OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.37k stars 941 forks source link

Make email notifications more actionable #8785

Open ups1decyber opened 1 week ago

ups1decyber commented 1 week ago

Use case

We would like to use the digest feature in conjunction with email notifiers to create regular summaries of events in OpenCTI, e.g. creation of new reports. This basically works, but the email does not feel actionable, because for each report (i.e. each notification), there is just a single line of text, and a button to click. What we have in mind is to add more context about the trigger entity. For example, the digest of newly created reports should contain report titles and the short descriptions of each report and potentially more relevant fields like markings (would be nice to be able to customize that).

Current Workaround

I have tried to find a workaround by adding a new notifier using the Platform Mailer connector. By adding these lines to the template, I wanted to check what information is available for notifications:

<%-JSON.stringify(data)%>
<%-JSON.stringify(content)%>

But it seems that there are only the short notification lines available, but no information on the triggering entity. So this is not a working workaround for the use-case.

Proposed Solution

I am not sure how exactly to solve this. One option might be to add information of the triggering entity to the notification objects, so information is accessible in the email template.

Additional Information

-

If the feature request is approved, would you be willing to submit a PR?

No

ups1decyber commented 1 week ago

Oh, and is there a way to customize the style of the email aswell? If not, that would also be a useful feature :)