Implement user account observable #957
Conversation
| https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_azo70vgj1vm2 | ||
|
|
||
| Args: | ||
| value: The value of the observable. This is the username of the account. |
There was a problem hiding this comment.
equivalent to which field below? I'm assuming it's repeated in one of the STIX fields? Could we also add a check to ensure that this is the case?
There was a problem hiding this comment.
Value should correspond to account_login by default. How should we handle this? Remove account_login attribute and only rely on value? Duplicate value with account_login?
There was a problem hiding this comment.
The problem I see is that values are unique among observables (we should change this to do value / type, like we do for entities). But still, value would probably have to be a concatenation of one or more fields that are more or less expected to be unique...
Otherwise, maybe having a check that both account_login and value are identical would be enough (if we use a property, we'll loose the ability to search by account_login)
There was a problem hiding this comment.
Updated documentation in 36144ea
Then we will need to implement validators for Observables
This PR implements user account observabled based on STIX definition.