Case form - Search indicator

When a user add a new indicator there should be an autocomplete system, if not we may duplicate indicators already added to the database.

Update: Just realized there is an option “Allow duplicate indicator”, is there a positive to duplicate indicator ?

The reason is simple.

  • Tracking and audit purpose because we are crowdsourced threat intelligence.
  • We like to know if there is a verdict difference from different reporter, example site was initially white-listed but later reported by community it should be blacklist.

Ok, understood :wink: Thanks