Restructure user access and storage to Case > Incident > Task/observable

[leejlawson]

Request Type

Feature Request

Problem Description

I work in an environment where all users should not have access to all incidents/cases. Is there a possibility that Hive can be restructured so that users have to be explicitly granted access to a case(project/customer etc.), within a Case there are Incidents(breach etc.), and within an Incident there are Tasks and Observables.

Possible Solutions

Structure:
-Case
--Incident
---Tasks
---Observables
---Reports

Users are explicitly granted access to Case level, then implicitly granted access to all Incidents underneath that Case. Admins have access to all Cases.

Tasks, Observables and Reports are limited access only to those that are explicitly granted access to the Case, unless an Observable has been added in another Case in which case a message should be displayed stating that "The same Observable was seen in Case1234, User1234 owns that Case". At that point, User1234 can share knowledge of (or grant access to) the previous Case.

Thanks,
Lee

[saadkadhi]

Hi @leejlawson. We are against creating yet another level below the case level. Instead, we'd study adding custom tags according to a taxonomy that would allow you to achieve the same results. For example shared:all, shared:groupX, ...

As for user/roles, that won't come before 3.0 slated for Q4 2017. We'll track this in #103.