Feature Request: Post-Processing enrichment on demand

[C-Oliver]

As an analyst I want to be able to extract all IOCs related to a submission in the Post-Processing webhook without making additional API calls. Tags related to a submission should be present on the webhook call, this feature would be enabled using a flag in the post processing, and if enabled, the action would enrich the submission results with all the IOCs for that submission.

[cccs-douglass]

Would just including the tags in the call be enough or are you looking for other things?

[C-Oliver]

Tags will be sufficient, but probably would be beneficial to send the full results index (results object) to the webhook to future proof the feature in case we need more data from the index?

[cccs-sgaron]

Tags will be sufficient, but probably would be beneficial to send the full results index (results object) to the webhook to future proof the feature in case we need more data from the index?

This might be very costly... we should restrain to what we really need. In the end, I get that it is not ideal to only receive partial submission result and have to query back but adding to much data for the dispatcher to pull will slow it down. Adding these extra output to the webhooks should also be optional and be ask when defining the webhook.

[C-Oliver]

Agreed, to be fair the tags are quite comprehensive, so they should be okay for now, we can always add an enrichment step to query to API if we need too.

[cccs-douglass]

I asked because tags alone would be quite cheap to add for new (rather than cache hit) calls to the webhook since the dispatcher already collects them.

[C-Oliver]

Sounds good, with some guidance, pointers where to start I can work on this feature and submit it back?