Description
When ingesting GTI reports, the connector does not create explicit targets relationships (e.g., IntrusionSet targets Sector, Campaign targets Location) from the contextual data provided by the GTI API.
Sectors and locations appear in the Knowledge tab but lack the structured STIX relationship objects that would make them queryable and visible in relationship views.
Expected Behavior
The connector should parse GTI contextual targeting data and create appropriate STIX relationship objects with relationship_type: targets between the relevant entities (Intrusion Sets, Campaigns) and their target Sectors/Locations.
Current Behavior
Targeting context is partially ingested but not modeled as explicit STIX relationships. Users cannot traverse targeting relationships in the graph or filter by them.
Component
external-import/google-threat-intelligence
Description
When ingesting GTI reports, the connector does not create explicit
targetsrelationships (e.g.,IntrusionSet targets Sector,Campaign targets Location) from the contextual data provided by the GTI API.Sectors and locations appear in the Knowledge tab but lack the structured STIX relationship objects that would make them queryable and visible in relationship views.
Expected Behavior
The connector should parse GTI contextual targeting data and create appropriate STIX
relationshipobjects withrelationship_type: targetsbetween the relevant entities (Intrusion Sets, Campaigns) and their target Sectors/Locations.Current Behavior
Targeting context is partially ingested but not modeled as explicit STIX relationships. Users cannot traverse targeting relationships in the graph or filter by them.
Component
external-import/google-threat-intelligence