6386",
"classification": "malicious-code:virus",
"classification_id": 4,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 2,
"state_name": "In progress"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "ROOTKIT TEST\n\nTHIS IS A TEST FORM",
"case_id": 13,
"case_name": "#13 - ROOTKIT TEST",
"case_open_date": "06/08/2023",
"case_soc_id": "CERT-EU-19",
"case_uuid": "6f8a72b5-2c82-4654-b84a-e8e10e9299de",
"classification": "malicious-code:rootkit",
"classification_id": 10,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "09/26/2023",
"case_description": "Scanning ports machine X\n\n\n- 1\n- 2\n- 3\n- \n**## EDITED**",
"case_id": 12,
"case_name": "#12 - Scanning ports machine X",
"case_open_date": "06/08/2023",
"case_soc_id": "CERT-EU-18",
"case_uuid": "3662a525-d572-495c-9d25-45920c3ad1ce",
"classification": "information-gathering:scanner",
"classification_id": 11,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 9,
"state_name": "Closed"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "Code Dialer\n\n### TEST CODE CODE ",
"case_id": 11,
"case_name": "#11 - Code Dialer",
"case_open_date": "06/08/2023",
"case_soc_id": "CERT-EU-17",
"case_uuid": "f0b3b128-88f3-4a37-a908-58ecb5fc7c89",
"classification": "malicious-code:dialer",
"classification_id": 9,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "spyware test 1",
"case_id": 10,
"case_name": "#10 - spyware test 1",
"case_open_date": "06/08/2023",
"case_soc_id": "CERT-EU-16",
"case_uuid": "38ba94bf-978f-4073-99af-291f79889b0b",
"classification": "malicious-code:spyware-rat",
"classification_id": 8,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "Social Eng",
"case_id": 9,
"case_name": "#9 - Social Eng",
"case_open_date": "06/07/2023",
"case_soc_id": "CERT-EU-15",
"case_uuid": "35070554-73c1-421a-bdbb-b840f09411b4",
"classification": "information-gathering:social-engineering",
"classification_id": 13,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "WAF invaded",
"case_id": 8,
"case_name": "#8 - WAF invaded",
"case_open_date": "06/07/2023",
"case_soc_id": "CERT-EU-15",
"case_uuid": "9bab6e73-be89-497c-bfc1-25e213f933eb",
"classification": null,
"classification_id": null,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "A virus has been detected on machine **machine.darkside.in** \n\nDDOS\n\n| Port | Protocol |Hostname|\n|--|--|--|\n| 443 | TCP |machine.darkside.in|\n\n\n```echo Please investigate !```\n\n### HELP !",
"case_id": 7,
"case_name": "#7 - test command 1",
"case_open_date": "06/07/2023",
"case_soc_id": "CERT-EU-14",
"case_uuid": "e88efdc4-6811-4c59-aca6-7eeefab72a81",
"classification": "availability:ddos",
"classification_id": 23,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 6,
"state_name": "Recovery"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "A virus has been detected on machine **machine.darkside.in** \n\n| Port | Protocol |Hostname|\n|--|--|--|\n| 443 | TCP |machine.darkside.in|\n\n\n```echo Please investigate !```\n\n### HELP !",
"case_id": 6,
"case_name": "#6 - Malware detected on machine.darkside.in",
"case_open_date": "06/07/2023",
"case_soc_id": "CERT-EU-13",
"case_uuid": "4f7d583d-7724-4be3-9137-7ca248630bc0",
"classification": null,
"classification_id": null,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "Ransomware test",
"case_id": 3,
"case_name": "#3 - CERT-EU Ransomware test",
"case_open_date": "06/05/2023",
"case_soc_id": "CERT-EU-82",
"case_uuid": "7b9ec75f-f194-4d73-a98a-b657b40b2cc4",
"classification": "malicious-code:ransomware",
"classification_id": 6,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "",
"case_description": "A virus has been detected on machine **darkpace.evil** \n\n| Port | Protocol |Hostname|\n|--|--|--|\n| 443 | TCP |darkplace.evil|\n\n\n```echo Please investigate !```\n\n### HELP !",
"case_id": 2,
"case_name": "#2 - virus-windows-11",
"case_open_date": "06/05/2023",
"case_soc_id": "CERT-EU-12",
"case_uuid": "1a5e6534-571f-4788-b4f5-47cc6b0c18bc",
"classification": "malicious-code:virus",
"classification_id": 4,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 3,
"state_name": "Opened"
},
{
"access_level": 4,
"case_close_date": "06/05/2023",
"case_description": "This is a demonstration.",
"case_id": 1,
"case_name": "#1 - Initial Demo",
"case_open_date": "06/05/2023",
"case_soc_id": "soc_id_demo",
"case_uuid": "46480e7c-5b78-42c5-8b2e-678991a8a495",
"classification": null,
"classification_id": null,
"client_name": "CERT-EU",
"opened_by": "nouser2",
"opened_by_user_id": 1,
"owner": "nouser2",
"owner_id": 1,
"state_id": 2,
"state_name": "In progress"
}
]
}

