Integration

DFIR IRIS integration

DFIR IRIS incident response platform API: list, open, update, close, reopen and delete cases, record and maintain the indicators of compromise, assets and tasks that make up an investigation, search the case notes, and work the alert feed by filtering it, reading an alert and escalating it into a case. IRIS is self hosted, so the instance host is part of the credential alongside the user API key.

Connect DFIR IRIS How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in DFIR IRIS.Built from the 20 DFIR IRIS tools below, on the connection you add once.

Common DFIR IRIS use cases

polling the alert feed for new alerts to triage
reporting what remains open on an investigation
removing a case that an automation opened in error
exporting the indicators of a case into a blocklist
closing a case once the investigation has been written up
opening a case when an alert is confirmed as a real incident
finding the identifier of the case a workflow should write to
reopening a closed case when the same indicator is seen again
reading the raw payload of an alert to extract its observables
recording a compromised host discovered during an investigation

What you can do with DFIR IRIS

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Case, 7 operations

close_caseClose casePOSTCloses a DFIR IRIS case.
create_caseCreate casePOSTOpens a new DFIR IRIS case for an investigation.
delete_caseDelete casePOSTDeletes a DFIR IRIS case with its indicators, assets, tasks and notes.
get_caseGet caseGETReturns one DFIR IRIS case with its owner, customer and state.
list_casesList casesGETLists the DFIR IRIS cases the API key can see.
reopen_caseReopen casePOSTReopens a closed DFIR IRIS case.
update_caseUpdate casePOSTUpdates the header fields of a DFIR IRIS case.

Alert, 4 operations

add_alertAdd alertPOSTPushes an alert into the DFIR IRIS intake feed from an external source.
escalate_alertEscalate alertPOSTEscalates a DFIR IRIS alert into a case so it can be investigated.
filter_alertsFilter alertsGETLists the DFIR IRIS alert feed with filters and paging.
get_alertGet alertGETReturns one DFIR IRIS alert with its raw content and linked cases.

Ioc, 4 operations

add_iocAdd iocPOSTAdds an indicator of compromise to a DFIR IRIS case.
delete_iocDelete iocPOSTDeletes an indicator of compromise from a DFIR IRIS case.
list_iocsList iocsGETLists the indicators of compromise recorded in a DFIR IRIS case.
update_iocUpdate iocPOSTUpdates an indicator of compromise recorded in a DFIR IRIS case.

Asset, 2 operations

add_assetAdd assetPOSTAdds an affected system to a DFIR IRIS case.
list_assetsList assetsGETLists the assets recorded in a DFIR IRIS case.

Task, 2 operations

add_taskAdd taskPOSTAdds an investigation task to a DFIR IRIS case.
list_tasksList tasksGETLists the investigation tasks of a DFIR IRIS case.

Note, 1 operation

search_notesSearch notesPOSTSearches the notes written in a DFIR IRIS case.

Use DFIR IRIS from Claude Code, Cursor or Codex

Connect DFIR IRIS in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its DFIR IRIS operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect DFIR IRIS

Create your workspace
Sign up free. Nothing to install.
Connect DFIR IRIS once
Add your DFIR IRIS connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

DFIR IRIS integration FAQ

What can you do with the DFIR IRIS integration?

LiveContext exposes 20 operations on DFIR IRIS, covering case, alert, ioc and asset. Common uses include polling the alert feed for new alerts to triage, reporting what remains open on an investigation and removing a case that an automation opened in error.