search

TheHive-Project / TheHive

TheHive: a Scalable, Open Source and Free Security Incident Response Platform
https://thehive-project.org
GNU Affero General Public License v3.0
3.45k stars 625 forks source link

Configure case behavior when updates to observables are made #392

Open notx11 opened 6 years ago

notx11 commented 6 years ago

Request Type

Feature Request

When you share a Case to MISP, TheHive will create the Alert that represent the newly created MISP event. And if you update that MISP event, the MISP connector will mark the alert as UPDATED, and will re-open the case OR if a case is created from an alert, then, if the alert (MISP event for example is updated (a new attribute has been added to the MISP event for example), the corresponding case gets re-opened.

Add the ability to allow or disallow cases from being reopened under these conditions in application.conf

treed593 commented 6 years ago

Following this, I would like to see this too