dfir-iris / iris-web

Collaborative Incident Response platform
GNU Lesser General Public License v3.0
1.08k stars 184 forks source link

[FR] It would be cool to have case Templates with the possibility to add Playbook #219

Open pleibling opened 1 year ago

pleibling commented 1 year ago

Please ensure your feature request is not already on the roadmap or associated with an issue. This can be checked here.

Templates are asked for, but not for Playbooks.

Is your feature request related to a problem? Please describe. No, but it helped a lot.

Describe the solution you'd like If there are different Templates for Casetypes, so they can have a specific Playbook for different types (e.g. Playbook for Phishing, Playbook for Webshell and so on).

Maybe there are free Playbooks, they can added directly - otherwise or better additional add own Playbooks e.g.:

Playbook for Malware:

Ektoplasma commented 1 year ago

Hi,

Case templates will populate cases with summary, notes, tasks, and tags. I don't really see how playbooks would add additional information. Can you precise?

pleibling commented 1 year ago

Hi @Ektoplasma, thanks for your fast reply. I saw it in the first time in Catalyst SOAR (https://catalyst-soar.com/features - under Tickettemplates and Playbooks) and play a little with them. I create some samples - if i create a case with the type, the shown me directly specific Informations (To Do, Playbooks, Links and so on) dependent to the Type of the created case.

I hope you can understand what i mean.

Ektoplasma commented 1 year ago

Ah I get it! Yeah why not, let's keep that FR open :)

pleibling commented 1 year ago

Thanks @Ektoplasma, sounds good :).