> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# DFIR-IRIS

> Read DFIR-IRIS cases and push playbook steps into a case as tasks.

## What Cymph uses it for

Cymph connects to a DFIR-IRIS instance to read cases and users, and to push playbook steps into a case as tasks. This connector performs both **read** operations (listing cases and users) and **write** operations (adding tasks to a case).

## Requirements

| Field            | Description                                                          |
| ---------------- | -------------------------------------------------------------------- |
| **Instance URL** | Base URL of your DFIR-IRIS instance, e.g. `https://iris.example.com` |
| **API token**    | A DFIR-IRIS API key (see below)                                      |

## API token setup

Every DFIR-IRIS user is issued an API key. To find it, log in to the DFIR-IRIS web interface and open **My Settings** (left panel, under your username). Copy the API key shown there. If the key is ever exposed, use the **Renew** option to generate a new one.

## Permissions

A DFIR-IRIS API key inherits the permissions of the user it belongs to, so use a token from a user account that has:

* **Access to the cases** you want Cymph to read and push tasks into (case list and task creation).
* **Administrative rights**, if you want Cymph to list all users when assigning tasks — the user-list endpoint is a management operation.

For a full-featured integration, an account with administrative privileges is the simplest choice; for least privilege, ensure at minimum the account has access to the relevant cases.

## What Cymph reads and writes

## Testing the connection