Skip to content

Commit 23bbb5c

Browse files
delemafdelemaf
authored
[backend] Add specific fintel filters for entities (#15201)
1 parent ba53bae commit 23bbb5c

5 files changed

Lines changed: 183 additions & 46 deletions

File tree

‎opencti-platform/opencti-front/src/private/components/widgets/WidgetCreationPerspective.tsx‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import { LibraryBooksOutlined } from '@mui/icons-material';
66
import React from 'react';
77
import { v4 as uuid } from 'uuid';
88
import { getDefaultWidgetColumns } from '@components/widgets/WidgetListsDefaultColumns';
9+
import useAttributes from '../../../utils/hooks/useAttributes';
910
import { useFormatter } from '../../../components/i18n';
1011
import { indexedVisualizationTypes, WidgetVisualizationTypes } from '../../../utils/widget/widgetUtils';
1112
import { useWidgetConfigContext } from './WidgetConfigContext';
@@ -15,16 +16,33 @@ import Card from '../../../components/common/card/Card';
1516

1617
const WidgetCreationPerspective = () => {
1718
const { t_i18n } = useFormatter();
18-
const { context, config, setStep, setConfigWidget } = useWidgetConfigContext();
19+
const { context, config, setStep, setConfigWidget, fintelEntityType } = useWidgetConfigContext();
1920
const { type, dataSelection } = config.widget;
2021

22+
// Container and domain object have different filters for the perspective selection
23+
const { containerTypes } = useAttributes();
24+
const isContainer = containerTypes.includes(fintelEntityType ?? '');
25+
2126
const handleSelectPerspective = (perspective: WidgetPerspective) => {
27+
let filterKey = 'objects';
28+
let filterValues: (object | string)[] = [SELF_ID];
29+
30+
// Handle Non-Container Logic
31+
if (!isContainer) {
32+
if (perspective === 'entities') {
33+
filterKey = 'regardingOf';
34+
filterValues = [{ key: 'id', values: [SELF_ID] }];
35+
} else {
36+
filterKey = 'fromId';
37+
}
38+
}
39+
2240
const fintelTemplateEntitiesInitialFilters = {
2341
mode: 'and',
2442
filters: [{
2543
id: uuid(),
26-
key: 'objects',
27-
values: [SELF_ID],
44+
key: filterKey,
45+
values: filterValues,
2846
operator: 'eq',
2947
mode: 'or',
3048
}],

‎opencti-platform/opencti-graphql/src/modules/fintelTemplate/fintelTemplate-domain.ts‎

Lines changed: 29 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,17 @@ import { extractContentFrom } from '../../utils/fileToContent';
2424
import { isCompatibleVersionWithMinimal } from '../../utils/version';
2525
import pjson from '../../../package.json';
2626
import { convertWidgetsIds } from '../workspace/workspace-utils';
27-
import { SELF_ID, widgetAttackPatterns, widgetContainerObservables, widgetIndicators } from '../../utils/fintelTemplate/__fintelTemplateWidgets';
27+
import {
28+
SELF_ID,
29+
widgetContainerAttackPatterns,
30+
widgetContainerIndicators,
31+
widgetContainerObservables,
32+
widgetEntityAttackPatterns,
33+
widgetEntityIndicators,
34+
widgetEntityObservables,
35+
} from '../../utils/fintelTemplate/__fintelTemplateWidgets';
2836
import { fintelTemplateVariableNameChecker } from '../../utils/syntax';
37+
import { isStixDomainObjectContainer } from '../../schema/stixDomainObject';
2938

