Enhance case management in OpenCTI

[SamuelHassine]

Use case

Show stoppers:

• Cases & tasks enriched text editor + screenshots + attachement overall experience
• Timeline + lineage of the case to better show what changed, the origin etc. (better than current history)
• Templates for playbook
• Default case template depending on incident types
• Teams default webhook. Add Slack, add comprehensive documentation as we need playbooks to SOAR and other web APIs
• Notification of assignment + for mailing list having default triggers to enable alerting when case severity for instance is increased
• When triggering a response action or an enrichment, be able to ask for validation (approval workflow)
• Default dashboards for CSIRT/CSIRT metrics inspired from NIST and VERIS standards (MTTR, MTTD, MTTA, etc.)
• Enhance reporting with PDF export really meaning full for cases. Team should work on the PDF export HTML template and overall quality of the PDF export connector
• Connector

Nice to have:

• Custom properties
• Wiki

[Jipegien]

we need to discuss where to put it in the roadmap