[backend] Bug correction for setting x_opencti_score on SCO. Uses confidence factor value from User/Group #10154
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Maybe x_opencti_score isn't a direct corollary to "confidence" for an SCO, however it is required for decay rules, so just in case:
The new PR#(OpenCTI-Platform/connectors#3526) removes the setting of confidence value directly via a connector. It is expected to inherit the value via the User/Group setting of the users running the connector. However, SCO objects use
x_opencti_score
and notconfidence
value as the key in the DB that tracks this "similar" value. Thus, all SCOs would not be created with a "confidence" value (x_opencti_score) (i.e. would be set to None). This PR seeks to create a similar behavior forx_opencti_score
, based on the confidence level that the User/Group creating the record is rated.middleware.js
has been updated to account for this difference.Issues
NOTE: The Artifact create drawer within the Frontend off -
/dashboard/observations/artifacts
- does not have a score field on it, so artifacts created via this panel will now inherit the score of the creator. However, the drawer off -/dashboard/observations/observables
- and create and select Artifact - does have a score field, defaulted to 50.Previous behavior would be a score of None set off
/dashboard/observations/artifacts
and a score of 50 (or whatever the user defined) set off/dashboard/observations/observables
. I believe the None is a bug in itself, since the docs seem to indicate all should have 50 to start at a minimum. (https://docs.opencti.io/latest/usage/indicators-lifecycle/#score-decay)To fix / make the behavior the same - artifactImport would require the support of
x_opencti_score
, which it currently doesn't support. This is viewed as a separate tech debt PR should this behavior correction be required.Checklist
Further comments
See Issue - #10153