IRIS-Web (DFIR)

iris-cli case new --name <c>

Manage DFIR cases in IRIS-Web with the CLI, creating cases and events with evidence and notes.

Run it when you want to manage DFIR cases from the command line: iris-cli case new registers the case (name, description) in IRIS-Web — the DFIR case platform (from dfir-iris): cases with events, evidence, notes, and IOCs. It is the reference DFIR case platform: incident management with forensic detail. In the SOC/DFIR, IRIS-Web is case management: the case created with the CLI (or the interface) and events and evidence organized.

Do not use it without the platform: iris-cli requires the IRIS-Web server and credentials — the infrastructure is the requirement. And watch out: the IRIS case is built with the DFIR flow (events, evidence, IOCs) — integration with analysis tools (Timesketch, 020) is part of the flow. The IRIS API has its schema: consult the documentation. For interactive analyst work, use the IRIS interface; the CLI is for programmatic operations.