Skip to content

[docs] Dynamic filters for relationships and regarding of (#301) #302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added docs/reference/assets/filters-dynamicFrom.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
93 changes: 93 additions & 0 deletions docs/reference/filters.md
Original file line number Diff line number Diff line change
Expand Up @@ -397,6 +397,99 @@ If a values combination may not return all the results because one of the above
![RegardingOf filter with warning](./assets/filters-regardingOf-warning.png)


#### The dynamic regardingOf filter keys

The ``dynamicRegardingOf`` filter key, displayed as `in regards of (dynamic)` in the UI enables to target the entities having a relationship of a certain type with entities matching a given filter.
The ``values`` of this filter can take two subfilters with the ``eq`` opeartor:
- the ``relationship_type`` values indicates which relationship types are concerned
- the ``dynamic`` values contains the filter the entities involved in the relationships should match

Here is an example of filter to fetch the entities targeting malwares with a given label:

```ts
// Example: entities having a relationship of type 'targets' with a malware having a 'ransomware' label
filters = {
mode: 'and',
filters: [
{
key: 'dynamicRegardingOf',
values: [
{
key: 'dynamic',
values: [
{
mode: 'and',
filters: [
{
key: 'entity_type',
values: ['Malware'],
},
{
key: 'objectLabel',
values: ['ransomware'],
},
],
filterGroups: [],
}
]
},
{
key: 'relationship_type',
values: ['targets']
},
],
},
],
filterGroups: [],
};
```

![DyanmicRegardingOf filter](./assets/filters-dynamicRegardingOf.png)


!!! warning "This filter may exclude some results for technical reasons"

This filter requires a pre-query to fetch entities ids matching the dynamic filter. Then the regardingOf filter is applied on these ids.
Only the first 5000 results of this prequery are taken into account. So the final results may exclude some entities if the number of entities matching the dynamic filter is too large. In this case, a warning is displayed in the UI and you may consider giving a more restrictive dynamic filter.

![DynamicRegardingOf filter with warning](./assets/filters-dynamicRegardingOf-warning.png)

#### The ``dynamicFrom`` and ``dynamicTo`` filter keys

The ``dynamicFrom`` (respectively ``dynamicTo``) filter key is used to apply a given filter on the source (respectively target) of a relationship.

Here is an example of filter used to fetch the relationships whose source is a malware with the 'ransomware' label.
```ts
// Example: relationships whose source entity is a malware with the 'ransomware' label
filters = {
mode: 'and',
filters: [
{
key: 'dynamicFrom',
values: [
{
mode: 'and',
filters: [
{
key: 'entity_type',
values: ['Malware'],
},
{
key: 'objectLabel',
values: ['ransomware'],
},
],
filterGroups: [],
}
],
},
],
filterGroups: [],
};
```

![DynamicFrom filter](./assets/filters-dynamicFrom.png)


#### Limited support in stream events filtering

Expand Down