Feature Request: (Badlist) Allow setting expiration time on Badlist IOCs about assemblyline HOT 7 CLOSED

This is a feature already available in the system:

from assemblyline.

I'd say longer expiry wins as there is an expectation that the IOC will be there for at least that long.

from assemblyline.

That sounds like what we would need, the ability to be able to set retention time for the external source.
Can we re-open this issue with than goal?

from assemblyline.

Should be patched in the latest version of the service

from assemblyline.

How can I set this on an IOC from an external source/feed?

from assemblyline.

Currently the only way to do this is in /manage/badlist manually. But if you wanted to automatically set an expiration period based on the source, then we'd need to add a configuration on the service side that can set/extend the expiry period of the item when it's added/updated to the list.

from assemblyline.

How would you want to handle competing sources raising the same item to be added to the badlist and they both can control the expiration?

Should the one with the longer expiry win, should the source with more recent updates win?

from assemblyline.