dfir-iris
Link IOC directly to case
Currently an IOC object can be linked to multiple Cases. However, this gives unexpected behavior, since an update on one case also updates this on another case. An IOC might have a complete different context on a certain case related to another case.
This PR makes an IOC bound to one specific case. The "Linked Cases" feature is still implemented by simply querying all IOCs with the same value/type combination.
The migration for this was non-trivial, since all IOC related objects have to be duplicated to not loose any data. I did not write a migration for the IOC->CaseEvents and IOC->Alerts link, since I never used this feature before. If someone could help me with that would be great!
fixes #462 fixes #304
@whikernel do you have any comments on this PR? I would be open for comments to improve/change it if needed.
Hi @Matthijsy Thanks for the work, it's a big chunk indeed 👍 I'll need a bit more time to test it out and add the migration for the Events and the Alerts. It will probably be part of the next minor release (2.4.12).
