dfir-iris / iris-web

Collaborative Incident Response platform
GNU Lesser General Public License v3.0
1.08k stars 184 forks source link

[FR] Make comments on tasks more obvious #551

Open jrunu opened 3 months ago

jrunu commented 3 months ago

We're trying out IRIS and are modeling/testing processes. I think its important to note that we're looking into handling SOC "standard" incidences and less major externally driven ones.

Is your feature request related to a problem? Please describe. Currently comments on tasks are not obvious, unless you open a specific task. In our current modeling we think that tasks are often finished without a comment. Comments would be made if something out of the ordinary or noteworthy happened. In the tasks overview (/Case/tasks) these are not visible, you would have to click each task to figure it out

Describe the solution you'd like We're uncertain what would be a good solution and are interested in other peoples experiences. Considering #550, I think it would be good if the task representation in the timeline has the speech bubble with a number indicating comments on that task. If I'd make myself familiar with a case I would look first into the timeline.

Describe alternatives you've considered An additional column in the task view, with the comment count. Or an icon indicating the existence of comments.

Maybe the comments on alerts are the wrong place all together, and it should be an entry directly to the timeline? (Consider #294 for streamlining this).