[backend] wip breakdown api

opencti-platform/opencti-front/src/schema/relay.schema.graphql

@@ -7385,8 +7385,10 @@ type Query {
   publicStixCoreObjectsMultiTimeSeries(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [MultiTimeSeries]
   publicStixRelationshipsMultiTimeSeries(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [MultiTimeSeries]
   publicStixCoreObjectsDistribution(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [Distribution]
+  publicStixCoreObjectsDistributionBreakdown(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [Distribution]
   publicStixRelationshipsDistribution(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [Distribution]
-  publicBookmarks(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): StixDomainObjectConnection
+  publicStixRelationshipsDistributionBreakdown(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [Distribution]
+  publicBookmarks(uriKey: String!, widgetId: String!): StixDomainObjectConnection
   publicStixCoreObjects(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): StixCoreObjectConnection
   publicStixRelationships(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): StixRelationshipConnection
 }

opencti-platform/opencti-graphql/src/generated/graphql.ts

@@ -17560,10 +17560,12 @@ export type Query = {
   publicDashboards?: Maybe<PublicDashboardConnection>;
   publicStixCoreObjects?: Maybe<StixCoreObjectConnection>;
   publicStixCoreObjectsDistribution?: Maybe<Array<Maybe<Distribution>>>;
+  publicStixCoreObjectsDistributionBreakdown?: Maybe<Array<Maybe<Distribution>>>;
   publicStixCoreObjectsMultiTimeSeries?: Maybe<Array<Maybe<MultiTimeSeries>>>;
   publicStixCoreObjectsNumber?: Maybe<Number>;
   publicStixRelationships?: Maybe<StixRelationshipConnection>;
   publicStixRelationshipsDistribution?: Maybe<Array<Maybe<Distribution>>>;
+  publicStixRelationshipsDistributionBreakdown?: Maybe<Array<Maybe<Distribution>>>;
   publicStixRelationshipsMultiTimeSeries?: Maybe<Array<Maybe<MultiTimeSeries>>>;
   publicStixRelationshipsNumber?: Maybe<Number>;
   rabbitMQMetrics?: Maybe<RabbitMqMetrics>;
@@ -18895,8 +18897,6 @@ export type QueryPositionsArgs = {
 
 
 export type QueryPublicBookmarksArgs = {
-  endDate?: InputMaybe<Scalars['DateTime']['input']>;
-  startDate?: InputMaybe<Scalars['DateTime']['input']>;
   uriKey: Scalars['String']['input'];
   widgetId: Scalars['String']['input'];
 };
@@ -18938,6 +18938,14 @@ export type QueryPublicStixCoreObjectsDistributionArgs = {
 };
 
 
+export type QueryPublicStixCoreObjectsDistributionBreakdownArgs = {
+  endDate?: InputMaybe<Scalars['DateTime']['input']>;
+  startDate?: InputMaybe<Scalars['DateTime']['input']>;
+  uriKey: Scalars['String']['input'];
+  widgetId: Scalars['String']['input'];
+};
+
+
 export type QueryPublicStixCoreObjectsMultiTimeSeriesArgs = {
   endDate?: InputMaybe<Scalars['DateTime']['input']>;
   startDate?: InputMaybe<Scalars['DateTime']['input']>;
@@ -18970,6 +18978,14 @@ export type QueryPublicStixRelationshipsDistributionArgs = {
 };
 
