Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RFE: TAXII Observed Data Query #4

Open
JasonKeirstead opened this issue Aug 30, 2017 · 3 comments
Open

RFE: TAXII Observed Data Query #4

JasonKeirstead opened this issue Aug 30, 2017 · 3 comments
Labels
Need to Discuss Type: Enhancement

Comments

@JasonKeirstead
Copy link

RFE to allow a way to query observed_data objects that match a given SCO pattern. Once the consumer retrieves those objects, they can pull other relationed objects if they desire.
@JasonKeirstead
Copy link
Author

I will submit a proposal for this.

@MarkDavidson
Copy link

Recommendation:

  • If Jason has a 5-minute-ish proposal, review at F2F
  • Otherwise, discuss scope and goals at F2F

@JasonKeirstead
Copy link
Author

The basic use cases for query by an analyst in my mind are this… in priority order…

a) Find indicators that will match this observation
b) Find observations that match this indicator pattern
c) Find nodes with this combination of properties (we kind of have this today)
d) Find relationships to/from these node(s)
e) (b) except with substring matches
f) Graph traversal queries ( ie tell me if A and B are connected, and if so, return the path(s) )

If we had this I think we would have > 95% coverage of anything needed to build a robust UI for an analyst

@jordan2175 jordan2175 added this to To do in TAXII-2.1 Feb 22, 2018
@jordan2175 jordan2175 removed this from To do in TAXII-2.1 Jan 22, 2019
@emmanvg emmanvg mentioned this issue Dec 10, 2019
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Need to Discuss Type: Enhancement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@MarkDavidson @JasonKeirstead @jordan2175