Skip to content

[BUG] Alert escalation using a case template doesn't assign classification #1055

@xBounceIT

Description

@xBounceIT

Describe the bug
Im trying to merge an alert into a new case using a pre-defined case template. The template is barebone with only this definition:

{
    "name": "Template Suspicious User Activity",
    "display_name": "Template Suspicious user Activity",
    "description": "",
    "author": "",
    "title_prefix": "",
    "summary": "",
    "tags": [],
    "tasks": [],
    "note_directories": [],
    "classification": "suspicious-user-activity"
}

The classification is a custom one. My goal is to have a case with that classification assigned, mainly to be used via API.

This doesn't work, as the case get's created without classification.

To Reproduce
Steps to reproduce the behavior:

  1. Create a custom case classification
  2. Create a custom case template which assigns that classification
  3. From an already created alert, merge it into a new case using the custom template
  4. Observe the missing classification in the newly created case
  5. Try to create a new case from scratch with the custom template
  6. Observe the classification correctly assigned

Expected behavior
Template's classification to be assigned to escalated alerts

Screenshots
Escalated alert:
Image

Case created from scratch:

Image

Desktop (please complete the following information):

  • OS: Windows 11 25H2
  • Browser Firefox 148

Smartphone (please complete the following information):
N/A

Additional context
IRIS v2.4.27

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions