OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.43k stars 948 forks source link

Enable the change of relationship type between actors. #6825

Open sofiasmargolles opened 6 months ago

sofiasmargolles commented 6 months ago

Use case

Enable the possibility of changing the relationship type between threat actors, being able to change from part-of to cooperates by updating the relationship.

Current Workaround

Creating a new relationship between the same actors, with the desired relationship type, and then deleting the previous one.

Proposed Solution

Implement a way to change between part-of and cooperates-with relationships in the update relationship menu.

Additional Information

If the feature request is approved, would you be willing to submit a PR?

Yes / No (Help can be provided if you need assistance submitting a PR) No.

nino-filigran commented 6 months ago

@sofiasmargolles Your request makes sense but I have a question first: what is the reason for having a wrong relation at first? Is it like a manual mistake or some feeds/files/connectors sending you "wrong information"?

sofiasmargolles commented 6 months ago

It not a matter of creating the relationship wrong, but rather about discovering additional intel that requires a relationship update.