Group observables of an entity (create an object with multiple observables)

TheHive-Project / TheHive

TheHive: a Scalable, Open Source and Free Security Incident Response Platform

https://thehive-project.org

GNU Affero General Public License v3.0

3.43k stars 623 forks source link

Group observables of an entity (create an object with multiple observables) #991

Open mgabriel-silva opened 5 years ago

mgabriel-silva commented 5 years ago

Request Type

Feature Request

Problem Description

Suppose a case involving multiple network assets. There will be a lot of observable ips and fqdns It's very hard to vizualize which ip refer to which fqdn It would be nice to group these observables in entities (just like in MISP)

Instead of:

ip1
ip2
ip3
fqdn1
fqdn2
fqdn3

Should be:

entity1 ip1 fqdn1
entity2 ip2 fqdn2
entity3 ip3 fqdn3

nadouani commented 5 years ago

This is something that can be possible with TheHive 4, not before.