With this PR automatic artifact relations take precedence over manual relations because artifact-related instances (relations between certain objects and artifacts) have an auto_created attribute. This attribute indicates whether the relation was added by a user or by the system during object creation, such as the hash/name of evidences or the cidr/domain of events.
Updating artifact-related instances like Event and Case could include a parameter that represents a collection of artifacts. This parameter could lead to conflicts in artifact relations, such as adding new ones, removing no longer existing ones, creating automated relations, and retaining existing ones.
Therefore, the process should function as follows:
Related to #97:
With this PR automatic artifact relations take precedence over manual relations because artifact-related instances (relations between certain objects and artifacts) have an auto_created attribute. This attribute indicates whether the relation was added by a user or by the system during object creation, such as the hash/name of evidences or the cidr/domain of events.
Updating artifact-related instances like Event and Case could include a parameter that represents a collection of artifacts. This parameter could lead to conflicts in artifact relations, such as adding new ones, removing no longer existing ones, creating automated relations, and retaining existing ones.
Therefore, the process should function as follows:
Instance creation:
Instance update: