Promote or demote Intrusion sets and campaigns

[sudesh0sudesh]

Hello Team,

Can we have a button for intrusion sets and campaigns so that the users can promote a campaign to an intrusion set and demote intrusion set to a campaign if they think it is necessary?

Current Work Around.

Currently, it is more tedious as they have to create a campaign and attach it to the report or multiple reports and then delete the intrusion set or vice versa.

[nino-filigran]

@sudesh0sudesh could you please elaborate on this and more specifically on:

• how often does that occur that an intrusion set is created as a campaign and vice versa?
• why does it occur?

For future reference we already have a ticket opened about this: #3571
For now, this is something we might plan to do, but on a limited set of entities (threat actor <-> intrusion set & malware <-> tool, hence the question to understand the real issue behind this request).