Feature Request: Ability to add a 'Comment' when Bulk Uploading IOC Rules in XDR

[AlCurran]

When adding IOC's to XDR, adding a comment is a useful way to keep track of where the IOC originated from. When an alert is triggered from that IOC, the analyst can review the IOC rule and read the comment for context. 

When 'bulk' uploading, using a file for example, there is no comment field. Is it possible to add the ability to make a comment for all entries made during a bulk upload?

Thanks. 

[gjenkins · Accepted solution]

Hi @AlCurran, 

That is a great suggestion, indeed.

For an immediate solution, you can add a comment after performing the bulk upload by selecting the checkbox next to the target IOCs, right-clicking, and then selecting "edit selected." The comment field will be editable from there.

 

To make the selection easier, you can filter by modification date to find the IOCs created only when uploaded.

 

As for submitting a feature request to submit a comment at upload, I recommend submitting that to your Account team directly as I do not believe that they monitor this discussion board.

[AlCurran]

Great work around, thanks! 

Yeah I’ve suggested it via our account team but haven’t heard back. Just wanted to know if this was something others would be interested in. It’s a small addition but would really help our manual IOC process.

Thanks for your reply!