OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.47k stars 951 forks source link

Taxii feed: when updating feed to change starting date, the cursor should be reset #8463

Open aHenryJard opened 2 months ago

aHenryJard commented 2 months ago

Description

Date added after and next cursor are during ingestion set by the taxii server, but when the date is changed manually on taxii feed configuration the cursor should be reset. In current implementation the cursor is reset only when all data is consume (more = false in server response).

Use case is: for some reason if users wants to restart from another date than the current one that is set up, dependeing on taxii server implementation behavior can ignore date and take cursor.

Environment

  1. OS (where OpenCTI server runs): { e.g. Mac OS 10, Windows 10, Ubuntu 16.4, etc. }
  2. OpenCTI version: { e.g. OpenCTI 1.0.2 }
  3. OpenCTI client: { e.g. frontend or python }
  4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. { e.g. Run ... }
  2. { e.g. Click ... }
  3. { e.g. Error ... }

Expected Output

Update taxii feed date, cursor is empty.

Actual Output

Update taxii feed date, cursor is not reset.

Additional information

Screenshots (optional)

richard-julien commented 1 month ago

Take also a look to other ingester.

aHenryJard commented 3 weeks ago

There is no cursor for CSV Feed and RSS Feed, so I don't think we need to change anything there.

richard-julien commented 3 weeks ago

There is no start date but a still a state that cannot be reset. So its more about giving the possibility to reset the state maybe.

aHenryJard commented 3 days ago

Proposal: Image