dfir-iris / iris-web

Collaborative Incident Response platform

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[FR] Use names instead of IDs in entities (for API)

barn4k opened this issue · comments

Is your feature request related to a problem? Please describe.
If I want to create new alert/case, then I should specify severity, status, IOC, classification, TLP by its ID. Thay may work in single environment setup, but create a mess in multi-environment setups (e.g. when we have different IRIS for dev and prod stages), because for this to work in prod, we should make some sync script, that will populate the new entities in the same order, as it was configured in dev. Otherwise, the IDs of objects won't match. That mostly needed for classification and IOC blocks.

Describe the solution you'd like
Use Name (e.g. for TLP: amber (id:2), green (id:3) and so on) value in payloads and leave the id's for DB. That will also create more readable payloads for API (try to find out what that all IDs means without the full list under the hand)

Additional context
I suppose the names' part is already implemented, there is one check needed - make sure the name is unique (or just find the first match). Using the names for entities (expect case id and alert id) will allow us to be more flexible and do not rely on the id mappings.