OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
5.12k stars 813 forks source link

Remove score property from Observables #5002

Open Jipegien opened 7 months ago

Jipegien commented 7 months ago

Use case

Observables is not something to score. It is observed, or it is not. To assess if an Observable is associated with malicious practices, the Indicator Object must be used.

CTI sources provide Indicator with a "relevance" score. Detection systems provides Observables that have been seen in logs Observables matches Indicators' pattern

To implement: removing score from Observable schema and views.

nino-filigran commented 1 week ago

@labo-flg use case for deprecation