PhantomGraph Release Notes v0.13.3 — DFIR-IRIS Case Export (2026-08-30) A case can now be sent straight into DFIR-IRIS as an investigation case, from the button beside Push to MISP. Configure your IRIS server under Settings → Integrations, the same way as MISP. The two exports are deliberately different. MISP receives what is publishable: the indicators PhantomGraph stands behind. IRIS receives what was observed: every URL, host, address, attachment hash and certificate name from the submission, each one labelled with whether it is eligible for indicator promotion. Observables that are not eligible are exported anyway and marked, because when you are investigating, the links a case ruled out are part of how you reach a conclusion. Anything marked as context carries a note not to publish it without corroborating it yourself. The case arrives with the verdict, the narrative, and a timeline that follows the attack as it was observed: each stage on the main timeline, with the URLs seen at that stage branching off it, so a redirect chain and the page it landed on stay visually distinct. Timeline entries record the order events were observed in, not clock times: PhantomGraph observes sequence during a detonation, not timestamps, and the case says so rather than implying a precision it does not have. Export is analyst-initiated by default. You can optionally set a threshold— Suspicious and above, or Malicious only — to have qualifying cases created automatically as they complete. Turning it on applies to new submissions; it does not export your existing history. Sending the same case twice will not duplicate it. PhantomGraph finds the existing case and reconciles its observables, and leaves the timeline alone; any events you added yourself in IRIS are yours, and are never rewritten or duplicated by a re-export. Also in this release: per-account integration settings now take effect. Integration settings saved in Settings → Integrations were previously being stored but not applied, so pushes used the server’s own configuration instead of yours. If you had saved your own MISP server, it will begin being used after this release - please check that the settings shown are the ones you intend. Separately, saving one integration’s settings no longer clears another’s. For full release notes history, create a free account at app.phantomgraph.io and try it out today.