Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Relationships should be learned instead of hard-coded #342

Open
pcoccoli opened this issue May 19, 2023 · 0 comments
Open

Relationships should be learned instead of hard-coded #342

pcoccoli opened this issue May 19, 2023 · 0 comments
Labels
enhancement New feature or request

Comments

@pcoccoli
Copy link
Collaborator

Is your feature request related to a problem? Please describe.
We have a table of known relationships (STIX 2.0 references between SCOs). Some data source may have reference properties not previously known to Kestrel, and therefore not mapped for FIND.

Describe the solution you'd like
We should instead learn those relationships by inspecting the data we get back from the data source, and attempt to map those to the standard Ketrel relationship types. Once stix-shifter (or other data sources) start using SROs to link SCOs, we probably need to map those dynamically to Kestrel relationship types.
We can "learn" relationships from STIX references by processing the *_ref attributes we find and extracting the list of target types (each STIX id contains the type as the first part of the id).
For SROs, the full set of learned relationship will be the relationship_type attribute of the relationship entities.

Describe alternatives you've considered
Instead of mapping references and SROs to Kestrel relationship types, we can provide a way to show all discovered relationships to the user, and allow them to use those directly.

Additional context
N/A

@pcoccoli pcoccoli added the enhancement New feature or request label May 19, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant