Changing incident handler when an incident is opened through the API

[vacmf]

This is similar to #92 but slightly different.

When certain type of events/incidents are automatically fed into FIR through the API, they will look all opened by the same API user. This is correct but as we don't have other fields to distinguish between "opener" and "handler", it becomes hard to understand who worked on what.
It's fine to sort it out by looking at the comments but it is hard to have an overview from the dashboard, or when using the newly introduced "opened_by" search field.

The best would be to have 2 fields: "opener" and "handler", but if this adds extra complexity as stated in #92 , as a workaround how about defining one or more users that once they open a case they get replaced by the first one who saves something on that case?

Just an idea. I'm not happy about such a solution but it might be a functional workaround.

[tomchop]

What about displaying the "last user to comment" or the "most frequent commenter" of every incident?

[benjimons]

I too think this would be useful. We are using the actor field and populating all our incident responder into that label field. The flip side is when we delete a user we have to change the label group to one we made called 'old' as to not screw table relationships up