Human Readable Output#

Command successfully sent to IRIS DFIR"#

access_levelcase_close_datecase_descriptioncase_idcase_namecase_open_datecase_soc_idcase_uuidclassificationclassification_idclient_nameopened_byopened_by_user_idownerowner_idstate_idstate_name
4TEST 732#32 - TEST 712/18/202347ae5435-4c25-4408-bf86-98277807b2famalicious-code:dialer9CERT-EUnouser21nouser213Opened
4TEST 531#31 - TEST 512/18/20235d5e6bc6-2c83-4c77-9f87-fb12d82e1e35malicious-code:ransomware6CERT-EUnouser21nouser213Opened
4case null 0000f

### dsdsdsd		29#29 - case null 0000f12/14/2023e7ed6439-799a-4eaf-b16c-cde8f7a10ffcmalicious-code:dialer9CERT-EUnouser21nouser213Opened
4malware byte you

test22222		28#28 - malware byte you12/14/2023test-eu-1112aeb9026-7b1d-4caa-a22d-b95e7507eec8abusive-content:harmful-speech2CERT-EUnouser21nouser214Containment
4test jira fields

### 12244434		27#27 - test jira fields11/30/20236b8d5e9a-e27b-4a6a-b27d-059b235f0814malicious-code:spyware-rat8CERT-EUnouser21nouser213Opened
4Evil rootkit
##
machine evil

26#26 - Evil rootkit11/22/2023CERT-EU-846327dec1a169-37cf-44b0-8e9d-78b51efebbc0malicious-code:rootkit10CERT-EUnouser21nouser215Eradication
4mail spam

spam 1234444		25#25 - mail spam11/22/2023CERT-EU-821342383317f2e-72df-4934-a283-500fecd0e758abusive-content:spam1CERT-EUnouser21nouser214Containment
4Evil spyware

dark 123 machine local		24#24 - Evil spyware11/22/2023CERT-EU-896492c63dc059-b8a7-4595-bc2b-833e4798e3acmalicious-code:spyware-rat8CERT-EUnouser21nouser213Opened
4Scanning VIP


fdsfdsfsdfsdfsdfsdf		23#23 - Scanning VIP11/22/2023CERT-EU-2316346cd85ed04-fa5a-4f47-8a3f-0280297a3d53information-gathering:scanner11CERT-EUnouser21nouser213Opened
4virus id 2244

testing 123

machine 10.0.0.1		20#20 - virus id 224411/22/2023CERT-EU-556e71ba63-ad61-4c7e-8b4e-10f16a65cb36malicious-code:virus4CERT-EUnouser21nouser213Opened
4rootkit blabla

machine.dark.local malware baisfldasnfadsf		19#19 - rootkit blabla09/29/2023CERT--EU-444a48eed36-cc03-4a42-a13b-3af41a76dccbmalicious-code:rootkit10CERT-EUnouser21nouser213Opened
409/28/2023Phishing EU member

blabla		18#18 - Phishing EU member09/28/2023CERT-EU-77a9803459-461b-4442-a11e-b6440a91cd85fraud:phishing30CERT-EUnouser21nouser219Closed
4Phishing EU official

test ticket !!!		17#17 - #17 case custom attrib test08/09/2023soc_id_democ034f0fa-d19c-480a-8b1d-045b558915d0abusive-content:harmful-speech2CERT-EUnouser21Natasha Carl24Containment
409/25/2023spam test ticket

blah		16#16 - spam test ticket07/13/2023CERT-EU-2171636b85-ef58-4d45-a5bf-faa2ac00031aabusive-content:spam1CERT-EUnouser21nouser219Closed
4dark.local

testing notes		15#15 - Virus detected on VM dark.local07/13/2023CERT-EU-2094e4a63a-3c8b-4a4e-ae02-b32c0c1b6386malicious-code:virus4CERT-EUnouser21nouser212In progress
4ROOTKIT TEST

THIS IS A TEST FORM		13#13 - ROOTKIT TEST06/08/2023CERT-EU-196f8a72b5-2c82-4654-b84a-e8e10e9299demalicious-code:rootkit10CERT-EUnouser21nouser213Opened
409/26/2023Scanning ports machine X


- 1
- 2
- 3
-
## EDITED		12#12 - Scanning ports machine X06/08/2023CERT-EU-183662a525-d572-495c-9d25-45920c3ad1ceinformation-gathering:scanner11CERT-EUnouser21nouser219Closed
4Code Dialer

### TEST CODE CODE		11#11 - Code Dialer06/08/2023CERT-EU-17f0b3b128-88f3-4a37-a908-58ecb5fc7c89malicious-code:dialer9CERT-EUnouser21nouser213Opened
4spyware test 110#10 - spyware test 106/08/2023CERT-EU-1638ba94bf-978f-4073-99af-291f79889b0bmalicious-code:spyware-rat8CERT-EUnouser21nouser213Opened
4Social Eng9#9 - Social Eng06/07/2023CERT-EU-1535070554-73c1-421a-bdbb-b840f09411b4information-gathering:social-engineering13CERT-EUnouser21nouser213Opened
4WAF invaded8#8 - WAF invaded06/07/2023CERT-EU-159bab6e73-be89-497c-bfc1-25e213f933ebCERT-EUnouser21nouser213Opened
4A virus has been detected on machine machine.darkside.in

DDOS

| Port | Protocol |Hostname|
|--|--|--|
| 443 | TCP |machine.darkside.in|


```echo Please investigate !```

### HELP !		7#7 - test command 106/07/2023CERT-EU-14e88efdc4-6811-4c59-aca6-7eeefab72a81availability:ddos23CERT-EUnouser21nouser216Recovery
4A virus has been detected on machine machine.darkside.in

| Port | Protocol |Hostname|
|--|--|--|
| 443 | TCP |machine.darkside.in|


```echo Please investigate !```

### HELP !		6#6 - Malware detected on machine.darkside.in06/07/2023CERT-EU-134f7d583d-7724-4be3-9137-7ca248630bc0CERT-EUnouser21nouser213Opened
4Ransomware test3#3 - CERT-EU Ransomware test06/05/2023CERT-EU-827b9ec75f-f194-4d73-a98a-b657b40b2cc4malicious-code:ransomware6CERT-EUnouser21nouser213Opened
4A virus has been detected on machine darkpace.evil