3039
// to customize a template we need : EE, FF enabled
3140
// but also to have the SETTINGS_SETCUSTOMIZATION capability !!
@@ -79,12 +88,14 @@ export const addFintelTemplate = async (
7988
input: FintelTemplateAddInput,
8089
preventDefaultWidgets = false,
8190
) => {
82-
const isFintelForEntityFeatureEnabled = isFeatureEnabled('FINTEL_FOR_ENTITY');
83-
8491
// check rights
8592
await canCustomizeTemplate(context);
8693
// check input validity
8794
checkFintelTemplateWidgetsValidity(input.fintel_template_widgets ?? []);
95+
// get settings type
96+
const { settings_types: [settings_type] } = input;
97+
const isFintelForEntityFeatureEnabled = isFeatureEnabled('FINTEL_FOR_ENTITY');
98+
const isContainer = isFintelForEntityFeatureEnabled ? isStixDomainObjectContainer(settings_type) : true;
8899
// add id to fintel template widgets
89100
const widgetsWithIds = (input.fintel_template_widgets ?? []).map((templateWidget) => ({
90101
...templateWidget,
@@ -103,7 +114,7 @@ export const addFintelTemplate = async (
103114
columns: [{
104115
label: 'Representative',
105116
attribute: 'representative.main',
106-
variableName: isFintelForEntityFeatureEnabled ? 'entityRepresentative' : 'containerRepresentative',
117+
variableName: isContainer ? 'containerRepresentative' : 'entityRepresentative',
107118
}],
108119
instance_id: SELF_ID,
109120
}],
@@ -113,29 +124,20 @@ export const addFintelTemplate = async (
113124
},
114125
},
115126
});
116-
// - list widgets of observables
117-
widgetsWithIds.push({
118-
variable_name: widgetContainerObservables.variable_name,
119-
widget: {
120-
id: uuidv4(),
121-
...widgetContainerObservables.widget,
122-
},
123-
});
124-
// - list widgets of attack patterns
125-
widgetsWithIds.push({
126-
variable_name: widgetAttackPatterns.variable_name,
127-
widget: {
128-
id: uuidv4(),
129-
...widgetAttackPatterns.widget,
130-
},
131-
});
132-
// - list widgets indicators
133-
widgetsWithIds.push({
134-
variable_name: widgetIndicators.variable_name,
135-
widget: {
136-
id: uuidv4(),
137-
...widgetIndicators.widget,
138-
},
127+
128+
const relatedDataWidgets = isContainer
129+
? [widgetContainerObservables, widgetContainerAttackPatterns, widgetContainerIndicators]
130+
: [widgetEntityObservables, widgetEntityAttackPatterns, widgetEntityIndicators];
131+
132+
// Add related data widgets depending on the settings type (container or entity)
133+
relatedDataWidgets.forEach(({ variable_name, widget }) => {
134+
widgetsWithIds.push({
135+
variable_name: variable_name,
136+
widget: {
137+
id: uuidv4(),
138+
...widget,
139+
},
140+
});
139141
});
140142
}
141143

‎opencti-platform/opencti-graphql/src/utils/fintelTemplate/__executiveSummary.template.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
import {
22
widgetAllEntitiesAndObservables,
3-
widgetAttackPatterns,
3+
widgetContainerAttackPatterns,
44
widgetGroupingMultiAttributes,
55
widgetIncidentResponseMultiAttributes,
6-
widgetIndicators,
6+
widgetContainerIndicators,
77
widgetReportMultiAttributes,
88
widgetRFIMultiAttributes,
99
widgetRFTMultiAttributes,
@@ -169,8 +169,8 @@ export const generateFintelTemplateExecutiveSummary = (containerType: string): F
169169
start_date: '1970-01-01T00:00:00Z',
170170
fintel_template_widgets: [
171171
multiAttributesWidget,
172-
widgetIndicators,
173-
widgetAttackPatterns,
172+
widgetContainerIndicators,
173+
widgetContainerAttackPatterns,
174174
widgetThreats,
175175
widgetVictims,
176176
widgetAllEntitiesAndObservables,

‎opencti-platform/opencti-graphql/src/utils/fintelTemplate/__fintelTemplateWidgets.ts‎

Lines changed: 121 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,44 @@ export const widgetContainerObservables: FintelTemplateWidgetAddInput = {
141141
},
142142
],
143143
parameters: {
144-
title: 'Observables contained in the entity',
144+
title: 'Observables contained in the container',
145+
},
146+
},
147+
};
148+
149+
export const widgetEntityObservables: FintelTemplateWidgetAddInput = {
150+
variable_name: 'observables',
151+
widget: {
152+
type: 'list',
153+
perspective: WidgetPerspective.Entities,
154+
dataSelection: [
155+
{
156+
perspective: WidgetPerspective.Entities,
157+
number: 50,
158+
filters: JSON.stringify({
159+
mode: 'and',
160+
filters: [
161+
{ key: ['entity_type'], values: ['Stix-Cyber-Observable'] },
162+
{
163+
key: 'regardingOf',
164+
operator: 'eq',
165+
values: [{
166+
key: 'id',
167+
values: [SELF_ID],
168+
}],
169+
mode: 'or',
170+
},
171+
],
172+
filterGroups: [],
173+
}),
174+
columns: [
175+
{ label: 'Observable type', attribute: 'entity_type' },
176+
{ label: 'Value', attribute: 'representative.main' },
177+
],
178+
},
179+
],
180+
parameters: {
181+
title: 'Observables linked to the entity',
145182
},
146183
},
147184
};
@@ -170,12 +207,12 @@ export const widgetIncidentIOC: FintelTemplateWidgetAddInput = {
170207
},
171208
],
172209
parameters: {
173-
title: 'Indicators contained in the entity',
210+
title: 'Indicators contained in the container',
174211
},
175212
},
176213
};
177214

