Commit fec5749f authored by Arne Øslebø's avatar Arne Øslebø
Browse files

Update usecase.md

parent 17dd965b
......@@ -16,6 +16,6 @@ He then expands one of the events and scrolls down till he sees the field "desti
<img src="images/use_case4.png" width=480>
After evaluating the information in MISP, the security analyst concludes that this is a real threat and decides to create a new case in the Hive, the tool for doing incident response. He does this by clicking on the red button "Create new Case" in the Kibana dashboard. A dialog box opens up where he can add details about the case and select source IP addresses that should be added as an observable in Kibana. When he is ready he clicks on "Create Case" and a new tab opens up showing the newly created case in the Hive.
After evaluating the information in MISP, the security analyst concludes that this is a real threat and decides to create a new case in the Hive, the tool for doing incident response. He does this by clicking on the red button "Create new Case" in the Kibana dashboard. A dialog box opens up where he can add details about the case and select the IP addresses that should be added as an observable in the Hive. When he is ready he clicks on "Create Case" and a new tab opens up showing the newly created case in the Hive.
<img src="images/use_case3.png" width=640>
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment