stix2arango is a command line tool that takes a group of STIX 2.1 objects in a bundle and inserts them into ArangoDB. It can also handle updates to existing objects in ArangoDB imported in a bundle.
RETURN LENGTH(
FOR doc IN test4_edge_collection
FILTER doc._is_latest == true
AND doc._is_ref == true
AND doc.created_by_ref == "identity--72e906ce-ca1b-5d73-adcd-9ea9eb66a1b4"
AND doc._stix2arango_note == "test4C"
RETURN doc
)
Should return
[
15032
]
(the number of embedded relationships in the bundle)
Which it does.
RETURN LENGTH(
FOR doc IN test4_edge_collection
FILTER doc._is_latest == false
AND doc._is_ref == true
AND doc.created_by_ref == "identity--72e906ce-ca1b-5d73-adcd-9ea9eb66a1b4"
AND doc._stix2arango_note == "test4A"
OR doc._stix2arango_note == "test4B"
RETURN doc
)
Test case 4
https://github.com/muchdogesec/stix2arango/blob/optimizations/tests/4-import-detected-because-of-stix2arango-note.md
Should return
(the number of embedded relationships in the bundle)
Which it does.
Should return
b/c two updates have happened to ( 15032x2)
but it actually returns