Description
Sort related cases by related artifacts count
Request Type
Feature Request
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | Debian |
| TheHive version / git hash | 3.0.1 |
| Package Type | DEB |
Problem Description
Currently, all related cases are sorted by creation date. It would be helpful to be able to sort this list by related artifacts amount.
For example, a phishing email case can be related to tens of other cases simply because of an email address. But among all those related cases, there is only one with same attachment (i.e. same filename and hash). Having this case on top of the list would save time and potentially reduce human errors.
It could also improved by taking in account that a related artifact is flagged as an IOC, either by giving more "weight" to the artifact when counting them or simply by adding a third sort based taking in account only the fact that the artifact is an IOC or not.
Having a dropdown list to select the kind of sort to be applied would be great.