Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[backend] Improve stix loader and stream relation resolution #4154

Merged
merged 3 commits into from
Aug 24, 2023

Conversation

richard-julien
Copy link
Member

There is conditions where an auto sanity mode think that the relation should be deleted.
Its due to our process that doesnt not use system user to resolve to be sure about the situation.
Also improve the stream to not publish the relation if one of the from/to is not accessible.

@richard-julien richard-julien added enterprise edition use to identify feature part of the Enterprise Edition licence filigran team use to identify PR from the Filigran team and removed enterprise edition use to identify feature part of the Enterprise Edition licence labels Aug 24, 2023
@richard-julien richard-julien linked an issue Aug 24, 2023 that may be closed by this pull request
const toId = stixData.target_ref ?? stixData.where_sighted_refs[0];
const hasFrom = missingMap.has(fromId) || cache.has(fromId);
const hasTo = missingMap.has(toId) || cache.has(toId);
if (!hasFrom || !hasTo) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sur this is exactly what we want
If there are in a platform

  • a sector : marking RED
  • a sector : marking GREEN
  • a relationship between this two sectors : marking GREEN
  • user A : marking GREEN

If user A modify the relationship, the modification is not displayed in the stream

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Its exactly what is expected. If both part of the relation is not accessible the relation must not be published.

@@ -471,7 +472,7 @@ const loadElementsWithDependencies = async (context, user, elements, opts = {})
const message = `From ${element.fromId} is ${validFrom}, To ${element.toId} is ${validTo}`;
logApp.warn(`Auto delete of invalid relation ${element.id}. ${message}`);
// Auto deletion of the invalid relation
await elDeleteElements(context, SYSTEM_USER, [element], storeLoadByIdWithRefs);
// await elDeleteElements(context, SYSTEM_USER, [element], storeLoadByIdWithRefs);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why removing this ?
There are some side effects ?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just forgot to remove the comment after some testing

@SamuelHassine SamuelHassine merged commit 3ba9990 into master Aug 24, 2023
6 checks passed
@SamuelHassine SamuelHassine deleted the issue/4087 branch August 24, 2023 13:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
filigran team use to identify PR from the Filigran team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Removing Sharing Organization removes relationships
3 participants