 
+export type QueryPublicStixRelationshipsDistributionBreakdownArgs = {
+  endDate?: InputMaybe<Scalars['DateTime']['input']>;
+  startDate?: InputMaybe<Scalars['DateTime']['input']>;
+  uriKey: Scalars['String']['input'];
+  widgetId: Scalars['String']['input'];
+};
+
+
 export type QueryPublicStixRelationshipsMultiTimeSeriesArgs = {
   endDate?: InputMaybe<Scalars['DateTime']['input']>;
   startDate?: InputMaybe<Scalars['DateTime']['input']>;
@@ -34929,10 +34945,12 @@ export type QueryResolvers<ContextType = any, ParentType extends ResolversParent
   publicDashboards?: Resolver<Maybe<ResolversTypes['PublicDashboardConnection']>, ParentType, ContextType, Partial<QueryPublicDashboardsArgs>>;
   publicStixCoreObjects?: Resolver<Maybe<ResolversTypes['StixCoreObjectConnection']>, ParentType, ContextType, RequireFields<QueryPublicStixCoreObjectsArgs, 'uriKey' | 'widgetId'>>;
   publicStixCoreObjectsDistribution?: Resolver<Maybe<Array<Maybe<ResolversTypes['Distribution']>>>, ParentType, ContextType, RequireFields<QueryPublicStixCoreObjectsDistributionArgs, 'uriKey' | 'widgetId'>>;
+  publicStixCoreObjectsDistributionBreakdown?: Resolver<Maybe<Array<Maybe<ResolversTypes['Distribution']>>>, ParentType, ContextType, RequireFields<QueryPublicStixCoreObjectsDistributionBreakdownArgs, 'uriKey' | 'widgetId'>>;
   publicStixCoreObjectsMultiTimeSeries?: Resolver<Maybe<Array<Maybe<ResolversTypes['MultiTimeSeries']>>>, ParentType, ContextType, RequireFields<QueryPublicStixCoreObjectsMultiTimeSeriesArgs, 'uriKey' | 'widgetId'>>;
   publicStixCoreObjectsNumber?: Resolver<Maybe<ResolversTypes['Number']>, ParentType, ContextType, RequireFields<QueryPublicStixCoreObjectsNumberArgs, 'uriKey' | 'widgetId'>>;
   publicStixRelationships?: Resolver<Maybe<ResolversTypes['StixRelationshipConnection']>, ParentType, ContextType, RequireFields<QueryPublicStixRelationshipsArgs, 'uriKey' | 'widgetId'>>;
   publicStixRelationshipsDistribution?: Resolver<Maybe<Array<Maybe<ResolversTypes['Distribution']>>>, ParentType, ContextType, RequireFields<QueryPublicStixRelationshipsDistributionArgs, 'uriKey' | 'widgetId'>>;
+  publicStixRelationshipsDistributionBreakdown?: Resolver<Maybe<Array<Maybe<ResolversTypes['Distribution']>>>, ParentType, ContextType, RequireFields<QueryPublicStixRelationshipsDistributionBreakdownArgs, 'uriKey' | 'widgetId'>>;
   publicStixRelationshipsMultiTimeSeries?: Resolver<Maybe<Array<Maybe<ResolversTypes['MultiTimeSeries']>>>, ParentType, ContextType, RequireFields<QueryPublicStixRelationshipsMultiTimeSeriesArgs, 'uriKey' | 'widgetId'>>;
   publicStixRelationshipsNumber?: Resolver<Maybe<ResolversTypes['Number']>, ParentType, ContextType, RequireFields<QueryPublicStixRelationshipsNumberArgs, 'uriKey' | 'widgetId'>>;
   rabbitMQMetrics?: Resolver<Maybe<ResolversTypes['RabbitMQMetrics']>, ParentType, ContextType, Partial<QueryRabbitMqMetricsArgs>>;

opencti-platform/opencti-graphql/src/modules/publicDashboard/publicDashboard-domain.ts

@@ -21,6 +21,8 @@ import type {
   QueryPublicBookmarksArgs,
   QueryPublicStixCoreObjectsArgs,
   QueryPublicStixRelationshipsArgs,
+  QueryPublicStixCoreObjectsDistributionBreakdownArgs,
+  QueryPublicStixRelationshipsDistributionBreakdownArgs,
 } from '../../generated/graphql';
 import { FunctionalError, UnsupportedError } from '../../config/errors';
 import { SYSTEM_USER } from '../../utils/access';
@@ -36,6 +38,7 @@ import { stixRelationshipsDistribution, stixRelationshipsMultiTimeSeries, stixRe
 import { bookmarks, computeAvailableMarkings } from '../../domain/user';
 import { getMaxMarkings } from '../../domain/settings';
 import { dayAgo } from '../../utils/format';
+import { isStixCoreObject } from '../../schema/stixCoreObject';
 
 export const findById = (
   context: AuthContext,
@@ -382,6 +385,39 @@ export const publicStixCoreObjectsDistribution = async (
   return stixCoreObjectsDistribution(context, user, parameters);
 };
 
+// breakdown
+export const publicStixCoreObjectsDistributionBreakdown = async (
+  context: AuthContext,
+  args: QueryPublicStixCoreObjectsDistributionBreakdownArgs
+) => {
+  const { user, dataSelection } = await getWidgetArguments(context, args.uriKey, args.widgetId);
+
+  const selection = dataSelection[0];
+  const filters = {
+    filterGroups: [selection.filters],
+    filters: [],
+    mode: 'and'
+  };
+
+  const parameters = {
+    startDate: args.startDate,
+    endDate: args.endDate,
+    filters,
+    toTypes: selection.toTypes,
+    field: selection.attribute,
+    dateAttribute: selection.date_attribute || 'created_at',
+    operation: 'count',
+    limit: selection.number ?? 10,
+    types: [
+      ABSTRACT_STIX_CORE_OBJECT,
+    ],
+  };
+
+  const rootDistribution = await stixCoreObjectsDistribution(context, user, parameters);
+  console.log(rootDistribution);
+  return rootDistribution;
+};
+
 export const publicStixRelationshipsDistribution = async (
   context: AuthContext,
   args: QueryPublicStixRelationshipsDistributionArgs
@@ -413,6 +449,77 @@ export const publicStixRelationshipsDistribution = async (
   return stixRelationshipsDistribution(context, user, parameters);
 };
 
