[
https://issues.apache.org/jira/browse/METRON-688?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15850184#comment-15850184
]
Nick Allen commented on METRON-688:
-----------------------------------
May be better to create an additional field like 'reason' or 'context' (or
anything else) where additional context is provided instead of changing the use
of 'comment'. Could still find use for a general, fixed description of the
rule, which is what 'comment' provides.
> Allow Threat Triage Comment Field to Contain Stellar Expressions
> ----------------------------------------------------------------
>
> Key: METRON-688
> URL: https://issues.apache.org/jira/browse/METRON-688
> Project: Metron
> Issue Type: Improvement
> Reporter: Nick Allen
> Assignee: Nick Allen
>
> Allow the Threat Triage comment field to contain a Stellar expression that
> can be executed. This will allow a rule to produce a message with contextual
> information like the specific values that caused the rule to trigger.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