| Port | Protocol |Hostname|
|--|--|--|
| 443 | TCP |darkplace.evil|


```echo Please investigate !```

### HELP !		2#2 - virus-windows-1106/05/2023CERT-EU-121a5e6534-571f-4788-b4f5-47cc6b0c18bcmalicious-code:virus4CERT-EUnouser21nouser213Opened
406/05/2023This is a demonstration.1#1 - Initial Demo06/05/2023soc_id_demo46480e7c-5b78-42c5-8b2e-678991a8a495CERT-EUnouser21nouser212In progress

iris-close-case-id#

Close a specific case by ID.

Base Command#

iris-close-case-id

Input#

Argument NameDescriptionRequired
case_idProvide Case ID.Required

Context Output#

PathTypeDescription
IRIS.case_nameunknowncase name
IRIS.case_soc_idunknowncase soc ID
IRIS.open_dateunknowncase open date
IRIS.close_dateunknowncase close date

Command example#

!iris-close-case-id case_id=9

Context Example#

{
"IRIS": {
"case_customer": 1,
"case_description": "Social Eng",
"case_id": 9,
"case_name": "#9 - Social Eng",
"case_soc_id": "CERT-EU-15",
"case_uuid": "35070554-73c1-421a-bdbb-b840f09411b4",
"classification_id": 13,
"close_date": "2024-01-22",
"closing_note": null,
"custom_attributes": {},
"modification_history": {
"1686161424.82484": {
"action": "created",
"user": "nouser2",
"user_id": 1
},
"1694445948.238388": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694446268.42952": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694446597.253438": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694446626.551442": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447102.368478": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447187.785556": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447233.805542": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447256.462593": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447324.542543": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447772.724512": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1694448681.95518": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694449204.048061": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694449647.332296": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1694449754.493539": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694450199.853172": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1694452250.114495": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694452672.978887": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1704711697.835427": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1704711700.739643": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1704711947.950361": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1704711950.774661": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1705935117.44055": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
}
},
"open_date": "2023-06-07",
"owner_id": 1,
"state_id": 9,
"status_id": 0,
"user_id": 1
}
}

Human Readable Output#

Command successfully sent to IRIS DFIR"#

case_customercase_descriptioncase_idcase_namecase_soc_idcase_uuidclassification_idclose_datemodification_historyopen_dateowner_idstate_idstatus_iduser_id
1Social Eng9#9 - Social EngCERT-EU-1535070554-73c1-421a-bdbb-b840f09411b4132024-01-221686161424.82484: {"user": "nouser2", "user_id": 1, "action": "created"}
1694445948.238388: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694446268.42952: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694446597.253438: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694446626.551442: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447102.368478: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447187.785556: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447233.805542: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447256.462593: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447324.542543: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447772.724512: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1694448681.95518: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694449204.048061: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694449647.332296: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1694449754.493539: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694450199.853172: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1694452250.114495: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694452672.978887: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1704711697.835427: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1704711700.739643: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1704711947.950361: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1704711950.774661: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1705935117.44055: {"user": "nouser2", "user_id": 1, "action": "case closed"}		2023-06-071901

