yeti-platform / yeti

Your Everyday Threat Intelligence
https://yeti-platform.io/
Apache License 2.0
1.71k stars 286 forks source link

`tags=` searches are too slow #1124

Open tomchop opened 1 month ago

tomchop commented 1 month ago

We need to handle tags=-type searches a bit differently, as it's currently too slow for larger databases.

My hypothesis is that the selection happens over the whole observable collection, and for each observable the tags graph is traversed once, and only the items that have the specified tag are kept.

A much better approach would be to start from the tag and simply return all observables that are associated with it (1 traversal instead of N)