Iris Dfir and OpenCTI integration

Make sure you have n8n installed and running:

• Install n8n on any platform using npm or Docker;
• Or let n8n host it for you on its cloud infrastructure.

In n8n, click the "Add workflow" button in the Workflows tab to create a new workflow.

Add the starting point – a trigger on when your workflow should run: on an app event, on schedule, on a webhook call, when called by another workflow, or manually. In some cases, the HTTP Request node might already serve as your starting point.

You can find Iris Dfir and OpenCTI nodes in the nodes panel and drag them onto your workflow canvas. These nodes will be added as HTTP Request nodes with pre-configured credential types. This allows you to perform custom operations, without additional authentication setup.

Click on the HTTP nodes to configure their settings. Use Iris Dfir and OpenCTI API docs to construct your requests. The HTTP Request nodes make custom API calls to Iris Dfir and OpenCTI to query the data you need using the URLs you provide. See the example here.

Connect the output of the Iris Dfir node to the input of the OpenCTI node or vice versa.

Use n8n's core nodes to transform data the way you need and extend the integration:

• Splitting: IF and Switch
• Merging: Merge, Compare Datasets
• Looping: IF and Loop Over Items
• Waiting: Wait
• Creating sub-workflows: Execute Workflow and Execute Workflow Trigger
• Error handling: Stop And Error and Error Trigger
• Code: write custom JavaScript or Python and run it as a step in your workflow.

Once you've configured everything, make sure to save your workflow and activate it. Activating a workflow means that it will run automatically every time a trigger node receives input or meets a condition. By default, all newly created workflows are deactivated.

Run the workflow to see if everything is working as expected. Based on your configuration, data should flow from Iris Dfir to OpenCTI or vice versa. Easily debug your workflow: you can check past executions to isolate the mistake and fix it.