[SOCRadar] Functional Error (relationship_type)

[Megafredo]

Description

A user on Community slack has encountered a Functional error on relationships (https://filigran-community.slack.com/archives/C06CF1N302W/p1740463481155569)

Here's the error:

Message : {'name': 'FUNCTIONAL_ERROR', 'error_message': 'Only stix-core-relationship can be created through this method.'}

The problem comes from the relationship_type used in the connector code.
In OpenCTI, the authorized relationship between an Indicator and an Identity is related-to and not created-by, if you want to display the Identity in the Indicator's relationships.

⚠️As a general rule, however, we recommend associating the author directly with the Indicator via the created_by_ref field, rather than creating a specific relationship. The connector adds the corresponding identity to the indicator via created_by_ref.

There are two possible options for the fix :

1. Do not create the relationship, as it is already indicated in the indicator author (recommended option).
2. However, if it is really necessary to display the identity in relationships, change the relationship type (Relationship_Type) and use related-to instead of created-by.

This should correct the error and allow the connector to function correctly.

Hi @Radargoger, i'm pinging you on this PR to ask if you can fix this ?
If you need more information don't hesitate to contact me ;)

Environment

1. OS (where OpenCTI server runs): Windows
2. OpenCTI version: 6.5.3
3. OpenCTI client: 6.5.4
4. Other environment details: -

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Starting the SOCRadar connector
2. Wait for ingestion
3. See “Functional error” errors on connector page

Expected Output

No more Functional Error type errors

Actual Output

Displays errors of this type

Message : {'name': 'FUNCTIONAL_ERROR', 'error_message': 'Only stix-core-relationship can be created through this method.'}

Screenshots (optional)

See the Community Slack conversation above