Improve case management

[daryllimyt]

Description

• Currently, state management is in preview mode

Roadmap

• [v0] Basic case management with timeline

Todos

High priority

• Autocomplete
  • Basic persistence feat(ui+engine): Add basic case autocomplete persistence #57
  • Implement user controls to commit and overwrite autocompleted values feat+refactor(ui): Add autocomplete commit confirmation + move some state into the provider #60
  • Adjust this so it only applies autocomplete for Tag and Action, not Context. Context should be populated by data in the workflow
• Update case content inside the sliding side panel
  • Refactor and extend SMAC to include T (Tags) feat(ui+engine): Improve case management [2/N] #66
    • Action -> Multi-select of short, well-defined todos. != runbook -- UI: [v0] single select [v1] multi select feat(ui+engine): Improve case management [2/N] #66
    • Context -> metadata regarding the payload, e.g. user email, geo IP, etc -- UI: Flat KV feat(ui+engine): Improve case management [2/N] #66
    • Suppressions -> condition: result -- UI: Flat KV feat(ui+engine): Improve case management [1/N] #64
    • Tags -> Categories associated with the payload, e.g. MITRE Attack TTPs -- UI: Flat KV feat(ui+engine): Improve case management [1/N] #64
  • Remove runbooks
  • Remove metrics
• Deduplication
  • Include identifiers
    • this needs to be designed in a way that can easily leverage AI features
  • [v0] use SHA256 hashes to exact matches
• Basic controls (baseline usability)
  • Fine-grained case controls
    • Changing and synchronizing priority feat(ui): Add change case priority controls #80
    • Changing and synchronizing status feat: Implement change case status controls #78
    • [v0] Clearing cases from the case table - scope this to just mark as closed, remains in table
      • Current issue - trying to check this box actually triggers the onClick handler as well. fix(ui): Prevent checkbox from propagating click event #81
  • Viewing history/archives - this is more if cases are actually removed from the table. For now, can just filter the table to not include closed cases.
• Timeline + audit trail
  • [v0] Basic trail feat(ui+engine): Implement case activity timeline #89
    • When was the case opened
    • When did any case fields change
    • When was the case closed (no special case for this just use change status to closed)
• Tagging
  • Add AI Flair Add flair flag for tags #73
  • #91
  • [v0.5] Case-by-case tag addition; Do something with the checkboxes?; Users can add tags post-case creation
  • [v1] Users can create tags in case nodes and define their own tags for a workflow, has control over what tags autocomplete uses.

Low priority

• Advanced controls
  • Case nodes that can update case state (see torq)
  • Two way sync with external ticketing system
• Metrics
  • Remove bar charts
  • Summary statistics
  • Time series