iris-web icon indicating copy to clipboard operation
iris-web copied to clipboard

[FR] API call exposing the last update of any object in a case

Open 59e5aaf4 opened this issue 1 year ago • 0 comments

Is your feature request related to a problem? Please describe.

We would like to synchronize IRIS objects in threat intel platforms. For this, instead of re-shipping all the IRIS case objects every time, we'd like to use the last_update timestamp of objects. Unfortunately, it's not exposed for all objects. It's partially there in case/export, and case/<object>/list just carries the first last_update timestamp it grabs.

Describe the solution you'd like

An API call that, given a case id, gives us the last last_update timestamp across all objects. ( Ideally, a json with per-type last_updates : case, assets, ioc, notes, etc )

Describe alternatives you've considered Directly poking at the SQL database.

59e5aaf4 avatar Mar 22 '24 10:03 59e5aaf4