Ability to extend the scheme of the artifacts
We need the ability to add diffrent fields to the artifacts. Same as we can extend the scheme of the incident we need to create custom fields to the artifacts. This can be used to indicate the status of the artifact is blocked or allowed. Also might be used to indecate the place where is the ip inside my network, etc.
-
Guest
- Apr 19 2018
- Future consideration
Related ideas
This is totally needed. Especially in scripting with scripts, functions etc...
For example, I need some boolean fields to indicate whether a bad IP was blocked in firewall or not, or some text fields to indicate where the artifact came from
Without such fields, it's very hard to keep track of the artifacts' status and activities around them during the incident response process
Attachments Open full size
I need this too
Attachments Open full size
Totally agreed with this RFE. To be able to insert/update field to Artifacts of an incident will be great. Many info to be displayed.Appeciated ......
Attachments Open full size
Seems related to another RFE at its core:
https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-161
Attachments Open full size
This RFE will facilitate integration with a Threat Intel Platform. With it, I could extend the schema to show which artifacts are indicators of attack, indicators of compromise, victim identifiers, or some other context. Or I could modify the schema to align with an existing threat sharing protocol like STIX or TAXII.
Attachments Open full size
Hierarchical artifacts would also be great. Current use case where specified email sender is added as artifact (and then IP, attachment etc all relating to this email). Thus a hierarchical view of this artifact would be great. Thus certain artifacts are owned by other artifacts (or relate to other artifacts within the same incident).
Attachments Open full size
Also would be great for example to know which 'actions' where triggerred against an artefact - such as 'block requested'
Attachments Open full size
Also consider the out of box "IP" artifact allows analysts to specify if it was the source or destination and knows that 256.1.1.1 is not a valid ip address and tells the user so. There is a lot of customization that is not available when creating artifact types.
Attachments Open full size
Agree; At least the descfiption field should be visible at the Artifact which is not the case now. WHy does it exist if not shown during the entry.. where we could instruct e.g which syntax to use for user IDs or Tel Number or Hosts..
Attachments Open full size
I totally agree with this RFE. To be able to insert/update field to Artifact widget will be great. A frame including a scroll bar can be used for many enrichments, informations etc...
Attachments Open full size