Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FR] Allow analysts to mark an untouched task to not be deleted when closing the case #1072

Closed
dealtwith opened this issue Dec 13, 2021 · 1 comment

Comments

@dealtwith
Copy link

dealtwith commented Dec 13, 2021

Feature description
Some kind of dontDelete flag or a separate status other than Waiting, inProgress, or Completed -- something that can be assigned to a task so that it won't be deleted if it's untouched when closing a case.

Describe the solution you'd like
^

Additional context
I understand there's a discussion in #1755 about this. To quote @nadouani:

TheHive deletes tasks that have not been started at all, when closing a case. There is no valid reason to keep those tasks.

But having the ability to flag a Waiting task to not get deleted allows Incident Responders to also include a task that are considered to be "Post-incident activities" inside the case. Some examples of tasks that can be categorized as a "Post-incident activities" are "Create a follow-up report" and "Hold a lessons learned meeting" (NIST, SP 800-61 Rev. 2).

These tasks may be considered as "part-of-the-case", but not necessarily something that should be done WHILE case investigation is ongoing.

@dealtwith
Copy link
Author

Wrong repo. Closing this. Go to TheHive-Project/TheHive#2287

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant