{{ message }}
Repository navigation
Retrieve Shared Iris Queries via API #65
Description
In IRIS we can share our investigations with our organization. We'd like to be able to retrieve the investigation name, description, and latest search hash of the investigation via the API. This would alleviate us having to export every investigation and update the search_hash in our external application which uses domaintool's API on a cronjob - instead we can just edit a shared query and the cronjob will automatically pull in the query logic from the shared investigation.
Activity
dnunes-domaintools commentedon Apr 21, 2021
Hi @Derekt2, Apologies for the delay, and thanks for the feedback. That's a great suggestion. I've included it as a feature request to be considered with the next round of updates.
tlansec commentedon May 24, 2021
Surely the real solution is to have IRIS allow for alerting on new results for a given search hash, and then to retrieve the alerts for that search hash?
Derekt2 commentedon Feb 24, 2022
@dnunes-domaintools do you know if this ever got implemented? We're still pulling results from search hashes, which may or may not be the latest search hash in our organization's given investigation.
dnunes-domaintools commentedon Mar 15, 2022
Hi @Derekt2, I'd like to understand the use case a bit better here. It sounds like you're doing monitoring, and I'm wondering if perhaps a product like our recently announced Iris Detect (which will soon be supported by this code base) might be a better fit for that use case, or potentially utilizing some of our feed offerings.
You can feel free to email me directly dnunes at domaintools if you prefer.
Derekt2 commentedon Mar 23, 2022
Neither Iris Detect, nor your feed offerings fit this use case though they are similar. We're not interesting to "subscribing" to infrastructure results from other sources where we don't know and can't adjust their query logic.
The goal of this use case is to be able to "subscribe" or "automatically retrieve results via API" for investigations which multiple analysts control (and modify regularly to track threat actors & malware) and then share the output with a central organization. Being able to retrieve the current search hash for a shared query via API would work too as then we could piece together the steps with multiple requests.
Our analysts are able to use Domaintools API to meet this use case today, albeit they have to export the search hash every time they update their query.
dnunes-domaintools commentedon Aug 15, 2022
Hi again @Derekt2. We're planning a product update that I think would address your use case. Would it be possible to have our Iris product manager connect with you directly to better understand and help ensure we're building this out optimally? If you can send me a note to dnunes@domaintools.com, I'll set that up.