You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/docs/administration/notifiers.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -60,5 +60,5 @@ Custom notifiers are manageable in the "Settings > Customization > Notifiers" wi
60
60
61
61
For guidance on configuring notification triggers and exploring the usages of notifiers, refer to the [dedicated documentation page](../usage/notifications.md).
62
62
63
-
For security reason, the authorized methods that can be used in webhook template is limited, see [notifier_authorized_functions parameter](https://github.com/OpenCTI-Platform/opencti/blob/master/opencti-platform/opencti-graphql/config/default.json).
64
-
If you need to extend this authorization, you can update `APP__NOTIFIER_AUTHORIZED_FUNCTIONS` with a custom list. The default managed list by OpenCTI is safe, please be aware that you extends this list at your own risk.
63
+
For security reasons, the authorized methods that can be used in webhook template is limited, see [notifier_authorized_functions parameter](https://github.com/OpenCTI-Platform/opencti/blob/master/opencti-platform/opencti-graphql/config/default.json).
64
+
If you need to extend this authorization, you can update `APP__NOTIFIER_AUTHORIZED_FUNCTIONS` with a custom list. The default managed list by OpenCTI is safe, please be aware that you extend this list at your own risk.
Copy file name to clipboardExpand all lines: docs/docs/deployment/authentication.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@
6
6
7
7
SSO configuration is under the [OpenCTI Enterprise Edition](https://docs.opencti.io/latest/administration/enterprise/?h=ente) license.
8
8
9
-
With version 7.260224.0, defining & using authentication strategies is an Entreprise Edition feature. Using local authentication will be the unique way to login for Community Edition. More information in [this page](breaking-changes/7.260224.0-SSO-authentication-migration.md)
9
+
With version 7.260224.0, defining & using authentication strategies is an Enterprise Edition feature. Using local authentication will be the unique way to login for Community Edition. More information in [this page](breaking-changes/7.260224.0-SSO-authentication-migration.md)
10
10
11
11
Additionally, given the introduction of the capability to define [authentications via UI](../administration/authentication-via-ui.md), **defining authentication via environment variable will be decommissioned after some time (you will be warned before this change will be effective with enough time to ensure all needed actions are taken)**
12
12
@@ -31,7 +31,7 @@ Under the hood, we technically use the strategies provided by [PassportJS](http:
31
31
32
32
This strategy uses the OpenCTI database as a user management.
33
33
34
-
OpenCTI use this strategy as the default, but it's not the one we recommend for security reasons.
34
+
OpenCTI uses this strategy as the default, but it's not the one we recommend for security reasons.
35
35
36
36
```json
37
37
"local": {
@@ -234,7 +234,7 @@ Here is an example of OpenID configuration using environment variables:
234
234
- PROVIDERS__OPENID__CONFIG__LOGOUT_REMOTE=false
235
235
```
236
236
237
-
OpenCTI support mapping OpenID Claims on OpenCTI Groups (everything is tied to a group in the platform). Here is an example:
237
+
OpenCTI supports mapping OpenID Claims on OpenCTI Groups (everything is tied to a group in the platform). Here is an example:
Copy file name to clipboardExpand all lines: docs/docs/usage/automation.md
+18-18Lines changed: 18 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -49,13 +49,13 @@ To do so, click on the grey rectangle in the center of the workspace and select
49
49
50
50
### Duplicate a playbook
51
51
52
-
It is possible to duplicate a playbook, to easily replicate a playbook. You can do it directly by cliking on the burger menu (the 3 dots) at the end of the row and click on duplicate, or directly when you're inside a playbook.
52
+
It is possible to duplicate a playbook, to easily replicate a playbook. You can do it directly by clicking on the burger menu (the 3 dots) at the end of the row and click on duplicate, or directly when you're inside a playbook.
53
53
54
54
### Import/Export a playbook
55
55
56
56
#### Export a playbook
57
57
58
-
If you need to share a playbook with a colleague that is not on the same platform than you (or if you need to troubleshoot a playbook issue), you can now export your playbook directly: by cliking on the burger menu (the 3 dots) at the end of the row and click on duplicate, or directly when you're inside a playbook.
58
+
If you need to share a playbook with a colleague that is not on the same platform than you (or if you need to troubleshoot a playbook issue), you can now export your playbook directly: by clicking on the burger menu (the 3 dots) at the end of the row and click on duplicate, or directly when you're inside a playbook.
59
59
60
60
#### Import a playbook
61
61
@@ -260,36 +260,36 @@ Compared to other components, this component **makes a direct call to the databa
260
260
261
261
#### Manage Access Restriction
262
262
263
-
Will apply authorized members on the bundle within the playbook. It is only compatible with entities supportsing authorized members (Containers, Drafts, Organization).
263
+
Will apply authorized members on the bundle within the playbook. It is only compatible with entities supporting authorized members (Containers, Drafts, Organization).
264
264
You can decide to only apply restrictions on the triggering element or the whole bundle by enabling the toggle.
265
265
266
266
More details on [Authorize members](https://docs.opencti.io/latest/administration/authorized-members/?h=me)
267
267
268
268
##### Specificities of the component
269
269
Compared to other components, this component **makes direct call to the database**: this means that the query will be applied before the "send to ingestion" step. As a result, if, **within the same playbook**, you attempt to create a new entity (via the wrap in container step) and apply authorized members, the playbook will fail. Indeed, the entity will not yet be created, since it won't be sent to ingestion yet. You need to apply the authorized members in another playbook to achieve this use case.
270
270
271
-
**This component supportss dynamic variables**
271
+
**This component supports dynamic variables**
272
272
273
273
- Dynamic from the main entity triggering the playbook: Will apply the authorized members on the corresponding user of the field you choose, based on the triggering entity only. you can choose among:
274
274
- Author (organisation): If your author is an organisation, you will be able to apply authorized members directly on the organisation in author.
275
275
- Creator: Will apply the authorized members on all users in Creator field.
276
-
- Assignee: Will apply the authorized members on all users in Asignee field.
276
+
- Assignee: Will apply the authorized members on all users in Assignee field.
277
277
- Participant: Will apply the authorized members on all users in Participants field.
278
278
279
279
- Dynamic from the object in the bundle of the playbook: will apply the authorized members on all the corresponding users of all the entities contained in your bundle and not only the triggering entity.
280
280
- Organization: all users belonging to the organizations in your bundle will be added as authorized members.
281
281
282
-
**The component also supportss static fields, used for authorized members: users, groups & organizations.**
282
+
**The component also supports static fields, used for authorized members: users, groups & organizations.**
283
283
284
284
#### Remove Access Restriction
285
285
Compared to other components, this component **makes direct call to the database**: this means that the query will be applied before the "send to ingestion" step. As a result, if, **within the same playbook**, you attempt to create a new entity (via the wrap in container step) and remove default authorized members, the playbook will fail. Indeed, the entity will not yet be created, since it won't be sent to ingestion yet. You need to remove the authorized members in another playbook to achieve this use case.
286
286
287
-
Will remove authorized members on the bundle within the playbook. It is only compatible with entities supportsing authorized members (Containers, Drafts).
287
+
Will remove authorized members on the bundle within the playbook. It is only compatible with entities supporting authorized members (Containers, Drafts).
288
288
You can decide to only remove restriction on the triggering element or the whole bundle by enabling the toggle.
289
289
290
290
##### Specificities of the component
291
291
292
-
**This component supportss dynamic variables**
292
+
**This component supports dynamic variables**
293
293
294
294
- Dynamic from the main entity triggering the playbook: Will remove the authorized members on the corresponding user of the field you choose, based on the triggering entity only. you can choose among:
295
295
- Author (organisation): If your author is an organisation, you will be able to remove the organization from the authorized members.
@@ -300,7 +300,7 @@ You can decide to only remove restriction on the triggering element or the whole
300
300
- Dynamic from the object in the bundle of the playbook: will remove the authorized members on all the corresponding users of all the entities contained in your bundle and not only the triggering entity.
301
301
- Organization: all users belonging to the organizations in your bundle will be removed from authorized members.
302
302
303
-
**The component also supportss static fields, used for authorized members: users, groups & organizations.**
303
+
**The component also supports static fields, used for authorized members: users, groups & organizations.**
304
304
305
305
306
306
### Apply predefined rule
@@ -321,7 +321,7 @@ For instance, the following operation will not work within a playbook: listen to
321
321
322
322
**Routes:**
323
323
324
-
- Unmodified: because of the above reason, if none of your entities or observables contained in your STIX bundle have been impacted by the rule, then the STIX bundle will follow will follow the **unmodified** route.
324
+
- Unmodified: because of the above reason, if none of your entities or observables contained in your STIX bundle have been impacted by the rule, then the STIX bundle will follow the **unmodified** route.
