OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.43k stars 948 forks source link

Delete relations when deleting entities #2256

Open AAA10CR7 opened 2 years ago

AAA10CR7 commented 2 years ago

Use case

There are few cases where we link entities (intrusionSet, Malware, Tools ...etc) incorrectly with different other entities. Upon deleting the main entity, all linked relations should be deleted as well (from entity profile). Otherwise inconsistent data might be reside on the entity.

Current Workaround

Currently, we need to delete the entity along with all relations manually which is time consuming and subject to mistakes.

Proposed Solution

Provide ability to delete multiple relations at once or delete all relations once the entity is deleted.

Additional Information

Deleting the relation should remove it from the profile of the entity itself, not only in the graph.

If the feature request is approved, would you be willing to submit a PR?

Yes / No (Help can be provided if you need assistance submitting a PR)

richard-julien commented 2 years ago

It shoud be the case. What is your exact repro case? Thanks

AAA10CR7 commented 2 years ago

It shoud be the case. What is your exact repro case? Thanks

Suppose I add APT34 to certain case and create multiple relationships. Then I figure our it should be APT39 not APT34. Then I need to delete all relation with APT34 before removing APT34.

If I go blindly and delete APT34 directly , relations with be available on APT34 profile. It is not remove automatically.

richard-julien commented 2 years ago

I cant reproduced on my tests. My reprose case:

  1. Create threat actor 01
  2. Create threat actor 02
  3. Create Relation between the two threat actors.
  4. Delete threat actor 01

Result -> relation is deleted with the threat actor 01

Can you describe exactly step by step your use case?

Thanks