Skip to content

Commit 5216e4f

Browse files
committed
[docs] dynamic filters for relationships and in regards of (#301)
1 parent 6a0ed32 commit 5216e4f

File tree

4 files changed

+93
-0
lines changed

4 files changed

+93
-0
lines changed
32.5 KB
Loading
17.2 KB
Loading
42.3 KB
Loading

docs/reference/filters.md

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -397,6 +397,99 @@ If a values combination may not return all the results because one of the above
397397
![RegardingOf filter with warning](./assets/filters-regardingOf-warning.png)
398398

399399

400+
#### The dynamic regardingOf filter keys
401+
402+
The ``dynamicRegardingOf`` filter key, displayed as `in regards of (dynamic)` in the UI enables to target the entities having a relationship of a certain type with entities matching a given filter.
403+
The ``values`` of this filter can take two subfilters with the ``eq`` opeartor:
404+
- the ``relationship_type`` values indicates which relationship types are concerned
405+
- the ``dynamic`` values contains the filter the entities involved in the relationships should match
406+
407+
Here is an example of filter to fetch the entities targeting malwares with a given label:
408+
409+
```ts
410+
// Example: entities having a relationship of type 'targets' with a malware having a 'ransomware' label
411+
filters = {
412+
mode: 'and',
413+
filters: [
414+
{
415+
key: 'dynamicRegardingOf',
416+
values: [
417+
{
418+
key: 'dynamic',
419+
values: [
420+
{
421+
mode: 'and',
422+
filters: [
423+
{
424+
key: 'entity_type',
425+
values: ['Malware'],
426+
},
427+
{
428+
key: 'objectLabel',
429+
values: ['ransomware'],
430+
},
431+
],
432+
filterGroups: [],
433+
}
434+
]
435+
},
436+
{
437+
key: 'relationship_type',
438+
values: ['targets']
439+
},
440+
],
441+
},
442+
],
443+
filterGroups: [],
444+
};
445+
```
446+
447+
![DyanmicRegardingOf filter](./assets/filters-dynamicRegardingOf.png)
448+
449+
450+
!!! warning "This filter may exclude some results for technical reasons"
451+
452+
This filter requires a pre-query to fetch entities ids matching the dynamic filter. Then the regardingOf filter is applied on these ids.
453+
Only the first 5000 results of this prequery are taken into account. So the final results may exclude some entities if the number of entities matching the dynamic filter is too large. In this case, a warning is displayed in the UI and you may consider giving a more restrictive dynamic filter.
454+
455+
![DynamicRegardingOf filter with warning](./assets/filters-dynamicRegardingOf-warning.png)
456+
457+
#### The ``dynamicFrom`` and ``dynamicTo`` filter keys
458+
459+
The ``dynamicFrom`` (respectively ``dynamicTo``) filter key is used to apply a given filter on the source (respectively target) of a relationship.
460+
461+
Here is an example of filter used to fetch the relationships whose source is a malware with the 'ransomware' label.
462+
```ts
463+
// Example: relationships whose source entity is a malware with the 'ransomware' label
464+
filters = {
465+
mode: 'and',
466+
filters: [
467+
{
468+
key: 'dynamicFrom',
469+
values: [
470+
{
471+
mode: 'and',
472+
filters: [
473+
{
474+
key: 'entity_type',
475+
values: ['Malware'],
476+
},
477+
{
478+
key: 'objectLabel',
479+
values: ['ransomware'],
480+
},
481+
],
482+
filterGroups: [],
483+
}
484+
],
485+
},
486+
],
487+
filterGroups: [],
488+
};
489+
```
490+
491+
![DynamicFrom filter](./assets/filters-dynamicFrom.png)
492+
400493

401494
#### Limited support in stream events filtering
402495

0 commit comments

Comments
 (0)