You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When previewing alerts, TheHive shows their proximity with existing cases by showing the number of shared observables and IOCs. This is not good but not enough to make an informed decision on whether to import or not an alert and if so whether to add it to an existing case or not.
Possible Solutions
When #365 is implemented, add the number of observables in the alert that correspond to sighted IOCs in existing cases as well to further the analyst make a decision.
The text was updated successfully, but these errors were encountered:
Request Type
Feature Request
Work Environment
Problem Description
When previewing alerts, TheHive shows their proximity with existing cases by showing the number of shared observables and IOCs. This is not good but not enough to make an informed decision on whether to import or not an alert and if so whether to add it to an existing case or not.
Possible Solutions
When #365 is implemented, add the number of observables in the alert that correspond to
sighted
IOCs in existing cases as well to further the analyst make a decision.The text was updated successfully, but these errors were encountered: