Thehive: Cases are too easy to delete

[ecapuano]

Request Type

Feature Request

Work Environment

| Question | Answer
|---------------------------|--------------------
| TheHive version / git hash | 3.4.0-1

Problem Description

Running TheHive within our Network Defense Range, we expose the tool to many new analysts who are unfamiliar with it... A trend I have noticed across hundreds of new users, is the accidental deletion of a case when a task deletion was intended. Long ago I made this same mistake myself during a real world incident which sucked.

My feedback is simply to say that it is too easy to delete a case as it's not always immediately obvious the scope that is covered by a case-wide "Remove" button that is visible while looking at a task.

And yes, before it's mentioned in the thread, I am aware of the "Are you sure" dialogue...

But experience has proven that time and time again, analysts are mistaking this "Remove" function to be limited to the scope of the tab they are viewing (tasks, etc).

Steps to Reproduce

N/A

Possible Solutions

Perhaps move the "Remove" button from where it currently is to the Case Details page so that you can only access it when deliberately examining the case as a whole.

Another option, change the text to specify what is being removed... ie. "Remove" -> "Remove Case"... but I still think the first option might be better...

Discuss?

Complementary information

Covered above.

[veeral-patel]

@ecapuano Hey Eric. Here are some ideas:

1. Soft delete cases. This way, if a user deletes a case, an admin would be able to restore it within, say 30 days, of deletion.

2. Require user to enter some text to delete a case, like deleting a repo on GitHub:

1. Restrict who can delete a case. Maybe only an admin or the case's creator can delete a case?

2. Provide an undo notification for 15-20 seconds after deleting a case.

1. You can't delete a case, but only schedule it to be deleted. This means the case will be deleted after say 24 hours. In the meantime, you can un-schedule the case from being deleted.

2. Replace "deleting cases" with "archiving cases". You cannot delete a case, only archive it. Archived cases don't appear in searches and require a separate page to look at.

[nadouani]

Hello @ecapuano the issue is probably somewhere else, since this feature is available to users with admin role.

Are all your users administrators? Users with just write role can do almost everything except removing data.

[ecapuano]

Yes perhaps all of the users are admin because this is a training environment, but I also admit that I have done this myself inside of my production instance at 4am after a 12 hour IR....

I honestly feel some UI improvements could me made to reduce the risk, as RBAC still permits admins to make this mistake.

I like a lot of @veeral-patel's suggestions, specifically 1, 2 & 6.

[joaociocca]

Dunno how this is coming along, but I just had an analyst ask me about archiving cases and found this discussion.
Personally, I don't see a reason for it - but I'm not a daily user, they are. Any news on this?

[ecapuano]

This is still a recurring problem... I expose TheHive to hundreds of new users per year... and I am telling you guys, this happens far more often than it should. It's happened twice today to a couple new teams.

[ecapuano]

Having to include warnings as a regular part of our trainings