connectors
connectors copied to clipboard
OpenCTI-Platform
[AlienVault] add an import option to ingest only pulses to which the user subscribed to
Use case
Alienvault source is no reliable per say, some pulses of specific sources are. It would be relevant to let the choice to the user to ingest either everything from a specific date (curent state) or only pulses to which the user subscribed to.
Current Workaround
No identified workaround except not activating that connector.
Proposed Solution
add an option into the docker-compose to let the user choose whether only pulses to which the user subscribed to is more suited or not.
Additional Information
No addition information
If the feature request is approved, would you be willing to submit a PR?
YES
Yes / No (Help can be provided if you need assistance submitting a PR)
Doesn't the alienvault connector already only pull subscribed pulses? its querying the {base_url}/pulses/subscribed endpoint.
You might be right, at least it is not clear at the first glance what the connector does, so having an explicit option into the docker-compose could clarify things without having to study the source code of the connector.
I confirm that the AlienVault connector only pull information your user/API key is subscribed to. Unsubscribe the default AlienVault user if needed on the AlienVault side.
