You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/reference/filters.md
+93Lines changed: 93 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -397,6 +397,99 @@ If a values combination may not return all the results because one of the above
397
397

398
398
399
399
400
+
#### The dynamic regardingOf filter keys
401
+
402
+
The ``dynamicRegardingOf`` filter key, displayed as `in regards of (dynamic)` in the UI enables to target the entities having a relationship of a certain type with entities matching a given filter.
403
+
The ``values`` of this filter can take two subfilters with the ``eq`` opeartor:
404
+
- the ``relationship_type`` values indicates which relationship types are concerned
405
+
- the ``dynamic`` values contains the filter the entities involved in the relationships should match
406
+
407
+
Here is an example of filter to fetch the entities targeting malwares with a given label:
408
+
409
+
```ts
410
+
// Example: entities having a relationship of type 'targets' with a malware having a 'ransomware' label
!!! warning "This filter may exclude some results for technical reasons"
451
+
452
+
This filter requires a pre-query to fetch entities ids matching the dynamic filter. Then the regardingOf filter is applied on these ids.
453
+
Only the first 5000 results of this prequery are taken into account. So the final results may exclude some entities if the number of entities matching the dynamic filter is too large. In this case, a warning is displayed in the UI and you may consider giving a more restrictive dynamic filter.
454
+
455
+

456
+
457
+
#### The ``dynamicFrom`` and ``dynamicTo`` filter keys
458
+
459
+
The ``dynamicFrom`` (respectively ``dynamicTo``) filter key is used to apply a given filter on the source (respectively target) of a relationship.
460
+
461
+
Here is an example of filter used to fetch the relationships whose source is a malware with the 'ransomware' label.
462
+
```ts
463
+
// Example: relationships whose source entity is a malware with the 'ransomware' label
0 commit comments