178-
export const widgetIndicators: FintelTemplateWidgetAddInput = {
215+
export const widgetContainerIndicators: FintelTemplateWidgetAddInput = {
179216
variable_name: 'indicators',
180217
widget: {
181218
type: 'list',
@@ -199,7 +236,44 @@ export const widgetIndicators: FintelTemplateWidgetAddInput = {
199236
},
200237
],
201238
parameters: {
202-
title: 'Indicators contained in the entity',
239+
title: 'Indicators contained in the container',
240+
},
241+
},
242+
};
243+
244+
export const widgetEntityIndicators: FintelTemplateWidgetAddInput = {
245+
variable_name: 'indicators',
246+
widget: {
247+
type: 'list',
248+
perspective: WidgetPerspective.Entities,
249+
dataSelection: [
250+
{
251+
perspective: WidgetPerspective.Entities,
252+
number: 50,
253+
filters: JSON.stringify({
254+
mode: 'and',
255+
filters: [
256+
{ key: ['entity_type'], values: ['Indicator'] },
257+
{
258+
key: 'regardingOf',
259+
operator: 'eq',
260+
values: [{
261+
key: 'id',
262+
values: [SELF_ID],
263+
}],
264+
mode: 'or',
265+
},
266+
],
267+
filterGroups: [],
268+
}),
269+
columns: [
270+
{ label: 'Indicator types', attribute: 'indicator_types' },
271+
{ label: 'Indicator pattern', attribute: 'pattern' },
272+
],
273+
},
274+
],
275+
parameters: {
276+
title: 'Indicators linked to the entity',
203277
},
204278
},
205279
};
@@ -229,12 +303,12 @@ export const widgetIncidentTasksActions: FintelTemplateWidgetAddInput = {
229303
},
230304
],
231305
parameters: {
232-
title: 'Tasks contained in the entity',
306+
title: 'Tasks contained in the container',
233307
},
234308
},
235309
};
236310

237-
export const widgetAttackPatterns: FintelTemplateWidgetAddInput = {
311+
export const widgetContainerAttackPatterns: FintelTemplateWidgetAddInput = {
238312
variable_name: 'attackPatterns',
239313
widget: {
240314
type: 'list',
@@ -258,7 +332,44 @@ export const widgetAttackPatterns: FintelTemplateWidgetAddInput = {
258332
},
259333
],
260334
parameters: {
261-
title: 'Attack Patterns contained in the entity',
335+
title: 'Attack Patterns contained in the container',
336+
},
337+
},
338+
};
339+
340+
export const widgetEntityAttackPatterns: FintelTemplateWidgetAddInput = {
341+
variable_name: 'attackPatterns',
342+
widget: {
343+
type: 'list',
344+
perspective: WidgetPerspective.Entities,
345+
dataSelection: [
346+
{
347+
perspective: WidgetPerspective.Entities,
348+
number: 50,
349+
filters: JSON.stringify({
350+
mode: 'and',
351+
filters: [
352+
{ key: ['entity_type'], values: ['Attack-Pattern'] },
353+
{
354+
key: 'regardingOf',
355+
operator: 'eq',
356+
values: [{
357+
key: 'id',
358+
values: [SELF_ID],
359+
}],
360+
mode: 'or',
361+
},
362+
],
363+
filterGroups: [],
364+
}),
365+
columns: [
366+
{ label: 'Technique ID', attribute: 'x_mitre_id' },
367+
{ label: 'Technique', attribute: 'representative.main' },
368+
],
369+
},
370+
],
371+
parameters: {
372+
title: 'Attack Patterns linked to the entity',
262373
},
263374
},
264375
};
@@ -288,7 +399,7 @@ export const widgetThreats: FintelTemplateWidgetAddInput = {
288399
},
289400
],
290401
parameters: {
291-
title: 'Threats contained in the entity',
402+
title: 'Threats contained in the container',
292403
},
293404
},
294405
};
@@ -318,7 +429,7 @@ export const widgetVictims: FintelTemplateWidgetAddInput = {
318429
},
319430
],
320431
parameters: {
321-
title: 'Victims contained in the entity',
432+
title: 'Victims contained in the container',
322433
},
323434
},
324435
};
@@ -347,7 +458,7 @@ export const widgetAllEntitiesAndObservables: FintelTemplateWidgetAddInput = {
347458
},
348459
],
349460
parameters: {
350-
title: 'Entities and Observables contained in the entity',
461+
title: 'Entities and Observables contained in the container',
351462
},
352463
},
353464
};

‎opencti-platform/opencti-graphql/src/utils/fintelTemplate/__incidentCase.template.ts‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
import type { FintelTemplateAddInput } from '../../generated/graphql';
2-
import { widgetAttackPatterns, widgetContainerObservables, widgetIncidentIOC, widgetIncidentResponseMultiAttributes, widgetIncidentTasksActions } from './__fintelTemplateWidgets';
2+
import {
3+
widgetContainerAttackPatterns,
4+
widgetContainerObservables,
5+
widgetIncidentIOC,
6+
widgetIncidentResponseMultiAttributes,
7+
widgetIncidentTasksActions,
8+
} from './__fintelTemplateWidgets';
39

410
const template_content = `
511
<div>
@@ -104,7 +110,7 @@ export const fintelTemplateIncidentResponse: FintelTemplateAddInput = {
104110
widgetContainerObservables,
105111
widgetIncidentIOC,
106112
widgetIncidentTasksActions,
107-
widgetAttackPatterns,
113+
widgetContainerAttackPatterns,
108114
widgetIncidentResponseMultiAttributes,
109115
],
110116
};

0 commit comments

Comments
 (0)