Case Export Import

Case Export / Import

IRIS-NG can export a full case to a single AES-256-GCM encrypted .iris-case file and re-import it into another iris-ng instance. This is the supported path for moving a case between environments (lab → prod, instance → instance) without a database dump.

Format

A .iris-case file is a JSON envelope:

{"enc": "aes256gcm", "v": 1, "salt": "<b64>", "nonce": "<b64>", "ct": "<b64>"}

• Key derivation: PBKDF2-HMAC-SHA256, 260,000 iterations, 16-byte random salt.
• Cipher: AES-256-GCM, 12-byte random nonce per export.
• The ct field holds the encrypted case payload and dominates the file size.

Crypto lives in source/app/iris_engine/case_crypto.py. The password never leaves the request body — it is not in the URL or any log.

What is included

The export round-trips the case's structured data: metadata, notes, IOCs, assets, timeline events, tasks, and the lookup values needed to re-resolve them by name on the receiving side.

Not included (by design): evidence binaries, working-timeline rows, comments, the AI artifact cache, and per-object modification history. The receiving instance resolves lookup IDs (customer, severity, classification, IOC/asset types) by name, so a case imports cleanly even when those catalog IDs differ between instances.

Export

POST /api/v2/cases/<case_id>/export

• Body: {"password": "<analyst-chosen password>"} (JSON).
• Response: the .iris-case file as application/octet-stream, named iris-case-<id>-export.iris-case.
• Requires read-only or full access to the case.

In the UI, the Export button on the case-info modal opens a password + confirm dialog, then triggers a browser download.

Import

POST /api/v2/cases/import

• multipart/form-data with file=<.iris-case> and password=<pw> fields.
• Per the project CSRF rule for multipart bodies, send csrf_token as a form field (not only the X-CSRFToken header).
• Requires the standard_user permission.
• Creates a brand-new case (it does not overwrite an existing one).

In the UI, the Import dialog on the dashboard takes a file and a password.

Wrong password / corrupted file

A wrong password or a corrupted file fails decryption and returns HTTP 400 — "Decryption failed — wrong password or corrupted file". There is no password-recovery path; the password is only held by whoever performed the export.

Notes

• Encryption is mandatory — there is no plaintext export path in the current UI.
• Because import always creates a new case, re-importing the same file twice yields two independent cases.