Streaming: Negative filtering should work like Organization sharing & user TLP permissions about opencti

[ristowee]

Hello @richard-julien @SamuelHassine ,
Have you had time to consider if this proposal makes any sense?
We are currently stamping TLP:AMBER to data, which we do not want to stream outside our main system but that does not seem like a long-term solution.

[Jipegien]

Hello @ristowee :)
In OpenCTI, only Marking Definition and Organization sharing can be leverage for data segregation. It allows to keep consistency on this subject by binding it to the RBAC defined in the platform AND to keep data consistency for the majority of data sharing cases.

Thus, in live stream, you cannot limit data access with filters, but with the RBAC associated with the user you defined to be used with the live stream. in your case, you must apply a specific marking definition when an entity is created with the specific author and verify that the user associated with the stream does not have this marking definition. In a nutshell, you need to explicitly tell the context in which an Entity can be shared (Marking).

When respecting this approach, I think of 2 possible improvements:

• Add specific filters for dependencies in the Data sharing/Live Stream configuration, to narrow down related entities that can be shared (but it will have some limitation as it will not apply directly on relationships)
• In Data sharing/Live Stream configuration, have an option to block dependencies resolution (but it will limit the value of the data shared)

[Jipegien]

Hello @ristowee !

Is the following solution work for your use case?

• create a marking definition "AuthorXmarking"
• create a playbook adding this marking whenever an Object has the author="AuthorX"
• create a stream with any filter you want
• associate to the stream a user without the marking "AuthorXmarking"

The result should be a stream that does not contain any object or relation with the Author=AuthorX

This work around allows to keep the segregation concern at user side, and not at filter side. Your last proposition of adding a no_dependencies flag in the the data sharing/octi live stream does not keep the segregation concern at user side unfortunetly.