iris-reopen-case-id#

Reopen a specific case by ID.

Base Command#

iris-reopen-case-id

Input#

Argument NameDescriptionRequired
case_idcase ID.Optional

Context Output#

PathTypeDescription
IRIS.case_soc_idunknowncase soc ID
IRIS.case_idunknowncase ID
IRIS.close_dateunknowncase close date
IRIS.open_dateunknowncase open date
IRIS.case_nameunknowncase name
IRIS.closing_noteunknowncase closing note

Command example#

!iris-reopen-case-id case_id=9

Context Example#

{
"IRIS": {
"case_customer": 1,
"case_description": "Social Eng",
"case_id": 9,
"case_name": "#9 - Social Eng",
"case_soc_id": "CERT-EU-15",
"case_uuid": "35070554-73c1-421a-bdbb-b840f09411b4",
"classification_id": 13,
"close_date": null,
"closing_note": null,
"custom_attributes": {},
"modification_history": {
"1686161424.82484": {
"action": "created",
"user": "nouser2",
"user_id": 1
},
"1694445948.238388": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694446268.42952": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694446597.253438": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694446626.551442": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447102.368478": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447187.785556": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447233.805542": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447256.462593": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447324.542543": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694447772.724512": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1694448681.95518": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694449204.048061": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694449647.332296": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1694449754.493539": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694450199.853172": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1694452250.114495": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1694452672.978887": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1704711697.835427": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1704711700.739643": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1704711947.950361": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1704711950.774661": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
},
"1705935117.44055": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1705935120.30414": {
"action": "case reopened",
"user": "nouser2",
"user_id": 1
}
},
"open_date": "2023-06-07",
"owner_id": 1,
"state_id": 3,
"status_id": 0,
"user_id": 1
}
}

Human Readable Output#

Command successfully sent to IRIS DFIR"#

case_customercase_descriptioncase_idcase_namecase_soc_idcase_uuidclassification_idmodification_historyopen_dateowner_idstate_idstatus_iduser_id
1Social Eng9#9 - Social EngCERT-EU-1535070554-73c1-421a-bdbb-b840f09411b4131686161424.82484: {"user": "nouser2", "user_id": 1, "action": "created"}
1694445948.238388: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694446268.42952: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694446597.253438: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694446626.551442: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447102.368478: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447187.785556: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447233.805542: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447256.462593: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447324.542543: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694447772.724512: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1694448681.95518: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694449204.048061: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694449647.332296: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1694449754.493539: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694450199.853172: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1694452250.114495: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1694452672.978887: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1704711697.835427: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1704711700.739643: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1704711947.950361: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1704711950.774661: {"user": "nouser2", "user_id": 1, "action": "case reopened"}
