-
-
Notifications
You must be signed in to change notification settings - Fork 0
Object History
Several case objects keep an audit trail of their own lifecycle in a
modification_history column, surfaced as a collapsible History panel on the
object's modal. This page covers which objects have one, what each records, and the
Added by line that shows who created an object without opening the panel.
| Object | Where | Available from |
|---|---|---|
| Timeline event | Event modal — ⋮ → History, or the clock icon by the title | v2.5.0-beta.1+iris-ng.6 |
| IOC | IOC modal — ⋮ → History, or the clock icon by the title | IRIS-NG-v1.0.0 |
| Asset | Asset modal — ⋮ → History, or the clock icon by the title | IRIS-NG-v1.4.0 |
Notes, tasks, evidence and cases record some lifecycle entries internally but have no panel yet.
The clock icon beside the title appears only when the object has history. The ⋮ menu item is always present on an existing object, so opening it on an object with no recorded history shows an explicit No recorded history line rather than an empty box — a blank panel would be indistinguishable from a broken one.
| Object | Recorded lifecycle points |
|---|---|
| Timeline event |
created (manual), created (CSV import), promoted from working timeline (<source>), updated, flagged / unflagged, commented
|
| IOC |
created, ioc updated
|
| Asset |
created, asset updated, created (promoted from working timeline), created (case import), commented
|
Each entry carries the acting user and a timestamp. Entries are listed newest first.
Asset created covers every way an asset can be created — the single- and
multi-asset modals, the /api/v2/ endpoint, and escalating or merging an alert — because
they all funnel through the same code path. Promotion from the working timeline and case
import construct assets directly and are recorded separately, which is why they have
their own wording.
A convenience line under the object's UUID shows the creator, so the common question can be answered without opening the panel.
| Object | Line | Available from |
|---|---|---|
| Timeline event | On the timeline card footer and in the modal | IRIS-NG-v1.3.0 |
| Asset | In the asset modal | IRIS-NG-v1.4.0 |
| IOC | In the IOC modal | IRIS-NG-v1.4.0 |
The name shown is the user's display name, with their login available on hover. Where a creation time is known it is shown alongside, in UTC.
For events and assets, editing never reassigns the creator, so the attribution stays correct however many times the object is later changed — including changes made through the API or by a module.
IOCs behaved differently until this change, and it matters if you are reading an older instance. The IOC's user column was overwritten with whoever saved the IOC most recently, so on an IOC that a second analyst had edited it named the editor, and the original creator was permanently lost from that column. Two things follow:
- From this version, editing an IOC no longer touches it, so it means the creator, the same as every other case object. Who saved last is in the history panel.
- Because that only fixes matters going forward, the Added by line does not read that column at all. It resolves a genuine creation record instead — see below.
If you have tooling that reads an IOC's user field as last modified by, it will stop changing on edit. Nothing in IRIS-NG read it that way; the IOC list already sorted that column as opened by.
Two records are tried, in order:
-
The
createdentry in the IOC's history. Written sinceIRIS-NG-v1.0.0. IOCs added before that release do not have one. - The activity-log entry written when the IOC was added. This also supplies the creation time, which is otherwise not stored anywhere — IOCs have no "date added" column of their own.
If neither resolves, the line says Added by unknown and names the last person to save the IOC separately, rather than presenting them as the creator.
The second lookup matches on the IOC's value, so it fails when the value itself has been edited since the IOC was added — the log holds the value as it was at the time. That is the usual reason an otherwise ordinary IOC shows as unknown, and hovering the word explains it.
History entries only exist for activity that happened after the object type gained history:
| Object | Entries exist for activity from |
|---|---|
| Timeline event |
v2.5.0-beta.1+iris-ng.6 onward |
| IOC |
IRIS-NG-v1.0.0 onward |
| Asset |
IRIS-NG-v1.4.0 onward |
An asset or IOC created before those points shows an empty history panel. That is expected and is not a fault — there is no record to recover, and none is invented.
The Added by line is the one exception, and only for IOCs: the activity-log fallback described above reaches back over history that predates the feature entirely, which is why most existing IOCs can still name their creator.
- Dual Timeline — event history in the context of the timeline
- Case Notifications — the same activity log, used to show what changed in a case