cyb3rfox / Aurora-Incident-Response

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders
Apache License 2.0
742 stars 79 forks source link

Proposal: Expected working flow for OSINT tab not clear #60

Closed febrezo closed 3 years ago

febrezo commented 3 years ago

Currently I'm experiencing that the OSINT tab clones the values in the Systems tab. This is a bit confusing because there is no space to add multiple sources and evaluate them separately. At the same time, if you remove a row in the tab it seems to corrupt the information in the Systems table by removing details although "links" are still kept in the Timeline tab.

In a recent incident, a backup saved my life after manually removing lines in the OSINT tab but I guess that in the current design the usage is confusing.

I propose a fully redesign of this tab to include the following columns:

1 - Confirmed. Confirmed by other independent sources; logical in itself; Consistent with other information on the subject 
2 - Probably True. Not confirmed; logical in itself; consistent with other information on the subject
3 - Possibly True. Not confirmed; reasonably logical in itself; agrees with some other information on the subject
4 - Doubtfully True. Not confirmed; possible but not logical; no other information on the subject
5 - Improbable Not confirmed; not logical in itself; contradicted by other information on the subject
6 - Cannot Be Judged No basis exists for evaluating the validity of the information

Feel free to add any other valuable comments. This is just an idea.

cyb3rfox commented 3 years ago

That's a bug. The columns were from a different issue. The idea is not to store technical int but rather links to article you come across while investigating. It's rathe runstructured storage. Real technical intel is in the other tabs or whatever intel storage you use (misp/opencti...)