1705935117.44055: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1705935120.30414: {"user": "nouser2", "user_id": 1, "action": "case reopened"}		2023-06-071301

iris-change-case-state#

Change case state status

Base Command#

iris-change-case-state

Input#

Argument NameDescriptionRequired
case_idCase ID.Required
case_nameCase name.Required
case_stateCase state. Possible values are: In progress, Opened, Containement, Eradication, Recovery, Post-Incident, Reporting, Closed.Required

Context Output#

PathTypeDescription
IRIS.case_idnumberCase ID
IRIS.case_namestringCase name
IRIS.case_statestringCase state

Command example#

!iris-change-case-state case_id=1 case_state="In progress" case_name="#1 - Initial Demo"

Context Example#

{
"IRIS": {
"case_customer": 1,
"case_description": "This is a demonstration.",
"case_id": 1,
"case_name": "#1 - Initial Demo",
"case_soc_id": "soc_id_demo",
"case_uuid": "46480e7c-5b78-42c5-8b2e-678991a8a495",
"classification_id": null,
"close_date": "2023-06-05",
"closing_note": null,
"custom_attributes": null,
"modification_history": {
"1685985574.367342": {
"action": "case closed",
"user": "nouser2",
"user_id": 1
},
"1704711960.320669": {
"action": "case info updated",
"user": "nouser2",
"user_id": 1
},
"1705935129.662093": {
"action": "case info updated",
"user": "nouser2",
"user_id": 1
}
},
"open_date": "2023-06-05",
"owner_id": 1,
"state_id": 2,
"status_id": 0,
"user_id": 1
}
}

Human Readable Output#

Command successfully sent to IRIS DFIR"#

case_customercase_descriptioncase_idcase_namecase_soc_idcase_uuidclose_datemodification_historyopen_dateowner_idstate_idstatus_iduser_id
1This is a demonstration.1#1 - Initial Demosoc_id_demo46480e7c-5b78-42c5-8b2e-678991a8a4952023-06-051685985574.367342: {"user": "nouser2", "user_id": 1, "action": "case closed"}
1704711960.320669: {"user": "nouser2", "user_id": 1, "action": "case info updated"}
1705935129.662093: {"user": "nouser2", "user_id": 1, "action": "case info updated"}		2023-06-051201

iris-create-notes-group#

Creates notes group

Base Command#

iris-create-notes-group

Input#

Argument NameDescriptionRequired
case_idCase ID.Required
group_titleNotes group tittle.Required

Context Output#

There is no context output for this command.

Command example#

!iris-create-notes-group case_id=1 group_title="test group"

Context Example#

{
"IRIS": {
"group_creationdate": "2024-01-22T14:52:12.540571",
"group_id": 57,
"group_lastupdate": "2024-01-22T14:52:12.540571",
"group_title": "test group",
"group_uuid": "62742497-8cf6-4cea-bac4-5ff50e4bb4e5"
}
}

Human Readable Output#

Command successfully sent to IRIS DFIR"#

group_creationdategroup_idgroup_lastupdategroup_titlegroup_uuid
2024-01-22T14:52:12.540571572024-01-22T14:52:12.540571test group62742497-8cf6-4cea-bac4-5ff50e4bb4e5

iris-add-new-note-to-group#

Add a new note to an existing group.

Base Command#

iris-add-new-note-to-group

Input#

Argument NameDescriptionRequired
case_idCase ID.Required
note_titleNote tittle.Required
note_contentNote content.Required
group_idGroup ID.Required

Context Output#

There is no context output for this command.

Command example#

!iris-add-new-note-to-group case_id=1 group_id=55 note_content="test content" note_title="test tittle"

Context Example#

{
"IRIS": {
"custom_attributes": {},
"note_content": "test content",
"note_creationdate": "2024-01-22T14:52:15.366100",
"note_id": 63,
"note_lastupdate": "2024-01-22T14:52:15.366100",
"note_title": "test tittle",
"note_uuid": "a2cf6b17-d8be-4ca0-814d-12910aefa2f2"
}
}

Human Readable Output#

Command successfully sent to IRIS DFIR"#

note_contentnote_creationdatenote_idnote_lastupdatenote_titlenote_uuid
test content2024-01-22T14:52:15.366100632024-01-22T14:52:15.366100test tittlea2cf6b17-d8be-4ca0-814d-12910aefa2f2

iris-get-list-of-groups-and-notes#

Get a list of the notes and groups.

Base Command#

iris-get-list-of-groups-and-notes

Input#

Argument NameDescriptionRequired
case_idCase ID.Required

Context Output#

There is no context output for this command.

Command example#

!iris-get-list-of-groups-and-notes case_id=1

Context Example#

{
"IRIS": {
"groups": [
{
"group_id": 1,
"group_title": "test group",
"group_uuid": "98a49bf1-66a3-4014-94a3-b84f7465129e",
"notes": []
},
{
"group_id": 55,
"group_title": "test group",
"group_uuid": "89085dde-aa63-467b-a17a-d78d20bdc794",
"notes": [
{
"note_id": 61,
