For already safe-/badlisted tags/signatures, adjust the contextual menu

[kam193]

Is your feature request related to a problem? Please describe.
Currently, when you see a safe- or badlisted tag/signature, the contextual menu still offers you to add it to the list. You can not easily remove them from the list or see the reason for listing. In addition, I think there is an undefined behavior of badlisting an already safelisted tag etc.

Describe the solution you'd like
For a tag/signature that has already been listed, I'd like to replace both "adding" buttons with a "details" button directing to a view with details in the safe-/badlist, appropriate to where this tag is.

In addition, I'd disallow putting a tag in both lists.

Describe alternatives you've considered

• Just the remove button - it's okay, but still missing the important "why" information, especially for manually marked entries.
• instead of redirecting to a view, opening a popup with marking reason&source, button to remove and link to the full view - this is a solution I'd prefer, but I think it requires more work than just redirecting to an existing view.

Additional context

[cccs-sgaron]

Ok lets discuss the impacts of this...

1. Checking the state of a tag once the menu loads could be done but there would be a significant cost to it. This means that every time the context menu comes up, we have to do two API calls to check the status which will cause a delay in the menu's responsiveness.
2. Having an item in the bad and the safe lists at the same time may seems weird but may be a necessity. As we may have external sources that are auto ingested that disagree about the outcome of an IOC. The outcome in AL tho has to be predictable and I believe the safelist should win.

I'd like others to chime in on this subject as we are still working on making the experience better for those two features.

[kam193]

Okay, let's see:

1. The tag is already marked green or red - do we need any information more to change from "add to safe/badlist" to "show details"? I think it's enough to query the current state once clicked on details; if the cached state was wrong (as I observe, the colors are determined on the scanning time, right?), then the details window should correct it.
2. This is a truly valid point, I was thinking only about manually added tags. I partially agree that safelist should win - I have some doubts if it weren't better to prioritize the manual mark first (what if we have an external safelist source that disagrees with our manual verdict?). But in such a case, I'd suggest that the manual change should disable existing automated suggestions (or just any existing), and this should be clearly visible when you make the change and in the details view of the tag.

I think the edge cases from the second point makes the first - easily accessible detailed view - more important ;) Otherwise, when you see a wrongly marked tag, you need to manually find it in the tags view. It can also be important if you want to quickly understand why something is bad or safe.

[kam193]

Adding a little more context to the issue: I think a link to a related Badlist entry would be very helpful. Recently, I observed several false positives (or just too broad marking, like the whole twitter.com domain) in some badlist sources. The only way to edit / disable such entries is to manually copy the value and find them in the badlist. I would appreciate it if I could just click and go to related entries. It could even be just opening the badlist view with a right query (tag type & value) - this shouldn't require much work, but would automatically handle cases like entries duplicated over sources.