Promote or demote Intrusion sets and campaigns

[sudesh0sudesh]

Hello Team,

Can we have a button for intrusion sets and campaigns so that the users can promote a campaign to an intrusion set and demote intrusion set to a campaign if they think it is necessary?

Current Work Around.

Currently, it is more tedious as they have to create a campaign and attach it to the report or multiple reports and then delete the intrusion set or vice versa.

[nino-filigran]

@sudesh0sudesh could you please elaborate on this and more specifically on:

• how often does that occur that an intrusion set is created as a campaign and vice versa?
• why does it occur?

For future reference we already have a ticket opened about this: #3571
For now, this is something we might plan to do, but on a limited set of entities (threat actor <-> intrusion set & malware <-> tool, hence the question to understand the real issue behind this request).

[sudesh0sudesh]

It is quite common for most connectors are being coded to create intrusion sets instead of campaigns. A campaign can be identified when there is no specific attribution to a threat actor or other Intrusion Set, and it is a one of and can also be attributed Intrusion Sets of activity that occur over a period of time against a specific set of targets. Most connectors create Intrusion Sets for both Campaigns and Intrusion Sets.