Open Lhorus6 opened 1 month ago
In fact, we have three different terminologies to represent the same thing (first observation, start time, first seen). I suppose this is because the term ‘start time’ isn't always easy to understand, but we should align to a common terminology. Our recommendation is to use STIX (start time) everywhere.
@SamuelHassine : Do you agree with using ‘start time’ and ‘stop time’ everywhere in a relationship?
this seems a good idea to keep a STIX-first approach indeed @SamuelHassine: is @romain-filigran 's suggestion ok for you ?
Description
When I look in a relationship in a Knowledge Graph, the field names are not the right ones. The dates on the relationships are "start/stop time" but in the visual of a knowledge graph we have "first/last seen" which are dates on certain types of entities (e.g. Incident).
This is confusing
Environment
OCTI 6.3.6
Reproducible Steps
Steps to create the smallest reproducible scenario:
Expected
"Start/stop time" in the overview in the knowledge graph