mitre / caldera

Automated Adversary Emulation Platform
https://caldera.mitre.org
Apache License 2.0
5.39k stars 1.04k forks source link

fact_store's lifecycle? #2971

Closed guillaume-duong-bib closed 2 days ago

guillaume-duong-bib commented 2 months ago

I'm still trying to figure out #2930, and I noticed that every fact I ever created, directly through a Fact Source, or indirectly through a link's parser, is stored in fact_store (after some tests, only the facts that have been "loaded", e.g. through an operation, are in this case). Even though 99% of the "sources" of these facts, i.e. either operations or Fact Sources, have been deleted since.

I see no call to _delete_fact from base_knowledge_svc.py, so it makes sense that they remain, but I would expect these facts to disappear when their source disappears, e.g. when I delete a Fact Source or an operation.

Is this a desired behavior, or an oversight? If this is desired, what are the reasons for it?

clenk commented 2 months ago

It looks like an oversight to me.

guillaume-duong-bib commented 2 months ago

Thanks for your answer. So can I work on a PR for the issue on #2930 plus these, assuming that:

github-actions[bot] commented 1 month ago

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days