Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ensure that connector always enriches indicators #11

Closed
misje opened this issue May 7, 2024 · 1 comment
Closed

Ensure that connector always enriches indicators #11

misje opened this issue May 7, 2024 · 1 comment
Assignees
@misje
Milestone
0.3.0

Comments

@misje
Copy link
Owner

misje commented May 7, 2024

Currently, OpenCTI is a bit inconsistent when running this connector through automated enrichment on indicators. Sometimes the "based on" relationships are present, sometimes not. Although the indicator and the relationships are created at the same time, it appears that the enrichment is run before the relationships are created. This is expected and impossible to prevent if they relationships were manually added at a later time, but it's frustrating when they're all created at the same time, part of a internal OpenCTI automation. Can this be something OpenCTI can solve? If not, how could the connector deal with this?

This can probably be resolved with a playbook, but do not force users to rely on enterprise features for core functionality.
@misje misje added this to the 0.1.0alpha milestone May 7, 2024
@misje misje self-assigned this May 7, 2024
@misje misje modified the milestones: 0.1.0, 0.2.0 May 12, 2024
misje added a commit that referenced this issue May 29, 2024
@misje
Add a sleep when acting on indicators
dd938db 
This hard-coded delay is hopefully enough to give OpenCTI enough time to
created based-on relationships when creating an indicator in the
platform from an observable. Related to #11.
@misje misje mentioned this issue Jun 9, 2024
Merged
@misje misje closed this as completed Jun 10, 2024
@misje
Copy link
Owner Author

misje commented Jun 10, 2024 •
edited
Loading

The hacky solution of adding a 100 ms delay before fetching linked observables to the enriched indicator seems to work really well. I'm deeming this solved for now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@misje misje

Labels
None yet
Projects
None yet
Milestone
0.3.0
Development

No branches or pull requests
1 participant
@misje