Add a sighted flag for IOCs

[saadkadhi]

Request Type

Feature Request

Work Environment

Question	Answer
TheHive version / git hash	2.13.2

Problem Description

While observables can be flagged as IOCs, this doesn't mean they have been sighted on the network.

Think for example about a malicious sample received by email. When submitted through Cortex to a sandbox which declares it malicious and extracts C2 addresses, an analyst might add those C2s to the observable list and flag them as IOCs then search them on a SIEM. If found, they might add a found tag or any variation of such a word. However, this won't be consistent across cases and may not be efficiently leveraged in Cerana's dynamic dashboards. Moreover, since we intend on improving MISP exports by adding sightings, we need to add a flag that is very clear to activate/deactivate and understand.

Possible Solutions

Add a sighted flag with an associated, easy to understand, icon. The sighted flag can only be selected for observables flagged as IOCs. It doesn't make sense to have it for non-IOC observables.