You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
We have a table of known relationships (STIX 2.0 references between SCOs). Some data source may have reference properties not previously known to Kestrel, and therefore not mapped for FIND.
Describe the solution you'd like
We should instead learn those relationships by inspecting the data we get back from the data source, and attempt to map those to the standard Ketrel relationship types. Once stix-shifter (or other data sources) start using SROs to link SCOs, we probably need to map those dynamically to Kestrel relationship types.
We can "learn" relationships from STIX references by processing the *_ref attributes we find and extracting the list of target types (each STIX id contains the type as the first part of the id).
For SROs, the full set of learned relationship will be the relationship_type attribute of the relationship entities.
Describe alternatives you've considered
Instead of mapping references and SROs to Kestrel relationship types, we can provide a way to show all discovered relationships to the user, and allow them to use those directly.
Additional context
N/A
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
We have a table of known relationships (STIX 2.0 references between SCOs). Some data source may have reference properties not previously known to Kestrel, and therefore not mapped for
FIND
.Describe the solution you'd like
We should instead learn those relationships by inspecting the data we get back from the data source, and attempt to map those to the standard Ketrel relationship types. Once stix-shifter (or other data sources) start using SROs to link SCOs, we probably need to map those dynamically to Kestrel relationship types.
We can "learn" relationships from STIX references by processing the
*_ref
attributes we find and extracting the list of target types (each STIXid
contains the type as the first part of theid
).For SROs, the full set of learned relationship will be the
relationship_type
attribute of therelationship
entities.Describe alternatives you've considered
Instead of mapping references and SROs to Kestrel relationship types, we can provide a way to show all discovered relationships to the user, and allow them to use those directly.
Additional context
N/A
The text was updated successfully, but these errors were encountered: