Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge duplicates entities #480

Closed
8hur opened this issue Feb 11, 2020 · 2 comments
Closed

Merge duplicates entities #480

8hur opened this issue Feb 11, 2020 · 2 comments
Assignees
Labels
feature use for describing a new feature to develop solved use to identify issue that has been solved (must be linked to the solving PR)
Milestone

Comments

@8hur
Copy link

8hur commented Feb 11, 2020

Problem to Solve

When something is known under multiples names, multiples entities in opencti can be created for the same thing.

For example they could be one entity for SOGU and one for PlugX.

Current Workaround

Choose the least used entity, add the most used entity in every report where it appears then delete the least used entity.

Proposed Solution

Allow merging of entities, keeping every link associated to both of the previous entities.

@richard-julien
Copy link
Member

Looks like #246 but seems a bit different. For this use case maybe we should add a specific relation similar-to between group(s) and elect the group that will represents the others. Dont know if STIX define this kind of situation. @SamuelHassine?

@richard-julien richard-julien added the feature use for describing a new feature to develop label Feb 11, 2020
@8hur
Copy link
Author

8hur commented Feb 11, 2020

My bad. I haven't searched properly before filling the bug.

@SamuelHassine SamuelHassine self-assigned this Mar 2, 2020
@SamuelHassine SamuelHassine added the solved use to identify issue that has been solved (must be linked to the solving PR) label Mar 7, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature use for describing a new feature to develop solved use to identify issue that has been solved (must be linked to the solving PR)
Projects
None yet
Development

No branches or pull requests

3 participants