dfir-iris / iris-client Goto Github PK

When creating a case it should be possible to add tags and the owner. Right now it is only possible by doing a second request with update_case.

When using custom attributes on the add_case method, I find them to be in a bad format if I use the update_case afterwards.

The solution I found for this was by including exactly the same custom attributes in the update_case method.

The function contains the wrong post method instead of the get method

return self._s.pi_post(f'case/{object_name}/{object_id}/comments/list', cid=cid)

I've been trying to retrieve alerts between two dates but the query always returns all results.

dfir-iris-client==2.0.1

session = ClientSession(apikey="<apikey>",
                                host='http://localhost:8000', ssl_verify=False)
alertInstance = Alert(session=session)
results = alertInstance.filter_alerts(alert_start_date="2023-09-01",alert_end_date="2023-09-02")

I appear to have the same issue when performing curl requests when using alert_start_date/alert_end_date.

source_start_date/source_end_date appear to be the correct API calls

add_note_group and group_id are deprecated but were replaced by add_note_directory and directory_id.

The documentation does not reflect this change yet.

For integration between different system (or even reporting done outside of IRIS) i think
https://docs.dfir-iris.org/_static/iris_api_reference_v2.0.1.html#tag/Manage-case/operation/get-manage-cases-list should support filtering by

• time
• user
• case status

If I create a case A with any of those flags active, with attachment A, they work by adding the file to the evidences and IOCs.

But if I create a case B, with attachment A, with any of those flags active, the attachment is not added either to the IOCs or the evidences.

If I delete the case A and try to create the case B again, the flags work again.