opencti icon indicating copy to clipboard operation
opencti copied to clipboard

[Feature Request] Capability to close out reports in bulk against OS tags

Open skrumzy opened this issue 2 years ago • 1 comments

Use case

To efficiently and effectively close reports out in bulk that effect platforms you are not concerned about (e.g., Windows/Linux/MacOS) decreasing overall noise

Current Workaround

Manually going through reports to determine if it effects the platforms we possess

Proposed Solution

Scrape/Parse reports for keywords such as Linux, Windows, MacOS and apply a tag for the respective OS against the report that then can be closed out in a bulk method via Widget, Button, Filter method

Additional Information

None

If the feature request is approved, would you be willing to submit a PR?

Yes, but will need assistance

skrumzy avatar Sep 15 '22 12:09 skrumzy

Hi @skrumzy , when you say "close report", what does it means? Change the workflow status? delete the report?

When you say scrape/parse the report, you talk about the report PDF? Did you use the import-document connector for that?

Thanks

richard-julien avatar Sep 16 '22 12:09 richard-julien

Hi @richard-julien, Close the report could mean either the ability to delete it or change the status on the report to closed. When I say scrape/parse, I was just guessing at how you guys are pulling in reports and analyzing them to properly tag them, create entities, etc. Whatever that process is, is it possible to find keywords for OSes through regex or something else? Does that answer your questions?

skrumzy avatar Sep 27 '22 19:09 skrumzy

Hello @skrumzy,

You already has the capability to search reports for a specific keyword and then launch a mass background task (using the select all) then change the status or delete.

The launched background task takes into account your search keyword to target the reports.

Is this not enough?

image

SamuelHassine avatar Oct 02 '22 18:10 SamuelHassine