"note_lastupdate": "2024-01-08T11:04:41.529018",
"note_title": "test tittle",
"note_uuid": "1e7cfa4e-6ce0-4261-ae5d-a70eba2b1462",
"user": "nouser2"
},
{
"note_id": 62,
"note_lastupdate": "2024-01-08T11:06:05.840447",
"note_title": "test tittle",
"note_uuid": "c1ceef5b-0020-48d7-ac0f-c0c4c40ef396",
"user": "nouser2"
},
{
"note_id": 63,
"note_lastupdate": "2024-01-22T14:52:15.366100",
"note_title": "test tittle",
"note_uuid": "a2cf6b17-d8be-4ca0-814d-12910aefa2f2",
"user": "nouser2"
}
]
},
{
"group_id": 56,
"group_title": "test group",
"group_uuid": "36da7617-6eca-49d9-bbb6-64737db54aab",
"notes": []
},
{
"group_id": 57,
"group_title": "test group",
"group_uuid": "62742497-8cf6-4cea-bac4-5ff50e4bb4e5",
"notes": []
}
],
"state": {
"object_last_update": "2024-01-22T14:52:15.373121",
"object_state": 8
}
}
}

Human Readable Output#

Command successfully sent to IRIS DFIR"#

groupsstate
{'group_id': 1, 'group_uuid': '98a49bf1-66a3-4014-94a3-b84f7465129e', 'group_title': 'test group', 'notes': []},
{'group_id': 55, 'group_uuid': '89085dde-aa63-467b-a17a-d78d20bdc794', 'group_title': 'test group', 'notes': [{'note_id': 61, 'note_uuid': '1e7cfa4e-6ce0-4261-ae5d-a70eba2b1462', 'note_title': 'test tittle', 'user': 'nouser2', 'note_lastupdate': '2024-01-08T11:04:41.529018'}, {'note_id': 62, 'note_uuid': 'c1ceef5b-0020-48d7-ac0f-c0c4c40ef396', 'note_title': 'test tittle', 'user': 'nouser2', 'note_lastupdate': '2024-01-08T11:06:05.840447'}, {'note_id': 63, 'note_uuid': 'a2cf6b17-d8be-4ca0-814d-12910aefa2f2', 'note_title': 'test tittle', 'user': 'nouser2', 'note_lastupdate': '2024-01-22T14:52:15.366100'}]},
{'group_id': 56, 'group_uuid': '36da7617-6eca-49d9-bbb6-64737db54aab', 'group_title': 'test group', 'notes': []},
{'group_id': 57, 'group_uuid': '62742497-8cf6-4cea-bac4-5ff50e4bb4e5', 'group_title': 'test group', 'notes': []}		object_state: 8
object_last_update: 2024-01-22T14:52:15.373121

iris-get-list-of-iocs#

Returns a list of IOCs as well as any existing linked with other cases.

Base Command#

iris-get-list-of-iocs

Input#

Argument NameDescriptionRequired
case_idCase ID.Required

Context Output#

PathTypeDescription
IRIS.case_idnumberCase ID.
IRIS.case_namestringCase Name.

Command example#

!iris-get-list-of-iocs case_id=1

Context Example#

{
"IRIS": {
"ioc": [
{
"ioc_description": "This is an example",
"ioc_id": 5,
"ioc_misp": null,
"ioc_tags": "",
"ioc_tlp_id": 2,
"ioc_type": "github-username",
"ioc_type_id": 65,
"ioc_uuid": "93ca5e50-13a5-4d59-8b92-b99bf4bb70fd",
"ioc_value": "github-username-example",
"link": [],
"misp_link": null,
"tlp_bscolor": "warning",
"tlp_name": "amber"
}
],
"state": {
"object_last_update": "2024-01-08T10:45:20.129696",
"object_state": 1
}
}
}

Human Readable Output#

Command successfully sent to IRIS DFIR"#

iocstate
{'ioc_id': 5, 'ioc_uuid': '93ca5e50-13a5-4d59-8b92-b99bf4bb70fd', 'ioc_value': 'github-username-example', 'ioc_type_id': 65, 'ioc_type': 'github-username', 'ioc_description': 'This is an example', 'ioc_tags': '', 'ioc_misp': None, 'tlp_name': 'amber', 'tlp_bscolor': 'warning', 'ioc_tlp_id': 2, 'link': [], 'misp_link': None}object_state: 1
object_last_update: 2024-01-08T10:45:20.129696

iris-get-ioc-content#

Fetch the content of an ioc.

Base Command#

iris-get-ioc-content

Input#

Argument NameDescriptionRequired
case_idCase ID.Required
ioc_idIoC ID.Required

Context Output#

PathTypeDescription
IRIS.case_idnumberCase ID.
IRIS.ioc_descriptionstringIoC Description.
IRIS.ioc_idnumberIoC ID.
IRIS.ioc_valuestringIoC Value.
IRIS.ioc_typestringIoC Type.

Command example#

!iris-get-ioc-content case_id=1 ioc_id=5

Context Example#

{
"IRIS": {
"custom_attributes": {},
"ioc_description": "This is an example",
"ioc_enrichment": null,
"ioc_id": 5,
"ioc_misp": null,
"ioc_tags": "",
"ioc_tlp_id": 2,
"ioc_type": {
"type_description": "A github user name",
"type_id": 65,
"type_name": "github-username",
"type_taxonomy": null,
"type_validation_expect": null,
"type_validation_regex": null
},
"ioc_type_id": 65,
"ioc_uuid": "93ca5e50-13a5-4d59-8b92-b99bf4bb70fd",
"ioc_value": "github-username-example",
"user_id": 1
}
}

Human Readable Output#

Command successfully sent to IRIS DFIR"#

ioc_descriptionioc_idioc_tlp_idioc_typeioc_type_idioc_uuidioc_valueuser_id
This is an example52type_description: A github user name
type_taxonomy: null
type_id: 65
type_name: github-username
type_validation_regex: null
type_validation_expect: null		6593ca5e50-13a5-4d59-8b92-b99bf4bb70fdgithub-username-example1
Edit this page
Report an Issue