opencti icon indicating copy to clipboard operation
opencti copied to clipboard

Bulk Add of Singular Dimension Observables

Open ParamConstructor opened this issue 1 year ago • 5 comments

Proposed changes

  • Ability to add via a TT button (like on the Import Text Page) multiple single dimension observables
  • On the normal Create Observable form - a TT has been added next to the value field
  • Click the TT will launch the Dialog to Add Multiple Single Dimension observables - one per line
  • Clicking Continue will update the value field of the form to say "Multiple Values Entered Edit with the TT Button". The field is now disabled and can only be updated via the TT Dialog window
  • Clicking Cancel (within the TT Dialog) will clear the TT dialog, clear the normal value dialog, and re-enable the value field.
  • Blanking out the TT input field and clicking Continue with an empty Bulk Add form - will just leave the normal value field blank and enabled.
  • If TT is used and there is an Associated/Attached File - it is removed.
  • If the TT is used, the Associated/Attached File field will become disabled for use.
  • A progress bar has been added to this process, since it might be possible a user would insert say 100 records, however on testing with normal amounts (10/20 records) they seemed to add instantaneously.
  • Language translations have been added for the various dialog fields added that require translation.

Original Design Pattern

image

Updated Design Pattern to Implement (Jun/2024)

  • TT button has been replaced with a Add Multiple Values button
  • Bulk Observable Creation title replaced with Multiple Observable Title
  • Direction to Import page provided when attempting to add 50+ records and Continue button disappears image

Related issues

  • N/A

Checklist

  • [X] I consider the submitted work as finished
  • [X] I tested the code for its functionality
  • [ ] I wrote test cases for the relevant uses case
  • [ ] I added/update the relevant documentation (either on github or on notion)
  • [X] Where necessary I refactored code to improve the overall quality

Further comments

This has been rebased against "master" from the current time of submission.

ParamConstructor avatar Mar 01 '24 20:03 ParamConstructor

@SamuelHassine Can I work on this issue?

codecov[bot] avatar Mar 01 '24 21:03 codecov[bot]

For reviewers: https://www.notion.so/filigran/Observables-Bulk-creation-e7b786e203e6431380ef249b90071972

Jipegien avatar Mar 04 '24 09:03 Jipegien

@aHenryJard - Sorry for the delay on this - made the requested changes, rebased, and please give a review again.

ParamConstructor avatar May 07 '24 18:05 ParamConstructor

@aHenryJard - Rebased to 6.1.8 from this morning and issues above corrected. Please re-review when you have a sec.

ParamConstructor avatar Jun 04 '24 15:06 ParamConstructor

@aHenryJard / @lndrtrbn - This PR is ready again for re-review. There is a coded in 2 second sleep between batching of sets of observables (5 at a time) so the progress bar can be "watched". Believe there was a conversation about having this in there permanently as a User Perceived Performance thing... but it can certainly be removed. I have left it in for testing and an "official" guidance on leave it or remove it.

ParamConstructor avatar Jun 26 '24 16:06 ParamConstructor

@lndrtrbn - Build failing in the pipeline currently - seems 6.2.6 PyCTI not fully published... but the changes should all be in this build that have been discussed/negotiated with @Jipegien. I'll maybe re-push later to see if pipeline can find the PyCTI 6.2.6 build - but the code will not be changing with a re-push.

ParamConstructor avatar Jul 18 '24 15:07 ParamConstructor

@ParamConstructor thanks! You don't have to bother repush later. I'll integrate the work of this PR directly inside mine (bulk for entities) because it would be lot easier than making a big rebase after.

lndrtrbn avatar Jul 18 '24 15:07 lndrtrbn

@lndrtrbn has merged this capability into some larger set of work via this commit to master - https://github.com/OpenCTI-Platform/opencti/commit/74352ef2c5cdec209798fe663991dd9256fab9a4 - this PR will be closed.

ParamConstructor avatar Aug 06 '24 17:08 ParamConstructor