[backend/frontend] Threat actor group should not be part-of threat actor individual (#9576) #9649
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #9649 +/- ##
==========================================
- Coverage 65.26% 65.25% -0.02%
==========================================
Files 630 630
Lines 60244 60237 -7
Branches 6760 6762 +2
==========================================
- Hits 39319 39307 -12
- Misses 20925 20930 +5 ☔ View full report in Codecov by Sentry. |
|
@SarahBocognano there is a bit more to do to solve the issue.
TAI -> part of -> TAG
|
| const context = executionContext('migration'); | ||
| logApp.info('[MIGRATION] Transform invalid relationships to "related-to"'); | ||
|
|
||
| // Définition des relations valides avec direction |
| const invalidRelationshipsQuery = { | ||
| bool: { | ||
| must_not: validRelations.map((relation) => ({ | ||
| bool: { | ||
| must: [ | ||
| { term: { 'fromType.keyword': relation.fromType } }, | ||
| { term: { 'toType.keyword': relation.toType } }, | ||
| { term: { 'relationship_type.keyword': relation.relationType } }, | ||
| ], | ||
| }, | ||
| })), | ||
| }, | ||
| }; |
There was a problem hiding this comment.
I'm not sure to understand. This query will give you all relationships that are NOT one of the validRelations above, am I right ?
If so, you would get also valid relationships not listed in your array, like a campaign targeting a country.
Can't you instead search for invalid relationship directly ?
Proposed changes
Related issues