Actions requirements:

• Users should be able to make bulk actions by quick action on a group or sub-group
• Actions on bulk alerts should have a confirmation dialog box
• Quick actions include:
  Default: Add to case (existing), Close, Acknowledge
  if group contains host (then isolate) (prerreq using endpoint integration)
  If group contains rule (then add exception)
  if group contains process.name (or pid, entity.id, etc.), then endpoint could “terminate process”