-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Description
Description
I have a Container, for example a Grouping, containing inferred relationships.
I also have a Playbook that manipulates knowledge of contained entities, for example adding labels, on Containers update.
Instead of just adding labels, I have a new relationship, identical to the inferred one, created by AUTOMATION MANAGER.
Environment
- OS (where OpenCTI server runs): Ubuntu
- OpenCTI version: 6.9.21
Reproducible Steps
Steps to create the smallest reproducible scenario:
Requirements
Be sure you are in Enterprise Edition and have some inference rules activated (Settings / Customization / Rules Engine), in the example below I will use the rule Location Propagation.
Preparation of the Container:
- Create a new Grouping (Analyses / Groupings),
- Create a city
city1(Locations / Cities), - Create an area
area2(Locations / Administrative Areas), - Create a country
country3(Locations / Countries), - Create a relationship
located atbetweencity1andarea2, - Create a relationship
located atbetweenarea2andcountry3(at this step you should be able to see an inferred relationshiplocated atbetweencity1andcountry3), - Go to Data / Relationships and click on the inferred relationship newly created,
- In the header, click on button Add in container,
- Select your Grouping created in step 1 and check the box Also include first neighbors,
- Go to your Grouping, tab Knowledge, you should have something like that:
Preparation of the Playbook:
- Create a new Playbook (Data / Processing / Automation)
- Add a box
Listen knowledge events:
a. createOFF,
b. updateON,
c. deleteOFF,
d. filterEntity type = Grouping, - Add a box
Apply predefined ruletoout:
a. rule to applyResolve container references (add in bundle),
b. include inferred objectsON, - Add a box
Manipulate knowledgetoout:
a. action typeAdd,
b. fieldLabels,
c. choose one of your labels,
d. manipulate all elements in the bundleOFF, - Add a box
Send for ingestiontoout, - Start your Playbook that should looks like that:
Triggering the Playbook:
- Go to your created Container,
- Modify it, for example its description,
- Go to your created Playbook, you should see an execution trace available,
- Go to Data / Relationships, you should see a duplication of the inferred relationship,
The second line is normal, it cames from our rules engine. The first line is a relationship created by AUTOMATION MANAGER and should not exist
Expected Output
Only labels are added, the Playbook does not create any relationship.
Actual Output
Labels are added, but a duplicate relationship of the inferred one is also created.