Feature Request - Default/Standardized Taxonomies and Tags

[cybermung]

Request Type

Feature Request - Default/Standardized Taxonomies and Tags

Description

Lack of default tags that can be applied at the case/incident level. This would very similar to the way taxonomies work at at the event level with MISP. This allows for a more formal way of keeping track of different, standardized tags. Example default tags that would require input could include point of origination, attribution (APT, Cybercrime, etc), Detection Tool (SIEM, Employee, etc.)

Possible Solutions

Brainstorm ideas:

• Use MISP user interface workflow: Click Tags -> select appropriate taxonomy -> tag
• Use mix of drop downs in a seperate tag edit interface, drop downs can be added

Complementary information

Taxonomies should be importable in a similar way MISP does it (write the taxonomy via json, drop it into a folder, update application, $$)

[saadkadhi]

Hi @Philee,

Thank you for this interesting feature request which has also been raised in #35. This will take us some time to analyze and implement. Please bear with us as we have other features we'd like to get done in the upcoming weeks and months.

[philip8]

@Philee

Hey Phil, can you please contact me. Been trying to reach you.

My e-mail is [email protected]

[saadkadhi]

Adding a description from #35

Looking at MISP as well, there you have the possibility to tag Events in different categories, this is an excellent idea and I propose that this is implemented into thehive
For example in the MISP you can use the VERIS taxonomy, this is really useful for adding tags for cases to show more or less the details around the case, you can tag with country, type of enviroment, source of incident, impact, what kind of actor, insider etc. etc.

I suggest these gets implemented as tags in thehive, also that TLP, VERIS and MISP at least are implemented, if you like to make this work for the same organisations using MISP, then consider being able to use all the same taxonomies as them

[jeffrey-e]

Hi there, is there any update on this part? I see some requirements for something similar like this

[rriclet]

Taxonomies added to TheHive 4.1.0 :
#1670