diff --git a/doc/usecase.md b/doc/usecase.md index 88f1b341526c5bec2a847a883012ce5e1a66fc4b..c8691728ca761d32d0cd42d2cd302a1987861e70 100644 --- a/doc/usecase.md +++ b/doc/usecase.md @@ -16,6 +16,6 @@ He then expands one of the events and scrolls down till he sees the field "desti <img src="images/use_case4.png" width=480> -After evaluating the information in MISP, the security analyst concludes that this is a real threat and decides to create a new case in the Hive, the tool for doing incident response. He does this by clicking on the red button "Create new Case" in the Kibana dashboard. A dialog box opens up where he can add details about the case and select source IP addresses that should be added as an observable in Kibana. When he is ready he clicks on "Create Case" and a new tab opens up showing the newly created case in the Hive. +After evaluating the information in MISP, the security analyst concludes that this is a real threat and decides to create a new case in the Hive, the tool for doing incident response. He does this by clicking on the red button "Create new Case" in the Kibana dashboard. A dialog box opens up where he can add details about the case and select the IP addresses that should be added as an observable in the Hive. When he is ready he clicks on "Create Case" and a new tab opens up showing the newly created case in the Hive. <img src="images/use_case3.png" width=640>