search

OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.36k stars 939 forks source link

User data ingest not compatible with "enforced references" (Import, CSV mapper, ...) #4839

Open labo-flg opened 1 year ago

labo-flg commented 1 year ago

Description

When some entities have the option "Enforce references", we cannot import them from a CSV using our new CSV mappers. The backend checks for the validity of the gql input and it lacks the mandatory externalReferences.

Environment

5.11.12

Reproducible Steps

  1. Create a simple mapper as explained in this comment.

  2. Test it with the csv file provided in same comment --> you will get the validation error.

  3. Try to import data using this same file and mapper --> it won't work. Backend logs show the same error (frontend shows no feedback, but that's another issue).

Expected Output

?????

That's a good question actually. Once you enforce references, what is supposed to be possible ?

richard-julien commented 1 year ago

Not a CSV specific problem for me. Its global to file ingest. Pinging @Jipegien

Jipegien commented 11 months ago

This is not a bug. Enforced references are not covered by CSV mappers and any other means to import multiple Objects in one shot. This is a really complex problem for a very little subset of advanced users.

We will tackle this, later, in collaboration with end users to find a good trade off.