- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
12-29-2020 02:05 PM
When adding IOC's to XDR, adding a comment is a useful way to keep track of where the IOC originated from. When an alert is triggered from that IOC, the analyst can review the IOC rule and read the comment for context.
When 'bulk' uploading, using a file for example, there is no comment field. Is it possible to add the ability to make a comment for all entries made during a bulk upload?
Thanks.
12-29-2020 02:24 PM
Hi @AlCurran,
That is a great suggestion, indeed.
For an immediate solution, you can add a comment after performing the bulk upload by selecting the checkbox next to the target IOCs, right-clicking, and then selecting "edit selected." The comment field will be editable from there.
To make the selection easier, you can filter by modification date to find the IOCs created only when uploaded.
As for submitting a feature request to submit a comment at upload, I recommend submitting that to your Account team directly as I do not believe that they monitor this discussion board.
12-29-2020 02:24 PM
Hi @AlCurran,
That is a great suggestion, indeed.
For an immediate solution, you can add a comment after performing the bulk upload by selecting the checkbox next to the target IOCs, right-clicking, and then selecting "edit selected." The comment field will be editable from there.
To make the selection easier, you can filter by modification date to find the IOCs created only when uploaded.
As for submitting a feature request to submit a comment at upload, I recommend submitting that to your Account team directly as I do not believe that they monitor this discussion board.
12-29-2020 03:48 PM
Great work around, thanks!
Yeah I’ve suggested it via our account team but haven’t heard back. Just wanted to know if this was something others would be interested in. It’s a small addition but would really help our manual IOC process.
Thanks for your reply!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!