What Cymph uses it for
Cymph connects to a DFIR-IRIS instance to read cases and users, and to push playbook steps into a case as tasks. This connector performs both read operations (listing cases and users) and write operations (adding tasks to a case).Requirements
API token setup
Every DFIR-IRIS user is issued an API key. To find it, log in to the DFIR-IRIS web interface and open My Settings (left panel, under your username). Copy the API key shown there. If the key is ever exposed, use the Renew option to generate a new one.Permissions
A DFIR-IRIS API key inherits the permissions of the user it belongs to, so use a token from a user account that has:- Access to the cases you want Cymph to read and push tasks into (case list and task creation).
- Administrative rights, if you want Cymph to list all users when assigning tasks — the user-list endpoint is a management operation.