Case merging

[nadouani]

Request Type

Feature Request

Problem Description

There are times when a security analyst may open a new case and carry on with their investigation only to realize that a similar case has been opened by another security analyst (or by themselves if they have short time memory) or that there is a former case that is sufficiently related to the new case that they should be merged together in a single one instead of having two (or more) separate ones.

Possible Solutions

1. Provide a solution to allow a security analyst to select two or more cases and merge them together. When doing so, they must supply a short description to justify their action.
2. When a new case has been opened and observables imported, check upon import if said observables have already been encountered and suggest (without blocking the addition) that the security analyst should consider merging this case with the one where these observables have been already seen. If the security analyst elect to do so, they should go on with their observable addition and then go back to 1. (see above) to perform the merge operation.

The check in 2. may be done using a proximity algorithm.

Complementary information

Caution

Upon merging, we shall retain the ancient cases in the database so that when a security analyst look them up by case ID, they should get a hit that:

1. tells them the case they are looking for has been merged with another
2. redirect them to the new case

[analyst444]

Can we add merging cases functionality to our Hive? Looks like we don't have the facing arrows.