Custom severity levels for alerts and cases

[woifi]

Request Type

Feature Request

Problem Description

Currently, the severity level of alerts and cases is hardcoded to the values Low, Medium and High. We would love to have these customizable because our current SOC processes support more than those three values (i.e. there is also "Info only" and "Critical").

[Viper896]

+1, We have a P0-P3 scheme and would like the additional support for defining custom severity/priority levels

[frikky]

We also need custom / more severity levels 👍

[infsy]

Same for us !

[francoisihry]

Custom severity 👍
Interested in that feature too.

[francoisihry]

I think allow users to display their own metrics in the cases list and allow them to sort the cases by the metrics would fix the need just fine.

[InTheWoodsAutomation]

Is being able to customize severity levels still being pursued?

[inodee]

Yes, please!

[flyuk]

This would be great!

[zpriddy]

#939 adds Critical severity :)

[nadouani]

4.0.0-RC1 has already added a Critical severity. I don't think an Info severity is meaningful.

Any thoughts?

[crackytsi]

I think introducing critical as 4th severity is very helpfull.
Thanks a lot for that.
But i think we should not have to many severities, for me personally 4 are fully enough.

[hkelley]

I know this issue has been closed but I would still like to be able to customize the labels (four are enough).

Our workflow is this:

• Hive Alerts that cannot be immediately closed (we would really like to require a comment/explanation when closing an alert) become Cases. In our IR scale, these Cases should be graded as "Events" (lowest level, not yet an Incident). We open a case because more investigation is required, but we do not yet call it a true Incident because we don't yet know if any security controls were evaded or any harm was done.
• If the facts warrant, the Event becomes a Low, Medium, or High severity Incident (at which point, the ears of auditors, lawyers, and execs perk up a bit).

I think that being able to make the names/labels match the different organizational vocabularies and cultures is fairly important when talking about incident response.