Sort related cases by related artifacts amount

[srilumpa]

Sort related cases by related artifacts count

Request Type

Feature Request

Work Environment

Question	Answer
OS version (server)	Debian
TheHive version / git hash	3.0.1
Package Type	DEB

Problem Description

Currently, all related cases are sorted by creation date. It would be helpful to be able to sort this list by related artifacts amount.

For example, a phishing email case can be related to tens of other cases simply because of an email address. But among all those related cases, there is only one with same attachment (i.e. same filename and hash). Having this case on top of the list would save time and potentially reduce human errors.

It could also improved by taking in account that a related artifact is flagged as an IOC, either by giving more "weight" to the artifact when counting them or simply by adding a third sort based taking in account only the fact that the artifact is an IOC or not.

Having a dropdown list to select the kind of sort to be applied would be great.

[nadouani]

Are you talking about "Related cases" of a Case or of an Alert.

What page are you referring to?

[srilumpa]

I am talking about "related cases" of a case. The page is the "Related Cases" tab when opening a case details page.

[nadouani]

OK, so adding the sort capabilities to that list will save the issue