[backend] Remove Tasks and Notes from investigation knowledge(#issue/…

…4911)
OpenCTI-Platform · Nov 17, 2023 · 6ae667e · 6ae667e
1 parent 1259a6f
commit 6ae667e
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 3 deletions.
diff --git a/opencti-platform/opencti-graphql/src/domain/container.js b/opencti-platform/opencti-graphql/src/domain/container.js
@@ -2,7 +2,13 @@ import * as R from 'ramda';
 import { v4 as uuidv4 } from 'uuid';
 import { RELATION_OBJECT } from '../schema/stixRefRelationship';
 import { listAllThings, listThings } from '../database/middleware';
-import { internalFindByIds, listAllRelations, listEntities, storeLoadById } from '../database/middleware-loader';
+import {
+  internalFindByIds,
+  internalLoadById,
+  listAllRelations,
+  listEntities,
+  storeLoadById
+} from '../database/middleware-loader';
 import {
   ABSTRACT_BASIC_RELATIONSHIP,
   ABSTRACT_STIX_REF_RELATIONSHIP,
@@ -143,9 +149,21 @@ export const containersObjectsOfObject = async (context, user, { id, types, filt
   return buildPagination(0, null, resolvedObjects.map((r) => ({ node: r })), resolvedObjects.length);
 };
 
+export const filterUnwantedEntitiesOut = async ({ context, user, ids }) => {
+  const filteredOutInvestigatedIds = [];
+  ids.forEach((id) => {
+    const entity = internalLoadById(context, user, id);
+    if (!['Task', 'Note'].includes(entity.entity_type)) {
+      filteredOutInvestigatedIds.push(entity.id);
+    }
+  });
+  return filteredOutInvestigatedIds;
+};
+
 export const knowledgeAddFromInvestigation = async (context, user, { containerId, workspaceId }) => {
   const investigation = await findInvestigationById(context, user, workspaceId);
-  const toIds = investigation.investigated_entities_ids.filter((id) => id !== containerId);
+  const ids = investigation.investigated_entities_ids.filter((id) => id !== containerId);
+  const toIds = await filterUnwantedEntitiesOut({ context, user, ids });
   const containerInput = { toIds, relationship_type: 'object' };
   return await stixCoreObjectAddRelations(context, user, containerId, containerInput);
 };
diff --git a/opencti-platform/opencti-graphql/src/modules/workspace/investigation-domain.ts b/opencti-platform/opencti-graphql/src/modules/workspace/investigation-domain.ts
@@ -14,6 +14,7 @@ import type { BasicStoreEntity, StoreEntity, StoreEntityReport } from '../../typ
 import { nowTime } from '../../utils/format';
 import { READ_STIX_INDICES } from '../../database/utils';
 import { getParentTypes } from '../../schema/schemaUtils';
+import { filterUnwantedEntitiesOut } from '../../domain/container';
 
 const buildStixReportForExport = (workspace: BasicStoreEntityWorkspace, investigatedEntities: StoreEntity[]): StixObject => {
   const id = generateStandardId(ENTITY_TYPE_CONTAINER_REPORT, { name: workspace.name, published: workspace.created_at }) as StixId;
@@ -44,6 +45,8 @@ export const toStixReportBundle = async (context: AuthContext, user: AuthUser, w
 export const investigationAddFromContainer = async (context: AuthContext, user: AuthUser, containerId: string) => {
   const container = await internalLoadById<BasicStoreEntity>(context, user, containerId);
   const investigationToStartCanonicalName = `[${container.entity_type}] "${container.name}" (${nowTime()})`;
-  const investigationInput = { type: 'investigation', name: investigationToStartCanonicalName, investigated_entities_ids: container.object };
+  const filteredOutInvestigatedIds = await filterUnwantedEntitiesOut({ context, user, ids: container.object });
+
+  const investigationInput = { type: 'investigation', name: investigationToStartCanonicalName, investigated_entities_ids: filteredOutInvestigatedIds };
   return addWorkspace(context, user, investigationInput);
 };