Thehive: bulk merge alerts into case lose description's alert

[torsolaso]

Request Type

Bug

Work Environment

| Question | Answer
|---------------------------|--------------------
| OS version (server) | Ubuntu,
| TheHive version / git hash | 3.3.0-RC6

Problem Description

Hi,

we deteted that when you select various alerts and merge them into a new case you lose all the descriptions. This would not be a problem if you could continue making the preview but how it is working now you can't access to alert description neither in the case nor in the alert

Steps to Reproduce

1. select multiple alerts
2. Merge in a case
3. Go to Case description and see how it is empty
4. Try to return to alert preview and observe how you can't access to alert description

[nadouani]

This is in fact a bad user experience. Thanks for catching it.

[nadouani]

That said, the issue with merging the descriptions is that, if you have 100 alerts with the same or big descriptions, it will be unreadable.

We probably need to allow viewing the already imported alerts, in a readonly manner.

[ag-michael]

@nadouani Maybe if there is an 'Alerts' section (much like 'tasks' and 'observables' section) for each case where you can scroll through and expand to view alerts, that might solve some this? If so, when importing alerts, I'd like the option to select whether or not the alert description will be set as the case description , if selected only the latest alert's description is used.

[crackytsi]

I'm also a little unhappy that importing an alert to a case modifies the Case description by concatenating all descriptions.
For my opinion it would be better to be able to just view the imported alerts and do not update the description of the case at all. You can easily modify it by some text, that represents the full case not just the combination of all indivudual alerts ;)

[veeral-patel]

@ag-michael I think this is the right approach!

[nadouani]

The solution we have opted for is to allow users to preview the alerts related to a case, without putting the descriptions or every alert into the cases description, because if you merge 100 alerts into the same case, it will result on unusable case description