Displaying the comment added when dismissing an event

[ar3diu]

So in my environment I enforced the addition of a comment when dismissing an event. But where would I see this comment once an event has been dismissed?

Would it be a good idea to display this comment on the event's overview page or on the bottom bar next to the Dismissed tag...?
An audit log may also need to be logged for each Dismiss action.

[n3tsurge]

In the 2022.07.00 release it will show up in the Event Drawer when you click the View Event (magnifying glass) and will support many comments so analysts can talk back and forth or put copious notes on a single event. Brian Carroll

…

________________________________ From: Andrei R ***@***.***> Sent: Wednesday, June 22, 2022 2:51:38 AM To: reflexsoar/reflex-api ***@***.***> Cc: Subscribed ***@***.***> Subject: [reflexsoar/reflex-api] Displaying the comment added when dismissing an event (Discussion #205) So in my environment I enforced the addition of a comment when dismissing an event. But where would I see this comment once an event has been dismissed? [image]<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fuser-images.githubusercontent.com%2F61625853%2F174962640-04d50940-7867-4d22-b910-76309e3fa1fc.png&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7Ce2a6b909a6934843ee9908da541ba886%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637914775020231762%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=9IVsYsEnEGRrYfVLJgneIcgJQriHio5P9mFCThQldpo%3D&reserved=0> Would it be a good idea to display this comment on the event's overview page or at the bottom bar next to the Dismissed tag...? An audit log may also need to be logged for each Dismiss action. — Reply to this email directly, view it on GitHub<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Freflexsoar%2Freflex-api%2Fdiscussions%2F205&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7Ce2a6b909a6934843ee9908da541ba886%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637914775020231762%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=tEGP5q0OHRd9ug1q1NqINoTVsKZR9%2FkxxRLbMCYLrJs%3D&reserved=0>, or unsubscribe<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAMAOVOFVVQQSVGBK56GRLTVQKZXVANCNFSM5ZPB4DJA&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7Ce2a6b909a6934843ee9908da541ba886%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637914775020231762%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=TndgNk%2FKsoSQTvs8Gjeg83df6PwseA5BztVe%2BT6UVFg%3D&reserved=0>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[ar3diu]

Cool. Thanks for sharing the info! 🙏

[ar3diu]

Hey @n3tsurge , on the same topic: I was looking to create a Dashboard in Kibana with ReflexSOAR Event Information like title, status and dismiss reason. But I couldn't find any information about the dismiss reason in the raw event log written in Elasticsearch. Any suggestions? 🤔

[n3tsurge]

Its the field named dismiss_reason and dismiss_comment in the reflex-events index. It also shows up on the Dashboard in Reflex itself Brian Carroll

…

________________________________ From: Andrei R ***@***.***> Sent: Thursday, July 7, 2022 6:24:28 AM To: reflexsoar/reflex-api ***@***.***> Cc: Brian Carroll ***@***.***>; Mention ***@***.***> Subject: Re: [reflexsoar/reflex-api] Displaying the comment added when dismissing an event (Discussion #205) Hey @n3tsurge<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fn3tsurge&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7C32c3147bd0564368d97e08da6002e06c%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637927862736536672%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=kHATdxX4EVL1TXI0n0E1H9agEr3F1kKh%2FplYudsFvfc%3D&reserved=0> , on the same topic: I was looking to create a Dashboard in Kibana with ReflexSOAR Event Information like title, status and dismiss reason. But I couldn't find any information about the dismiss reason in the raw event log. Any suggestions? 🤔 — Reply to this email directly, view it on GitHub<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Freflexsoar%2Freflex-api%2Fdiscussions%2F205%23discussioncomment-3099269&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7C32c3147bd0564368d97e08da6002e06c%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637927862736536672%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=fHvd%2BO2pVdB01H47W7YM1OjwQ4kpEeIk%2BfiDddLXRQA%3D&reserved=0>, or unsubscribe<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAMAOVKUXZK74HBWUWZBD7TVS2V5ZANCNFSM5ZPB4DJA&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7C32c3147bd0564368d97e08da6002e06c%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637927862736536672%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=TeJ9Kpux9cvK9xPuB0xaZgIEHrbYxhR92o4M%2FvQF0mY%3D&reserved=0>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[ar3diu]

Found the dismiss_reason field, but it contains only ID-type values: c16f5859-4bc5-4661-b7e0-9931c63e51f5

[n3tsurge]

Yeah you have to correlate it back to the reflex-close-reasons index. Which means not dashboardable on the elastic side We do this because people can rename closed reasons and add custom ones in a future build Brian Carroll

