Observables export

[Fred-certeu]

Please replace every line in curly brackets { like this } with appropriate answers, and remove this line.

Problem to Solve

It is currently unclear how a user can export observables

Current Workaround

{ Please describe how you currently solve or work around this problem, given OpenCTI's limitation. }

Proposed Solution

It should be possible to export sets of observables:

• user initiated export (via the GUI)
• scheduled export (e.g. every day at hh:mm, every week, etc)
• external application initiated export (API ?)

Export format : to be discussed (STIX JSON, CSV, etc)

It should be possible to select fields to be included in the export files:

• type
• value
• score
• confidence level
• expiration date
• creator
• TLP
• associated threat name(s)

It should be possible to combine (and/or) different filters to generate the export sets:

• creation date (before, after)
• expiration date (expired or not)
• TLP (WHITE / GREEN / AMBER / RED)
• associated report
• related threats (e.g. all observables associated to threat actor A, or intrusion set B, or malware C, etc)
• creator
• score (e.g. score > 50, ...)
• confidence

-## Additional Information

{ Any additional information, including logs or screenshots if you have any. }

[SamuelHassine]

Linked to #391

[SamuelHassine]

Observables export will be implemented in the Release 2.1.4, but basic indicators exports has been implemented in the Release 2.1.3.

[Fred-certeu]

Merci, Samuel
We will test this feature.
In 2.1.4, will you implement the different filters that I've suggested?
Also, will there be user initiated + scheduled job + external app initiated ?
In the latest case, typically, we want to be able to have our customer portal offering daily packages of observables - created with specific filters.

[SamuelHassine]

@Fred-certeu, it will be implemented in 2.1.3 for Indicators (with the filters) and in 2.1.4 for Observables.

[I-Iugo]

@SamuelHassine Is the export of observables foreseen in 3.1.0? At first we could export them like the other menus without necessarily having a filter.