Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

kestrel_datasource_stixshifter doesn't delete searches #458

Closed
pcoccoli opened this issue Jan 12, 2024 · 1 comment
Closed

kestrel_datasource_stixshifter doesn't delete searches #458

pcoccoli opened this issue Jan 12, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@pcoccoli
Copy link
Collaborator

Describe the bug
stix-shifter has a "transmit delete" operation (stix_transmission.DELETE) but the interface doesn't use it. On some data sources (e.g. qradar, gcp_chronicle, bigquery) this should result in old searches/search results being orphaned on the data source.

After fetching all results, we should call the delete operation. Some stix-shifter modules may not implement it, so we need to catch (and ignore or just log) NotImplementedError.

@pcoccoli pcoccoli added the bug Something isn't working label Jan 12, 2024
@subbyte subbyte closed this as completed Jan 17, 2024
@subbyte
Copy link
Member

subbyte commented Jan 17, 2024

#460

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants