opencti icon indicating copy to clipboard operation
opencti copied to clipboard
verified publisher icon OpenCTI-Platform

Improve graph analysis

Open nino-filigran opened this issue 1 year ago • 2 comments

Use case

Epic to tackle issues to improve graph analysis. These are all the identified isssues.

We'll add more details regarding which will be covere by when.

Forecasted approach

The following approach defines how we want to deliver the features linked to improve graphs. This approach may change in the future. The feature listed in each release might not be tackled directly, but represents the ticekts to follow in each release.

  • In a first release, we will refactor our graphs from a technical standpoint to avoid having as many graph components that we have views having graphs. The goal is to reduce the amount of grpahs to its minimum to be able to easily update them.
    • https://github.com/OpenCTI-Platform/opencti/issues/3524
    • https://github.com/OpenCTI-Platform/opencti/issues/7298
  • In a second release, we will tackle some improvements to allow users to find the information they need easily by allowing to filter on any attribute, to hide the relationship when an entity is hidden & to improve the overall UI of graphs
    • https://github.com/OpenCTI-Platform/opencti/issues/2276
    • https://github.com/OpenCTI-Platform/opencti/issues/2352
    • https://github.com/OpenCTI-Platform/opencti/issues/7052
    • https://github.com/OpenCTI-Platform/opencti/issues/6795
    • https://github.com/OpenCTI-Platform/opencti/issues/1935
    • https://github.com/OpenCTI-Platform/opencti/issues/4946
  • In a third release, we will improve actions you can do to create graphs & you can perform within graphs to make them more usable by easily create an investigation from a list, grouping some items, deleting some items, add quick actions within graphs, enriching from an investigation graph.
    • https://github.com/OpenCTI-Platform/opencti/issues/7503
    • https://github.com/OpenCTI-Platform/opencti/issues/4314
    • https://github.com/OpenCTI-Platform/opencti/issues/6651
  • In a fourth release, we will create dedicated capabilities to perform graph analysis
    • https://github.com/OpenCTI-Platform/opencti/issues/6849
    • https://github.com/OpenCTI-Platform/opencti/issues/6478
  • In a last release we will work on graph performance
    • https://github.com/OpenCTI-Platform/opencti/issues/1718
    • https://github.com/OpenCTI-Platform/opencti/issues/8125

New issues appeared in the meantime:

  • https://github.com/OpenCTI-Platform/opencti/issues/8378

Issues not tackle for now:

  • https://github.com/OpenCTI-Platform/opencti/issues/1253
  • https://github.com/OpenCTI-Platform/opencti/issues/1258
  • https://github.com/OpenCTI-Platform/opencti/issues/2283
  • https://github.com/OpenCTI-Platform/opencti/issues/2590
  • https://github.com/OpenCTI-Platform/opencti/issues/2411
  • https://github.com/OpenCTI-Platform/opencti/issues/7053
  • https://github.com/OpenCTI-Platform/opencti/issues/7505
  • https://github.com/OpenCTI-Platform/opencti/issues/4203
  • https://github.com/OpenCTI-Platform/opencti/issues/3234

Total List of issues

https://github.com/OpenCTI-Platform/opencti/issues/1253 https://github.com/OpenCTI-Platform/opencti/issues/7298 https://github.com/OpenCTI-Platform/opencti/issues/1258 https://github.com/OpenCTI-Platform/opencti/issues/1935 https://github.com/OpenCTI-Platform/opencti/issues/1668 https://github.com/OpenCTI-Platform/opencti/issues/2283 https://github.com/OpenCTI-Platform/opencti/issues/3562 https://github.com/OpenCTI-Platform/opencti/issues/2276 https://github.com/OpenCTI-Platform/opencti/issues/2352 https://github.com/OpenCTI-Platform/opencti/issues/2590 https://github.com/OpenCTI-Platform/opencti/issues/2411 https://github.com/OpenCTI-Platform/opencti/issues/2866 https://github.com/OpenCTI-Platform/opencti/issues/3465 https://github.com/OpenCTI-Platform/opencti/issues/6849 https://github.com/OpenCTI-Platform/opencti/issues/7052 https://github.com/OpenCTI-Platform/opencti/issues/7053 https://github.com/OpenCTI-Platform/opencti/issues/7503 https://github.com/OpenCTI-Platform/opencti/issues/7505 https://github.com/OpenCTI-Platform/opencti/issues/6795 https://github.com/OpenCTI-Platform/opencti/issues/6478 https://github.com/OpenCTI-Platform/opencti/issues/4314 https://github.com/OpenCTI-Platform/opencti/issues/4203 https://github.com/OpenCTI-Platform/opencti/issues/3524 https://github.com/OpenCTI-Platform/opencti/issues/3234 https://github.com/OpenCTI-Platform/opencti/issues/1718 https://github.com/OpenCTI-Platform/opencti/issues/1256 https://github.com/OpenCTI-Platform/opencti/issues/6928 https://github.com/OpenCTI-Platform/opencti/issues/6651 https://github.com/OpenCTI-Platform/opencti/issues/8125

nino-filigran avatar Jun 24 '24 12:06 nino-filigran

Hi,

Is it possible that this https://github.com/OpenCTI-Platform/opencti/issues/6839 is related too?

Thanks in advance

AlexSanchezN avatar Aug 24 '24 10:08 AlexSanchezN

Another issue related to this epic : https://github.com/OpenCTI-Platform/opencti/issues/4946

It's been requested by users and I've personally found through investigation that it will be a game changer.

Lhorus6 avatar Sep 03 '24 16:09 Lhorus6

Here's a PR related that makes a simple change which significantly increases the max count of related elements that are fetched during a correlation query, which should address most of the cases where users are complaining that Correlations are empty when they shouldn't be, or Correlations are not showing expected related items. #9240

ckane avatar Dec 05 '24 02:12 ckane