Idea: include DFIQ question in flowintel-CM

[adulau]

• https://github.com/google/dfiq
• https://dfiq.org/ are the questions task? or a question can generate one more tasks?

[cvandeplas]

first feelings:

• looking from it purely from questions perspectives might be counter productive: resulting in many irrelevant tasks
• scenarios could be a way to "load" questions / tasks. But considering the (current) low amount of scenario's, and the need for flexibility, a question should be loadable ad-hoc
• one question can contain multiple approaches. So I would consider a question as task and approach as a kind of sub-task.

[tomchop]

A bit late to the party here! We've come up with a DFIQ 1.1 schema version, that simplifies the model a lot (merging Approaches into Questions, making a bunch of stuff optional). We'll release the changelog sometime next week and update the schema website soon. What @cvandeplas said remains true though.

I don't really know how you plan to use Questions in flowintel, but I'd be super curious to help iron out a plan for using DFIQ there. From what I'm guessing, questions here would be more akin to tasks, and approaches are ways to answer that question (or complete the task). Mind you, questions (in the DFIQ sense) are "templates" for tasks; the model doesn't account for answers / resolution of those tasks.

Approaches now contain steps, which are like 1. collect logs 2. process logs 3. run this query on logs. You can have a look at what the new model (with updated schemas) looks like here: https://github.com/tomchop/dfiq/tree/dfiq1.1