Default values for the attributes of Notes customizable for each of the other entities #9694
Labels
feature
use for describing a new feature to develop
needs triage
use to identify issue needing triage from Filigran Product team
Use case
We are creating workflows under step-by-step procedures and it would be really useful if the Note entity was customizable for the other entities.
From the Customization section, default values can be included to the attributes of the object and, it is proposed that these values would be different according to the relationship of the Note with another object.
In our case, the default value for the Content of the note created for a Threat Actor would not be the same as the default value for an Incident.
Our objective is to use templates so that analysts do not forget information to include and it would help a lot if this could be modified.
Current Workaround
Currently, from OpenCTI the only thing that can be achieved is to indicate a single default value for each attribute for the Note object, so it does not matter in which other entity the note is created. The default value of its attributes would be the same, making no distinction for the object in which the note was created.
Proposed Solution
Two approaches are proposed:
The first is to add a drop-down menu in the Attributes section of the Note object within Settings > Customization. This drop-down menu would contain the other objects of the platform and the configuration of both the mandatory and default values of the Note could be saved according to the entity to which it is going to be related.
It is proposed that in the Settings > Customization menu there should be a Templates section for which all the attributes of a note can be configured and, when a note is to be added to an entity, it can be associated to this template. With this solution it would be possible to create a single configuration that could be valid for all the objects on the platform.
Environment
OS: docker.
OpenCTI version: 6.4.8
OpenCTI client: frontend
If the feature request is approved, would you be willing to submit a PR?
No, but I am available for testing or examples if needed.
The text was updated successfully, but these errors were encountered: