[frontend/backend] add representative in stix filters (#6799)

OpenCTI-Platform · May 13, 2024 · 71740ed · 71740ed
1 parent ab46992
commit 71740ed
Show file tree

Hide file tree

Showing 8 changed files with 53 additions and 120 deletions.
diff --git a/...ti-platform/opencti-front/src/private/components/data/playbooks/PlaybookAddComponents.jsx b/...ti-platform/opencti-front/src/private/components/data/playbooks/PlaybookAddComponents.jsx
@@ -25,7 +25,12 @@ import Filters from '../../common/lists/Filters';
 import FilterIconButton from '../../../../components/FilterIconButton';
 import TextField from '../../../../components/TextField';
 import { useFormatter } from '../../../../components/i18n';
-import { deserializeFilterGroupForFrontend, emptyFilterGroup, serializeFilterGroupForBackend } from '../../../../utils/filters/filtersUtils';
+import {
+  deserializeFilterGroupForFrontend,
+  emptyFilterGroup,
+  serializeFilterGroupForBackend,
+  stixFilters
+} from '../../../../utils/filters/filtersUtils';
 import ItemIcon from '../../../../components/ItemIcon';
 import { isEmptyField, isNotEmptyField } from '../../../../utils/utils';
 import SwitchField from '../../../../components/fields/SwitchField';
@@ -451,29 +456,7 @@ const PlaybookAddComponentsContent = ({
                         >
                           <Filters
                             helpers={helpers}
-                            availableFilterKeys={[
-                              'entity_type',
-                              'workflow_id',
-                              'objectAssignee',
-                              'objects',
-                              'objectMarking',
-                              'objectLabel',
-                              'creator_id',
-                              'createdBy',
-                              'priority',
-                              'severity',
-                              'x_opencti_score',
-                              'x_opencti_detection',
-                              'revoked',
-                              'confidence',
-                              'indicator_types',
-                              'pattern_type',
-                              'x_opencti_main_observable_type',
-                              'fromId',
-                              'toId',
-                              'fromTypes',
-                              'toTypes',
-                            ]}
+                            availableFilterKeys={stixFilters}
                             searchContext={{ entityTypes: ['Stix-Core-Object', 'stix-core-relationship'] }}
                           />
                         </Box>

diff --git a/...ti-platform/opencti-front/src/private/components/data/stream/StreamCollectionCreation.tsx b/...ti-platform/opencti-front/src/private/components/data/stream/StreamCollectionCreation.tsx
@@ -15,7 +15,7 @@ import { FormikConfig } from 'formik/dist/types';
 import { commitMutation } from '../../../../relay/environment';
 import TextField from '../../../../components/TextField';
 import Filters from '../../common/lists/Filters';
-import { emptyFilterGroup, serializeFilterGroupForBackend } from '../../../../utils/filters/filtersUtils';
+import { emptyFilterGroup, serializeFilterGroupForBackend, stixFilters } from '../../../../utils/filters/filtersUtils';
 import FilterIconButton from '../../../../components/FilterIconButton';
 import { fieldSpacingContainerStyle } from '../../../../utils/field';
 import ObjectMembersField from '../../common/form/ObjectMembersField';
@@ -192,29 +192,7 @@ const StreamCollectionCreation: FunctionComponent<StreamCollectionCreationProps>
                 gap: 1 }}
               >
                 <Filters
-                  availableFilterKeys={[
-                    'entity_type',
-                    'workflow_id',
-                    'objectAssignee',
-                    'objects',
-                    'objectMarking',
-                    'objectLabel',
-                    'creator_id',
-                    'createdBy',
-                    'priority',
-                    'severity',
-                    'x_opencti_score',
-                    'x_opencti_detection',
-                    'revoked',
-                    'confidence',
-                    'indicator_types',
-                    'pattern_type',
-                    'x_opencti_main_observable_type',
-                    'fromId',
-                    'toId',
-                    'fromTypes',
-                    'toTypes',
-                  ]}
+                  availableFilterKeys={stixFilters}
                   helpers={helpers}
                   searchContext={{ entityTypes: ['Stix-Core-Object', 'stix-core-relationship'] }}
                 />

diff --git a/...cti-platform/opencti-front/src/private/components/data/stream/StreamCollectionEdition.tsx b/...cti-platform/opencti-front/src/private/components/data/stream/StreamCollectionEdition.tsx
@@ -16,7 +16,7 @@ import { useFormatter } from '../../../../components/i18n';
 import { commitMutation } from '../../../../relay/environment';
 import TextField from '../../../../components/TextField';
 import Filters from '../../common/lists/Filters';
-import { deserializeFilterGroupForFrontend, serializeFilterGroupForBackend } from '../../../../utils/filters/filtersUtils';
+import { deserializeFilterGroupForFrontend, serializeFilterGroupForBackend, stixFilters } from '../../../../utils/filters/filtersUtils';
 import FilterIconButton from '../../../../components/FilterIconButton';
 import { fieldSpacingContainerStyle } from '../../../../utils/field';
 import { convertAuthorizedMembers } from '../../../../utils/edition';
@@ -185,29 +185,7 @@ const StreamCollectionEditionContainer: FunctionComponent<{ streamCollection: St
             gap: 1 }}
           >
             <Filters
-              availableFilterKeys={[
-                'entity_type',
-                'workflow_id',
-                'objectAssignee',
-                'objects',
-                'objectMarking',
-                'objectLabel',
-                'creator_id',
-                'createdBy',
-                'priority',
-                'severity',
-                'x_opencti_score',
-                'x_opencti_detection',
-                'revoked',
-                'confidence',
-                'indicator_types',
-                'pattern_type',
-                'x_opencti_main_observable_type',
-                'fromId',
-                'toId',
-                'fromTypes',
-                'toTypes',
-              ]}
+              availableFilterKeys={stixFilters}
               helpers={helpers}
               searchContext={{ entityTypes: ['Stix-Core-Object', 'stix-core-relationship'] }}
             />

diff --git a/...platform/opencti-front/src/private/components/profile/triggers/TriggerEditionOverview.tsx b/...platform/opencti-front/src/private/components/profile/triggers/TriggerEditionOverview.tsx
@@ -16,7 +16,7 @@ import TextField from '../../../../components/TextField';
 import TimePickerField from '../../../../components/TimePickerField';
 import { convertEventTypes, convertNotifiers, convertTriggers, filterEventTypesOptions, instanceEventTypesOptions } from '../../../../utils/edition';
 import { fieldSpacingContainerStyle } from '../../../../utils/field';
-import { deserializeFilterGroupForFrontend, serializeFilterGroupForBackend } from '../../../../utils/filters/filtersUtils';
+import { deserializeFilterGroupForFrontend, serializeFilterGroupForBackend, stixFilters } from '../../../../utils/filters/filtersUtils';
 import { dayStartDate, formatTimeForToday, parse } from '../../../../utils/Time';
 import NotifierField from '../../common/form/NotifierField';
 import { Option } from '../../common/form/ReferenceField';
@@ -422,29 +422,7 @@ TriggerEditionOverviewProps
             >
               {(!trigger.instance_trigger
                 && <Filters
-                  availableFilterKeys={[
-                    'entity_type',
-                    'workflow_id',
-                    'objectAssignee',
-                    'objects',
-                    'objectMarking',
-                    'objectLabel',
-                    'creator_id',
-                    'createdBy',
-                    'priority',
-                    'severity',
-                    'x_opencti_score',
-                    'x_opencti_detection',
-                    'revoked',
-                    'confidence',
-                    'indicator_types',
-                    'x_opencti_main_observable_type',
-                    'pattern_type',
-                    'fromId',
-                    'toId',
-                    'fromTypes',
-                    'toTypes',
-                  ]}
+                  availableFilterKeys={stixFilters}
                   helpers={helpers}
                   searchContext={{ entityTypes: ['Stix-Core-Object', 'stix-core-relationship'] }}
                    />)}

diff --git a/...ti-platform/opencti-front/src/private/components/profile/triggers/TriggerLiveCreation.tsx b/...ti-platform/opencti-front/src/private/components/profile/triggers/TriggerLiveCreation.tsx
@@ -24,7 +24,7 @@ import TextField from '../../../../components/TextField';
 import type { Theme } from '../../../../components/Theme';
 import { handleErrorInForm } from '../../../../relay/environment';
 import { fieldSpacingContainerStyle } from '../../../../utils/field';
-import { emptyFilterGroup, getDefaultFilterObject, serializeFilterGroupForBackend, useFilterDefinition } from '../../../../utils/filters/filtersUtils';
+import { emptyFilterGroup, getDefaultFilterObject, serializeFilterGroupForBackend, stixFilters, useFilterDefinition } from '../../../../utils/filters/filtersUtils';
 import { insertNode } from '../../../../utils/store';
 import NotifierField from '../../common/form/NotifierField';
 import { Option } from '../../common/form/ReferenceField';
@@ -246,29 +246,7 @@ const TriggerLiveCreation: FunctionComponent<TriggerLiveCreationProps> = ({
         >
           {(!instance_trigger
             && <Filters
-              availableFilterKeys={[
-                'entity_type',
-                'workflow_id',
-                'objectAssignee',
-                'objects',
-                'objectMarking',
-                'objectLabel',
-                'creator_id',
-                'createdBy',
-                'priority',
-                'severity',
-                'x_opencti_score',
-                'x_opencti_detection',
-                'revoked',
-                'confidence',
-                'indicator_types',
-                'x_opencti_main_observable_type',
-                'pattern_type',
-                'fromId',
-                'toId',
-                'fromTypes',
-                'toTypes',
-              ]}
+              availableFilterKeys={stixFilters}
               helpers={helpers}
               searchContext={{ entityTypes: ['Stix-Core-Object', 'stix-core-relationship'] }}
                />

diff --git a/opencti-platform/opencti-front/src/utils/filters/filtersUtils.tsx b/opencti-platform/opencti-front/src/utils/filters/filtersUtils.tsx
@@ -74,6 +74,32 @@ export const contextFilters = [
   'contextObjectMarking',
 ];
 
+// filters available in stix filtering (streams, playbooks, triggers)
+export const stixFilters = [
+  'entity_type',
+  'workflow_id',
+  'objectAssignee',
+  'objects',
+  'objectMarking',
+  'objectLabel',
+  'creator_id',
+  'createdBy',
+  'priority',
+  'severity',
+  'x_opencti_score',
+  'x_opencti_detection',
+  'revoked',
+  'confidence',
+  'indicator_types',
+  'pattern_type',
+  'x_opencti_main_observable_type',
+  'fromId',
+  'toId',
+  'fromTypes',
+  'toTypes',
+  'representative',
+];
+
 //----------------------------------------------------------------------------------------------------------------------
 // utilities
 

diff --git a/opencti-platform/opencti-graphql/src/utils/filtering/filtering-constants.ts b/opencti-platform/opencti-graphql/src/utils/filtering/filtering-constants.ts
@@ -25,6 +25,7 @@ export const RELATION_FROM_ROLE_FILTER = 'fromRole';
 export const RELATION_TO_ROLE_FILTER = 'toRole';
 export const RELATION_FROM_TYPES_FILTER = 'fromTypes';
 export const RELATION_TO_TYPES_FILTER = 'toTypes';
+export const REPRESENTATIVE_FILTER = 'representative'; // representative of an entity
 export const INSTANCE_RELATION_TYPES_FILTER = 'elementWithTargetTypes'; // TODO Rename/migrate to fromOrToType
 export const CONNECTED_TO_INSTANCE_FILTER = 'connectedToId'; // TODO Rename/migrate to triggerListenId
 export const CONNECTED_TO_INSTANCE_SIDE_EVENTS_FILTER = 'connectedToId_sideEvents';

diff --git a/opencti-platform/opencti-graphql/src/utils/filtering/filtering-stix/stix-testers.ts b/opencti-platform/opencti-graphql/src/utils/filtering/filtering-stix/stix-testers.ts
@@ -25,6 +25,7 @@ import {
   RELATION_FROM_TYPES_FILTER,
   RELATION_TO_FILTER,
   RELATION_TO_TYPES_FILTER,
+  REPRESENTATIVE_FILTER,
   REVOKED_FILTER,
   SCORE_FILTER,
   SEVERITY_FILTER,
@@ -33,6 +34,7 @@ import {
 } from '../filtering-constants';
 import type { Filter } from '../../../generated/graphql';
 import { STIX_RESOLUTION_MAP_PATHS } from '../filtering-resolution';
+import { extractStixRepresentative } from '../../../database/stix-representative';
 
 //-----------------------------------------------------------------------------------
 // Testers for each possible filter.
@@ -276,6 +278,14 @@ export const testRelationToTypes = (stix: any, filter: Filter) => {
   return false;
 };
 
+/**
+ * REPRESENTATIVE
+ */
+export const testRepresentative = (stix: any, filter: Filter) => {
+  const representative: string = extractStixRepresentative(stix);
+  return testStringFilter(filter, [representative]);
+};
+
 /**
  * CONNECTED TO for DIRECT EVENTS ONLY
  * test if the stix is directly related to the instance id
@@ -348,4 +358,5 @@ export const FILTER_KEY_TESTERS_MAP: Record<string, TesterFunction> = {
   [RELATION_FROM_TYPES_FILTER]: testRelationFromTypes,
   [RELATION_TO_FILTER]: testRelationTo,
   [RELATION_TO_TYPES_FILTER]: testRelationToTypes,
+  [REPRESENTATIVE_FILTER]: testRepresentative,
 };