yeti-platform / yeti

Your Everyday Threat Intelligence
https://yeti-platform.io/
Apache License 2.0
1.76k stars 291 forks source link

Yeti Object Starring System #1007

Open udgover opened 9 months ago

udgover commented 9 months ago

I would like to be able to start some objects in Yeti, from observable to campaign in order to easily retrieve them. This would imply both backend and frontend implementation and we need to ideate the potential UI / UX.

tomchop commented 9 months ago

This is a big change, but I can see how it could be useful. I'm assuming the idea behind this is to be able to have a dashboard of "more interesting" objects... but going down that path, I can also imagine that if we want to create a single dashboard of starred items, we might also want to be able to have different dashboards with different combinations? So why not use tags for this?

The difference with stars is that they exist per-user, whereas tags are universal. Implementing a per-user tagging system sounds a bit like overkill. Maybe a combination of both? WDYT?

udgover commented 1 month ago

Going back to this discussion after a while :)

To handle this feature per-user we need to:

class Favorite(YetiModel, database_arango.ArangoYetiConnector):
    _collection_name: ClassVar[str] = "favorites"
    _type_filter: ClassVar[str | None] = None
    _root_type: Literal["favorite"] = "favorite"

    user: User
    created: datetime.datetime = Field(default_factory=now)
    annotation: str = ""

Then in database, we need a new fav_graph graph to link with other collections:

            self.graph("fav_graph"),
            {
                "edge_collection": "favorites_links",
                "from_vertex_collections": ["observables", "entities", "indicators"],
                "to_vertex_collections": ["favorites"],
            },

Then in UI, there are several ways to manage favorites:

tomchop commented 4 weeks ago

Do we really need a new schema for this? What if we just used a link from the User model to any of those entities, and encode the annotation / timestamp in the Link?