Flowintel - Flow Your Management

The speaker presents recent upgrades and new features for Flowintel, an open case management platform, as a follow-up to an earlier appearance on the same tool. The walkthrough starts with creating a case from a reusable template that holds standard tasks and subtasks, such as a methodology. Team members are added to the case and assigned to tasks, and notes and completed subtasks are tracked on each task.

The main focus is the link to threat intelligence. Selected text from a task's notes is sent to the MISP modules analyzer, which runs an enrichment module, and the results come back into the case as pending items. The speaker then adds an IP address from those results to the case as an indicator and creates MISP objects from the case notes. A module configuration error and a live-demo problem when saving a note are shown along the way.

The talk ends with connectors, which can push a single object, individual tasks or a full case to one or more MISP instances. Content can then be published so collaborators in the MISP community can use it. The practical takeaway for responders is that case tracking and indicator enrichment can stay in one workflow instead of being copied between tools.