Tutorials
Step-by-step walkthroughs that run on this instance. You do every step yourself on the real pages; a panel explains what to do and moves on once it's done. They create real data, so use a test customer.
Run your first investigation
Open a case, add several IOCs at once, put a raw log date on the timeline, and hand a task to a colleague.
13 steps · ~8 min
Triage alerts from the keyboard
Use the split triage view to walk the alert queue with j and k, select with x, and escalate an alert into a case with e.
9 steps · ~5 min
Hand over: report and close a case
Generate the case report from a template, then close the case with a note recording the outcome.
7 steps · ~4 min
Shortcuts for power users
Jump to any case with Ctrl+K, search everything with Ctrl+/, and the buttons that save typing inside a case.
8 steps · ~3 min
Automate IRIS with the API
Create a read-only API key for a script or an AI assistant, call the API with it, and find every endpoint in the reference.
8 steps · ~4 min
Track a vulnerability across a crisis
Record a vulnerability, open a war room and a case, find the vulnerability on an asset, and pull the case into the war room.
18 steps · ~10 min