OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
5.12k stars 813 forks source link

Questions (or bugs) with Creators and Assignees in reports. #7441

Open misohouse opened 5 days ago

misohouse commented 5 days ago

Deleting user information that is no longer using the platform does not erase the user information that is visible on the CREATORS tab of the report.

Is this intentional or a bug?

Additionally, I don't understand that when another user edits the report, another user's information is added to CREATORS.

Shouldn't the CREATORS be the person who created the report, so it should be one person, and the person who later edited the report should be added to Assignees by themselves?

Any answers would be appreciated.

nino-filigran commented 5 days ago

Hi @misohouse , Concerning your first question, the creator will be update to system after a little while.

About your second question, we consider that:

Therefore, you can always keep track of who's screated the information VS who edited it. Why would you need the user who edits becomes assignee? Which use case with the current approach can't you achieve?

misohouse commented 2 days ago

@nino-filigran

I want to change the display of report authors to a team basis (minimizing exposure to individual team members to external member).

So I changed the registered name of all the accounts that create the reports to the team name, but this is causing me to have 2 Creators on a report with the same name.

So what I wanted was to ask if it was possible to have the Creator only show the first one who created it, and have a separate Assignee that was analyzed to create that report.

But now that I think about it, even if I do what I said, the Assignee will also show up as a name, so I'll see multiple people with the same team name, which doesn't seem to accomplish what I want.

I think this is something I need to think about more.

Thanks for your answer :)