325
325
- Out: if at least one of the entity or observable of your STIX bundle has been successfully impacted by the rule, then the STIX bundle will follow the **Out** route.
326
326
327
327
### Send to notifier
@@ -335,7 +335,7 @@ Will send an email using the template that you can set in Parameters/security (u
335
335
336
336
##### Specificities of the component
337
337
338
-
**This component supportss dynamic variables**
338
+
**This component supports dynamic variables**
339
339
340
340
- Dynamic from the main entity triggering the playbook as Target: will send the email using the selected template to the corresponding user of the field you choose, based on the triggering entity only. you can choose among:
341
341
- Creator: Will send an email using an Email Template to the corresponding user.
@@ -345,7 +345,7 @@ Will send an email using the template that you can set in Parameters/security (u
345
345
- Dynamic from the object in the bundle of the playbook as Target: will send the email using the selected template to the corresponding user of the entities contained in your bundle and not only the triggering entity.
346
346
- Organization: all users of all organizations contained in your bundle will receive an email.
347
347
348
-
**The component also supportss static fields, used for authorized members: users, groups & organizations.**
348
+
**The component also supports static fields, used for authorized members: users, groups & organizations.**
349
349
350
350
### Promote observable to indicator
351
351
@@ -355,7 +355,7 @@ By default, it is applied to entities having triggered the playbook. You can tog
355
355
356
356
You can also add all indicators and relationships generated by this component in the entity having triggered the playbook, if this entity is a container.
357
357
358
-
#### Specifities of the component
358
+
#### Specificities of the component
359
359
360
360
**Routes:**
361
361
@@ -370,7 +370,7 @@ By default, it is applied to entities having triggered the playbook. You can tog
370
370
371
371
You can also add all observables and relationships generated by this component in the entity having triggered the playbook, if this entity is a container.
372
372
373
-
#### Specifities of the component
373
+
#### Specificities of the component
374
374
375
375
**Routes:**
376
376
@@ -385,7 +385,7 @@ Will filter out any entities in the current stage that do not match the filter c
385
385
386
386
**Reduce will not work if the result of your reduce knowledge step is different from the entity triggering your playbook:**
387
387
388
-
If the result of the reduce knowledge ends up not matching the initial entity triggering yur playbook, then the reduce step will fail. As an example:
388
+
If the result of the reduce knowledge ends up not matching the initial entity triggering your playbook, then the reduce step will fail. As an example:
389
389
With a first step listening on: entity type = IPV4 OR Report AND label = test. And a step that reduces knowledge based on Entity type = IPV4. You will get the following results:
390
390
391
391
@@ -400,7 +400,7 @@ With a first step listening on: entity type = IPV4 OR Report AND label = test. A
400
400
401
401
**Routes:**
402
402
403
-
- Unmatched: if the bundle does not match the reduce condition, then the stix bundle will follow the **unmatch** route. In this case, the playbook will act as the route "umatch" of the "match" component.
403
+
- Unmatched: if the bundle does not match the reduce condition, then the stix bundle will follow the **unmatched** route. In this case, the playbook will act as the route "unmatched" of the "match" component.
404
404
- Out: if your bundle is effectively reduced, then the stix bundle will follow the **Out** route.
405
405
406
406
### Match knowledge
@@ -433,10 +433,10 @@ In this list, you will find:
433
433
434
434
At the top right of the interface, you can access execution trace of your playbook and consult the raw data after every step of your playbook execution.
435
435
436
-
### Useful for troublshooting
436
+
### Useful for troubleshooting
437
437
438
438
- Fewer steps than the number of steps of your playbook: If your playbook contains, for instance, 5 steps and only 4 steps are shown, it means that the playbook stopped at the 4th step.
439
439
- Data created/ingested by the playbook does not contain the right modifications applied in the manipulate step: verify that your step is present, and that the operations you wanted to apply are well applied (you need to see the operation type, the field & the value)
440
-
- Use the different routes to help troubleshoot your playbook: if you're using multiple components that involves mutliple routes, it is sometimes useful to test your playbook by adding a "manipulate knowledge" step to add a label for instance, to understand the route your bundle is taking if you feel that the data created by your playbook is not the one you expect.
440
+
- Use the different routes to help troubleshoot your playbook: if you're using multiple components that involves multiple routes, it is sometimes useful to test your playbook by adding a "manipulate knowledge" step to add a label for instance, to understand the route your bundle is taking if you feel that the data created by your playbook is not the one you expect.
0 commit comments