OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.45k stars 947 forks source link

Investigations - Easily add label to selected entities #9072

Open damians-filigran opened 3 days ago

damians-filigran commented 3 days ago

Use case

As an analyst, I would like to select some specific entities on my link analysis, and then take an action on those, such as enriching them from VT, adding them to a report or case, or adding labels to them. One potential vehicle to do this would be to add a label easily from the UI, which could then trigger a playbook that performs those actions, or allow me to run a bulk edit on a separate tab by selecting all entities with that label

Current Workaround

One possible method is to create a temporary entity that supports relationships, like an external reference, and then click to add a relationship between those entities and the placeholder. That temporary entity can then be used as a search condition to select all those entities before running a bulk edit.

Proposed Solution

Have additional options on the bottom-right tool tray to include: Add Label, Add to Container.