Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[backend] observables values implemented (#8312) #8449

Closed
wants to merge 3 commits into from
Closed

[backend] observables values implemented (#8312) #8449

wants to merge 3 commits into from

Conversation

ValentinBouzinFiligran
Copy link
Member

@ValentinBouzinFiligran ValentinBouzinFiligran commented Sep 23, 2024 •
edited
Loading

Proposed changes

  • observables values key created
  • pattern extraction function created
  • observables values filled on creation
  • observables values filled on pattern edition or indicator edition when empty
  • graphql schema updated to export this new key

Related issues

Related PR

Checklist

  • I consider the submitted work as finished
  • I tested the code for its functionality
  • I wrote test cases for the relevant uses case (coverage and e2e)
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

@ValentinBouzinFiligran ValentinBouzinFiligran added the filigran team use to identify PR from the Filigran team label Sep 23, 2024
@ValentinBouzinFiligran ValentinBouzinFiligran marked this pull request as draft September 23, 2024 07:51
@ValentinBouzinFiligran ValentinBouzinFiligran mentioned this pull request Sep 23, 2024
Closed
5 tasks
@ValentinBouzinFiligran ValentinBouzinFiligran marked this pull request as ready for review October 2, 2024 07:15
@ValentinBouzinFiligran ValentinBouzinFiligran linked an issue Oct 2, 2024 that may be closed by this pull request
Ability to define and implement “Exclusion Lists” - POC #8312
Closed
@ValentinBouzinFiligran ValentinBouzinFiligran removed a link to an issue Oct 2, 2024
Ability to define and implement “Exclusion Lists” - POC #8312
Closed
@codecov Codecov
Copy link

codecov bot commented Oct 2, 2024 •
edited
Loading

Codecov Report

Attention: Patch coverage is 77.77778% with 4 lines in your changes missing coverage. Please review.

Project coverage is 66.14%. Comparing base (01406ab) to head (62958cd).

Files with missing lines Patch % Lines
...-graphql/src/modules/indicator/indicator-domain.ts 76.47% 4 Missing ⚠️
Additional details and impacted files 
@@                Coverage Diff                @@
##           release/6.4.0    #8449      +/-   ##
=================================================
- Coverage          66.14%   66.14%   -0.01%     
=================================================
  Files                597      597              
  Lines              60500    60517      +17     
  Branches            6202     6210       +8     
=================================================
+ Hits               40019    40030      +11     
- Misses             20481    20487       +6

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@ValentinBouzinFiligran ValentinBouzinFiligran changed the base branch from master to release/6.4.0 October 4, 2024 12:22
SouadHadjiat
SouadHadjiat reviewed Oct 11, 2024
View reviewed changes
opencti-platform/opencti-graphql/src/modules/indicator/indicator-domain.ts Outdated
@@ -305,6 +312,18 @@ export const indicatorEditField = async (context: AuthContext, user: AuthUser, i
if (!indicator) {
throw FunctionalError('Cannot edit the field, Indicator cannot be found.');
}

const foundPattern = finalInput.find((item) => item.key === 'pattern');
if (!indicator.x_opencti_observables_values || foundPattern) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could we extract this code block in a separate function? And maybe mutualize it with the same logic we have in addIndicator?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also suggest to move this part after the validation check about valid_until, since if we don't pass this validation check, there is no need for this part.

SouadHadjiat
SouadHadjiat reviewed Oct 11, 2024
View reviewed changes
opencti-platform/opencti-graphql/src/modules/indicator/indicator-domain.ts Outdated
@@ -231,6 +233,10 @@ export const addIndicator = async (context: AuthContext, user: AuthUser, indicat
// find default decay rule (even if decay is not activated, it is used to compute default validFrom and validUntil)
const decayRule = await findDecayRuleForIndicator(context, observableType);
const { validFrom, validUntil, revoked, validPeriod } = await computeValidPeriod(indicator, decayRule.decay_lifetime);
const extractedObservableValues = getObservableValuesFromPattern(formattedPattern);
if (!extractedObservableValues.length) {
throw FunctionalError(`Indicator of type ${indicator.pattern_type} is not correctly formatted.`);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

really ? do we always extract observable values from indicator pattern ? if we don't find observable values, we don't create the indicator ? extraction works only with stix pattern, what about other pattern types ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also I think it would be best to make sure we don't extract multiple times these observable values, like what we do in createObservablesFromIndicator.

@ValentinBouzinFiligran ValentinBouzinFiligran added the multi-repository For contribution that requires PR in several repository label Oct 14, 2024
@ValentinBouzinFiligran ValentinBouzinFiligran mentioned this pull request Oct 14, 2024
Merged
5 tasks
@labo-flg labo-flg force-pushed the release/6.4.0 branch 2 times, most recently from c150d0f to 264e053 Compare October 15, 2024 20:34
@ValentinBouzinFiligran ValentinBouzinFiligran changed the base branch from release/6.4.0 to master October 16, 2024 12:18
@ValentinBouzinFiligran ValentinBouzinFiligran changed the base branch from master to release/6.4.0 October 16, 2024 12:19
@ValentinBouzinFiligran ValentinBouzinFiligran deleted the issue/8312 branch October 16, 2024 13:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@SouadHadjiat SouadHadjiat SouadHadjiat left review comments

Assignees

@ValentinBouzinFiligran ValentinBouzinFiligran

Labels
filigran team use to identify PR from the Filigran team multi-repository For contribution that requires PR in several repository
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@ValentinBouzinFiligran @SouadHadjiat @Kedae