Retrieve Shared Iris Queries via API

[Derekt2]

In IRIS we can share our investigations with our organization. We'd like to be able to retrieve the investigation name, description, and latest search hash of the investigation via the API. This would alleviate us having to export every investigation and update the search_hash in our external application which uses domaintool's API on a cronjob - instead we can just edit a shared query and the cronjob will automatically pull in the query logic from the shared investigation.

[dnunes-domaintools]

Hi @Derekt2, Apologies for the delay, and thanks for the feedback. That's a great suggestion. I've included it as a feature request to be considered with the next round of updates.

[tlansec]

Surely the real solution is to have IRIS allow for alerting on new results for a given search hash, and then to retrieve the alerts for that search hash?

[Derekt2]

@dnunes-domaintools do you know if this ever got implemented? We're still pulling results from search hashes, which may or may not be the latest search hash in our organization's given investigation.

[dnunes-domaintools]

Hi @Derekt2, I'd like to understand the use case a bit better here. It sounds like you're doing monitoring, and I'm wondering if perhaps a product like our recently announced Iris Detect (which will soon be supported by this code base) might be a better fit for that use case, or potentially utilizing some of our feed offerings.

You can feel free to email me directly dnunes at domaintools if you prefer.

[Derekt2]

Neither Iris Detect, nor your feed offerings fit this use case though they are similar. We're not interesting to "subscribing" to infrastructure results from other sources where we don't know and can't adjust their query logic.

The goal of this use case is to be able to "subscribe" or "automatically retrieve results via API" for investigations which multiple analysts control (and modify regularly to track threat actors & malware) and then share the output with a central organization. Being able to retrieve the current search hash for a shared query via API would work too as then we could piece together the steps with multiple requests.

Our analysts are able to use Domaintools API to meet this use case today, albeit they have to export the search hash every time they update their query.

[dnunes-domaintools]

Hi again @Derekt2. We're planning a product update that I think would address your use case. Would it be possible to have our Iris product manager connect with you directly to better understand and help ensure we're building this out optimally? If you can send me a note to dnunes@domaintools.com, I'll set that up.