dfir-iris / iris-web

Collaborative Incident Response platform

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[FR] IOC/asset quick add from 'Add Timeline Event'

hunt3vil opened this issue · comments

Please ensure your feature request is not already on the roadmap or associated with an issue. This can be checked here.

Is your feature request related to a problem? Please describe.
I spend most of my IRIS time in the timeline view, adding events/findings as I identify them. Currently if I identify a new network connection (for example) I have to 1) jump out of the timeline view 2) got to the IOC tab and add the IP/domain as an IOC 3) go to the asset tab and add the asset if not already there 4) go to timeline view and create the event.

Describe the solution you'd like
I would love to have the ability to create IOCs/assets from the 'Add event' modal, without losing any data that I have already entered. I think a quick add shortcut button that launches the same IOC/asset modal on top of the 'add event' modal without losing the data already entered in the timeline event would do the trick.

Describe alternatives you've considered
The alternative is to switch contexts between the asset/IOCs/timeline which is a lot of clicks.

Additional context
Add any other context or screenshots about the feature request here.