center-for-threat-informed-defense / attack-workbench-rest-api

An application allowing users to explore, create, annotate, and share extensions of the MITRE ATT&CK® knowledge base. This repository contains the REST API service for storing, querying, and editing ATT&CK objects.
https://ctid.mitre-engenuity.org/
Apache License 2.0
42 stars 22 forks source link

Change retrieveAll query to use indexed sort order #285

Closed ElJocko closed 1 year ago

ElJocko commented 1 year ago

The index for the ATT&CK objects sorts versions in descending order. However, the retrieveAll() service function for ATT&CK objects sorts the versions of each object in ascending order and then groups the objects on the $last version (giving us the most recent version). This mismatch between the index and the query appears to cause an in-memory sort of all the objects in the collection.

The fix is to modify the query to sort versions in descending order and then group the objects on the $first version. The result is the same but the underlying query is more efficient. This problem was fixed for relationships in a patch, but needs to be completed for ATT&CK objects also.