Is there a way to create custom use case categories within ES?

[plimon]

Hello,

Is there a way to create custom use case categories within the use case library for ES?
The out-of-the-box categories look fairly rigid:
Abuse, Adversary Tactics, Best Practices, Cloud Security, Compliance, Malware, Vulnerability, etc.

Some SOC users are asking if this is possible without doing crazy XML file changes.

[lakshman239 · Accepted solution]

I believe if you create your custom searches with categories in local/analytic_stories.conf and analyticsstories.conf [ try to mimic same pattern as in default] and supplement with related savedsearches/correlationsearches.conf, the dashboards should be able to use them.

Additionally, you can also send feedback via the app for them to take a note and advise.

[plimon]

Hey Lakshman,

Thanks for the feedback. I was able to create a custom category through editing those two.conf files related to analytic stories. I also requested a future enhancement to app developers.

[lakshman239]

Glad it helped.Pls accept if you are satisfied to close this thread.