Inferred targeting of sectors or regions are called "Direct targeting"

[8hur]

Description

When viewing the victimology of a threat, Continents and sectors are labelled as being directly targeted by the threat even though the data in the platform clearly state that a specific country within that region or a specific organisation belonging to the sector has been targeted.

Environment

Demo platform

Reproducible Steps

1. Navigate to this page (victimology by location of the Chinese strategic threat) https://demo.opencti.io/dashboard/threats/threat_actors/58a92cb7-e22a-4587-8f7b-5026d8a3a961/knowledge/victimology?type=regions&viewMode=list
2. Observe the interface calling a "Direct targeting of this region" for the Americas.
3. Unfold the distinct region, Northern America, and observe the interface calling a "Direct targeting of this region" but this time, also signalling a direct targeting of the USA.
4. Click on the link detailing one of the "Direct targeting of this region" and observe that the link has been made though inference from the targeting of the USA.

Expected Output

• When the targeting of an entity is in inferred through inferences on the victim side (city part of country part of region for example) , mark it as an indirect targeting of the entity.
• When the targeting is inferred through inference on the offensive side (direct targeting of a sector through an incident, part of a campaign, attributed to a threat actor for example), keep the marking as a direct targeting of the entity.

Actual Output

Inferred, indirect targetting is marked as direct targeting.

Additional information

As a side note, the region inference might not be the most productive additions when viewing the victimology of a threat. Most threat end up with a world map mostly coloured even when they have a very precise targetting. For example, it would seem counterproductive to colour the whole of America when all data point to the specific targetting of a single Caribbean country.

[SamuelHassine]

The victimology screen has been fully rewritten and no longer displays "direct targeting".