<aside> 💡 On the OpenCTI platform, the direction of the relations between entities matters a lot.
</aside>
Either you add knowledge manually to a report or creating new knowledge programmatically, you have to be aware of the entities-relations model in order to use the platform. This model is based on STIX2 so if you are already familiar with it, you should already be aware of most of the following information.
TODO
OpenCTI is based on an entities-relations model that allows users to connect many entities together. In some cases, it could be interesting that some facts to be automatically inferred from others. For instance, if a campaign targeted the sector of electricity, which is a sub-sector of the energy sector, and is attributed to an intrusion set, the analyst wants to know that this specific intrusion set has targeted the energy sector.
In OpenCTI, this can be represented by:
To derive the implicit facts of this kind of knowledge, OpenCTI relies on the inferences capability of the Grakn database. The result is explained directly in the application when displaying an inferred relation:
The implemented rules are expressed here in pseudo-code.
when {
A attributed-to B
A uses C
}, then {
B uses C
}
when {
A attributed-to B
A targets C
}, then {
B targets C
}