Cisco Secure Endpoint and Iris Dfir integration

Make sure you have n8n installed and running:

• Install n8n on any platform using npm or Docker;
• Or let n8n host it for you on its cloud infrastructure.

In n8n, click the "Add workflow" button in the Workflows tab to create a new workflow.

Add the starting point – a trigger on when your workflow should run: on an app event, on schedule, on a webhook call, when called by another workflow, or manually. In some cases, the HTTP Request node might already serve as your starting point.

You can find Cisco Secure Endpoint and Iris Dfir nodes in the nodes panel and drag them onto your workflow canvas. These nodes will be added as HTTP Request nodes with pre-configured credential types. This allows you to perform custom operations, without additional authentication setup.

Click on the HTTP nodes to configure their settings. Use Cisco Secure Endpoint and Iris Dfir API docs to construct your requests. The HTTP Request nodes make custom API calls to Cisco Secure Endpoint and Iris Dfir to query the data you need using the URLs you provide. See the example here.

Connect the output of the Cisco Secure Endpoint node to the input of the Iris Dfir node or vice versa.

Use n8n's core nodes to transform data the way you need and extend the integration:

• Splitting: IF and Switch
• Merging: Merge, Compare Datasets
• Looping: IF and Loop Over Items
• Waiting: Wait
• Creating sub-workflows: Execute Workflow and Execute Workflow Trigger
• Error handling: Stop And Error and Error Trigger
• Code: write custom JavaScript or Python and run it as a step in your workflow.

Once you've configured everything, make sure to save your workflow and activate it. Activating a workflow means that it will run automatically every time a trigger node receives input or meets a condition. By default, all newly created workflows are deactivated.

Run the workflow to see if everything is working as expected. Based on your configuration, data should flow from Cisco Secure Endpoint to Iris Dfir or vice versa. Easily debug your workflow: you can check past executions to isolate the mistake and fix it.