Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[backend] Bug correction for setting x_opencti_score on SCO. Uses confidence factor value from User/Group #10154

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ParamConstructor
Copy link
Contributor

@ParamConstructor ParamConstructor commented Mar 5, 2025

Maybe x_opencti_score isn't a direct corollary to "confidence" for an SCO, however it is required for decay rules, so just in case:

The new PR#(OpenCTI-Platform/connectors#3526) removes the setting of confidence value directly via a connector. It is expected to inherit the value via the User/Group setting of the users running the connector. However, SCO objects use x_opencti_score and not confidence value as the key in the DB that tracks this "similar" value. Thus, all SCOs would not be created with a "confidence" value (x_opencti_score) (i.e. would be set to None). This PR seeks to create a similar behavior for x_opencti_score, based on the confidence level that the User/Group creating the record is rated.

middleware.js has been updated to account for this difference.

Issues

NOTE: The Artifact create drawer within the Frontend off - /dashboard/observations/artifacts - does not have a score field on it, so artifacts created via this panel will now inherit the score of the creator. However, the drawer off - /dashboard/observations/observables - and create and select Artifact - does have a score field, defaulted to 50.

Previous behavior would be a score of None set off /dashboard/observations/artifacts and a score of 50 (or whatever the user defined) set off /dashboard/observations/observables. I believe the None is a bug in itself, since the docs seem to indicate all should have 50 to start at a minimum. (https://docs.opencti.io/latest/usage/indicators-lifecycle/#score-decay)

To fix / make the behavior the same - artifactImport would require the support of x_opencti_score, which it currently doesn't support. This is viewed as a separate tech debt PR should this behavior correction be required.

Checklist

  • I consider the submitted work as finished
  • I tested the code for its functionality
  • I wrote test cases for the relevant uses case (coverage and e2e)
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

See Issue - #10153

…fidence level on an SCO. Aligns with new Connector project behavior.
@ParamConstructor ParamConstructor changed the title [backend] Bug correction for setting x_opencti_score which is the confidence level on an SCO. Aligns with new Connector project behavior. [backend] Bug correction for setting x_opencti_score on SCO. Uses confidence factor value from User/Group Mar 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant