OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
5.27k stars 831 forks source link

TLP Marking in PDF reports on data import feature #2204

Open SYNchroACK opened 2 years ago

SYNchroACK commented 2 years ago

Use case

When an user uses Data Import with a PDF, the UI should ask what is the TLP marking to apply to all data to be imported. I believe this is important because the authorization model is based on the TLP marking associated to Groups. For example, having a tlp:red report being imported in the platform with no marking, which is the same as tlp:white, will be accessible by everyone until someone applies a marking data is imported successfully.

Current Workaround

Apply marking afterwards

Proposed Solution

Have a combo-box requesting the marking to be applied to the report that is being imported.

dgioga commented 2 years ago

Ideally there would be, as @SYNchroACK says a dropdow to mark the file with a specific TLP at upload time. This would apply a default TLP on all of the entities that are creaated. In addition it would be nice to have individual dropdown or right click contextual menu for changing TLP marking on individual entities that were imported