…

________________________________ From: Andrei R ***@***.***> Sent: Thursday, July 7, 2022 7:54:42 AM To: reflexsoar/reflex-api ***@***.***> Cc: Brian Carroll ***@***.***>; Mention ***@***.***> Subject: Re: [reflexsoar/reflex-api] Displaying the comment added when dismissing an event (Discussion #205) Found the dismiss_reason field, but it contains only ID-type values: c16f5859-4bc5-4661-b7e0-9931c63d3g43 — Reply to this email directly, view it on GitHub<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Freflexsoar%2Freflex-api%2Fdiscussions%2F205%23discussioncomment-3099759&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7C85b8f6978359430ba15108da600f7af8%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637927916865879884%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=MbkDeSoAIV%2BUY1fgdXIVhpNMeFFMVGGpZjgK7%2Fl%2ByPU%3D&reserved=0>, or unsubscribe<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAMAOVME2GRZ6PAAVJU4JX3VS3AQFANCNFSM5ZPB4DJA&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7C85b8f6978359430ba15108da600f7af8%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637927916865879884%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=hkK1CGfdOeyZaaJ14lHKi81g7LzHL2eaFZ1AmqkUftg%3D&reserved=0>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[ar3diu]

Ok... I did not know about that index.
I will look for a method anyway to auto-map this information as it contributes to SOC Metrics/Reports.

Thanks for the answers!

[n3tsurge]

Yeah agreed we at some point plan to have a better reporting in dashboarding functionality inside reflex itself Brian Carroll

…

________________________________ From: Andrei R ***@***.***> Sent: Thursday, July 7, 2022 8:11:50 AM To: reflexsoar/reflex-api ***@***.***> Cc: Brian Carroll ***@***.***>; Mention ***@***.***> Subject: Re: [reflexsoar/reflex-api] Displaying the comment added when dismissing an event (Discussion #205) Ok... I did not think about that index. I will look for a method anyway to auto-map this information as it contributes to SOC Metrics/Reports. — Reply to this email directly, view it on GitHub<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Freflexsoar%2Freflex-api%2Fdiscussions%2F205%23discussioncomment-3099868&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7C8a9f759c8fc24a576dd908da6011dfd8%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637927927158467690%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=n7FHjxWciKEyaZCZSyXlzFtz%2BaaMXjKZhVbS1j95lkw%3D&reserved=0>, or unsubscribe<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAMAOVOFC3HA5NMTCDSYPD3VS3CQNANCNFSM5ZPB4DJA&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7C8a9f759c8fc24a576dd908da6011dfd8%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637927927158467690%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=W7qwjMKJMP%2F0LGueTgSRphiWB9Lcml99DcUO%2FcxOwMA%3D&reserved=0>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[ar3diu]

The current one looks pretty good.
Also as a suggestion, it would be useful if the dashboard items were clickable.

[n3tsurge]

Yeah that's one of the enhancements the thing about the current charting library is a it's very hard to use and do stuff like that so I want to replace the charting library and make it a little bit easier for people to create custom charts and drill downs and that kind of stuff Brian Carroll

…

________________________________ From: Andrei R ***@***.***> Sent: Thursday, July 7, 2022 8:15:24 AM To: reflexsoar/reflex-api ***@***.***> Cc: Brian Carroll ***@***.***>; Mention ***@***.***> Subject: Re: [reflexsoar/reflex-api] Displaying the comment added when dismissing an event (Discussion #205) The current one looks pretty good. Also as a suggestion, it would be useful if the dashboard items were clickable. — Reply to this email directly, view it on GitHub<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Freflexsoar%2Freflex-api%2Fdiscussions%2F205%23discussioncomment-3099890&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7C06fca8c146c64480f13908da60125fc3%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637927929285173570%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=FI2W8TMOYGlT3nL%2BevnUfFJoYAM63lf6e6zDmEr%2F3lQ%3D&reserved=0>, or unsubscribe<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAMAOVNWKVKTWT2CW6TNSC3VS3C5ZANCNFSM5ZPB4DJA&data=05%7C01%7Cbcarroll%40zeroonesecurity.com%7C06fca8c146c64480f13908da60125fc3%7Ca68b09e0c76f40ccb262ae8575779491%7C0%7C0%7C637927929285173570%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=iW0Lz84kzYFwKrNMFOEEFNobvlWo27V%2FrTSE49ClrwQ%3D&reserved=0>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[ar3diu]

Sounds really good! You guys have a lot of experience and knowledge in all SOC-related processes so I'm more than sure you've thought of a lot of cool features.

[n3tsurge]

This whole back and forth made me realize there are two bugs that need fixing that will solve your issue...we are supposed to store just the Reason name not the UUID, we also aren't producing the SOC metrics we should be like time to act, time to dismiss, time to close, etc.

[ar3diu]

Yes, those would certainly be useful.

Happy to at least contribute to identifying bugs if not fixing them! 😬