search

muchdogesec / stix2arango

stix2arango is a command line tool that takes a group of STIX 2.1 objects in a bundle and inserts them into ArangoDB. It can also handle updates to existing objects in ArangoDB imported in a bundle.
GNU Affero General Public License v3.0
1 stars 0 forks source link

_is_latest for vertex objects updated b/c modified time changes is incorrect #11

Closed himynamesdave closed 3 weeks ago

himynamesdave commented 3 weeks ago

test case 5

FOR doc IN test5_vertex_collection
    FILTER doc._stix2arango_note != "automatically imported on collection creation"
    AND doc.id == "indicator--7a5dedb9-30f9-51c0-a49d-91aeda1fd7fd"
    SORT doc._record_modified DESC
      RETURN {
        id: doc.id,
        _is_latest: doc._is_latest,
        name: doc.name
        modified: doc.modified
      }

should return 

[
  {
    "id": "indicator--7a5dedb9-30f9-51c0-a49d-91aeda1fd7fd",
    "_is_latest": true,
    "name": "SECOND UPDATE",
    "modified": "2024-01-01T00:00:00.000Z"
  }
  {
    "id": "indicator--7a5dedb9-30f9-51c0-a49d-91aeda1fd7fd",
    "_is_latest": false,
    "name": "FIRST UPDATE",
    "modified": "2023-12-12T00:00:00.000Z"
  },
  {
    "id": "indicator--7a5dedb9-30f9-51c0-a49d-91aeda1fd7fd",
    "_is_latest": false,
    "name": "Deny Service Access Using Security Descriptor Tampering Via Sc.EXE",
    "modified": "2023-02-28T00:00:00.000Z"
  }
]

but actually returnes

[
  {
    "id": "indicator--7a5dedb9-30f9-51c0-a49d-91aeda1fd7fd",
    "_is_latest": false,
    "name": "SECOND UPDATE",
    "modified": "2024-01-01T00:00:00.000Z"
  },
  {
    "id": "indicator--7a5dedb9-30f9-51c0-a49d-91aeda1fd7fd",
    "_is_latest": false,
    "name": "FIRST UPDATE",
    "modified": "2023-12-12T00:00:00.000Z"
  },
  {
    "id": "indicator--7a5dedb9-30f9-51c0-a49d-91aeda1fd7fd",
    "_is_latest": true,
    "name": "Deny Service Access Using Security Descriptor Tampering Via Sc.EXE",
    "modified": "2023-02-28T00:00:00.000Z"
  }
]

which is not correct, as objects that contain modified times should always have _is_latest==true as the version with the highest modified time.

The same incorrect behaviour exists for relationships to

See 

FOR doc IN test5_edge_collection
    FILTER doc._stix2arango_note != "automatically imported on collection creation"
    AND doc._is_ref == false
    AND doc.id == "relationship--3089bdec-3d25-5d1b-a6ac-9d152ab14e35"
    SORT doc._record_modified DESC
      RETURN {
        id: doc.id,
        _is_latest: doc._is_latest,
        modified: doc.modified
      }

Should return:

[
  {
    "id": "relationship--3089bdec-3d25-5d1b-a6ac-9d152ab14e35",
    "_is_latest": true,
    "modified": "2024-01-01T00:00:00.000Z"
  },
  {
    "id": "relationship--3089bdec-3d25-5d1b-a6ac-9d152ab14e35",
    "_is_latest": false,
    "modified": "2023-12-12T00:00:00.000Z"
  },
  {
    "id": "relationship--3089bdec-3d25-5d1b-a6ac-9d152ab14e35",
    "_is_latest": false,
    "modified": "2023-02-28T00:00:00.000Z"
  }
]

but again, wrong modified time is _is_latest in current responses:

[
  {
    "id": "relationship--3089bdec-3d25-5d1b-a6ac-9d152ab14e35",
    "_is_latest": false,
    "modified": "2024-01-01T00:00:00.000Z"
  },
  {
    "id": "relationship--3089bdec-3d25-5d1b-a6ac-9d152ab14e35",
    "_is_latest": false,
    "modified": "2023-12-12T00:00:00.000Z"
  },
  {
    "id": "relationship--3089bdec-3d25-5d1b-a6ac-9d152ab14e35",
    "_is_latest": true,
    "modified": "2023-02-28T00:00:00.000Z"
  }
]