[ti_opencti] Support filtering of indicators and maintain state + deduplication mechanism #15332
Conversation
|
💚 CLA has been signed |
andrewkroh
added
Integration:ti_opencti
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
| "POST", | ||
| state.url.trim_suffix("graphql").trim_suffix("/") + "/graphql" | ||
| ).with({ | ||
| "Header": ({ | ||
| "Content-Type": ["application/json"] | ||
| }).with( | ||
| has(state.api_key) && size(state.api_key) > 0 ? | ||
| { "Authorization": ["Bearer " + state.api_key] } | ||
| : | ||
| {} | ||
| ) | ||
| }).with({ | ||
| "Body": { | ||
| "query": state.query, | ||
| "variables": { |
| fields: | ||
| - api_key | ||
| state: | ||
| url: {{url}} |
| # Track last modified timestamp to avoid re-fetching | ||
| last_modified: null | ||
| # Filter configuration | ||
| pattern_types: {{#if pattern_types}}{{pattern_types}}{{else}}[]{{/if}} |
There was a problem hiding this comment.
These should be in the pattern
| pattern_types: {{#if pattern_types}}{{pattern_types}}{{else}}[]{{/if}} | |
| {{#if pattern_types}} | |
| pattern_types: {{pattern_types}} | |
| {{/if}} |
but to aid the simpler construction of the filter parameter, probably more like
| pattern_types: {{#if pattern_types}}{{pattern_types}}{{else}}[]{{/if}} | |
| {{#if pattern_types}} | |
| filter.pattern_types: {{pattern_types}} | |
| {{/if}} |
| ) ? | ||
| { | ||
| "mode": "and", | ||
| "filters": ( |
There was a problem hiding this comment.
This can be done more readably with an expression mapping over the set of filters.
|
Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as |
|
Hi @SamuelHassine, I hope you find well I made some changes to your contribution in order to make it work properly (@efd6 your comments were addressed too), but since I don't have permission to push changes to your repository I had to open a new pull request #15876. |
|
Closing this PR in favor of #15876. @SamuelHassine thanks for your contribution! |
5 participants
Proposed commit message
[ti_opencti] Support filtering, add deduplication, update logos
Checklist
changelog.ymlfile.Related issues