opencti
opencti copied to clipboard
[Feature Request] Capability to close out reports in bulk against OS tags
Use case
To efficiently and effectively close reports out in bulk that effect platforms you are not concerned about (e.g., Windows/Linux/MacOS) decreasing overall noise
Current Workaround
Manually going through reports to determine if it effects the platforms we possess
Proposed Solution
Scrape/Parse reports for keywords such as Linux, Windows, MacOS and apply a tag for the respective OS against the report that then can be closed out in a bulk method via Widget, Button, Filter method
Additional Information
None
If the feature request is approved, would you be willing to submit a PR?
Yes, but will need assistance
Hi @skrumzy , when you say "close report", what does it means? Change the workflow status? delete the report?
When you say scrape/parse the report, you talk about the report PDF? Did you use the import-document connector for that?
Thanks
Hi @richard-julien, Close the report could mean either the ability to delete it or change the status on the report to closed. When I say scrape/parse, I was just guessing at how you guys are pulling in reports and analyzing them to properly tag them, create entities, etc. Whatever that process is, is it possible to find keywords for OSes through regex or something else? Does that answer your questions?
Hello @skrumzy,
You already has the capability to search reports for a specific keyword and then launch a mass background task (using the select all) then change the status or delete.
The launched background task takes into account your search keyword to target the reports.
Is this not enough?