+export const publicStixRelationshipsDistributionBreakdown = async (
+  context: AuthContext,
+  args: QueryPublicStixRelationshipsDistributionBreakdownArgs
+) => {
+  const { user, dataSelection } = await getWidgetArguments(context, args.uriKey, args.widgetId);
+  context.user = user;
+
+  const selection = dataSelection[0];
+  const breakdownSelection = dataSelection[1];
+
+  const filters = {
+    filterGroups: [selection.filters],
+    filters: [],
+    mode: 'and'
+  };
+
+  const parameters = {
+    operation: 'count',
+    field: selection.attribute || 'entity_type',
+    startDate: args.startDate,
+    endDate: args.endDate,
+    filters,
+    dynamicFrom: selection.dynamicFrom,
+    dynamicTo: selection.dynamicTo,
+    dateAttribute: selection.date_attribute,
+    isTo: selection.isTo,
+    limit: selection.number,
+  };
+
+  // Use standard API
+  const rootDistribution = await stixRelationshipsDistribution(context, user, parameters);
+
+  return Promise.all(rootDistribution
+    .map(async (distrib) => {
+      if (!isStixCoreObject(distrib.entity.entity_type)) {
+        return distrib;
+      }
+      const breakdownFilters = {
+        filterGroups: [breakdownSelection.filters],
+        filters: [{
+          key: ['fromId'],
+          values: [distrib.entity.id],
+          mode: 'and',
+          operator: 'eq',
+        }],
+        mode: 'and'
+      };
+
+      const breakdownParameters = {
+        operation: 'count',
+        field: breakdownSelection.attribute || 'entity_type',
+        startDate: args.startDate,
+        endDate: args.endDate,
+        filters: breakdownFilters,
+        dynamicFrom: breakdownSelection.dynamicFrom,
+        dynamicTo: breakdownSelection.dynamicTo,
+        dateAttribute: breakdownSelection.date_attribute,
+        isTo: breakdownSelection.isTo,
+        limit: breakdownSelection.number,
+      };
+
+      return {
+        ...distrib,
+        entity: {
+          ...distrib.entity,
+          stixRelationshipsDistribution: await stixRelationshipsDistribution(context, user, breakdownParameters),
+        }
+      };
+    }));
+};
+
 // bookmarks
 export const publicBookmarks = async (
   context: AuthContext,

opencti-platform/opencti-graphql/src/modules/publicDashboard/publicDashboard-resolvers.ts

@@ -15,7 +15,9 @@ import {
   publicStixRelationshipsDistribution,
   publicBookmarks,
   publicStixCoreObjects,
-  publicStixRelationships
+  publicStixRelationships,
+  publicStixCoreObjectsDistributionBreakdown,
+  publicStixRelationshipsDistributionBreakdown,
 } from './publicDashboard-domain';
 import { getAuthorizedMembers } from '../../utils/authorizedMembers';
 
@@ -29,7 +31,9 @@ const publicDashboardResolvers: Resolvers = {
     publicStixRelationshipsMultiTimeSeries: (_, args, context) => publicStixRelationshipsMultiTimeSeries(context, args),
     publicStixRelationshipsNumber: (_, args, context) => publicStixRelationshipsNumber(context, args),
     publicStixCoreObjectsDistribution: (_, args, context) => publicStixCoreObjectsDistribution(context, args),
+    publicStixCoreObjectsDistributionBreakdown: (_, args, context) => publicStixCoreObjectsDistributionBreakdown(context, args),
     publicStixRelationshipsDistribution: (_, args, context) => publicStixRelationshipsDistribution(context, args),
+    publicStixRelationshipsDistributionBreakdown: (_, args, context) => publicStixRelationshipsDistributionBreakdown(context, args),
     publicBookmarks: (_, args, context) => publicBookmarks(context, args),
     publicStixCoreObjects: (_, args, context) => publicStixCoreObjects(context, args),
     publicStixRelationships: (_, args, context) => publicStixRelationships(context, args),

opencti-platform/opencti-graphql/src/modules/publicDashboard/publicDashboard.graphql

@@ -75,12 +75,24 @@ type Query {
     startDate: DateTime
     endDate: DateTime
   ): [Distribution]
+  publicStixCoreObjectsDistributionBreakdown(
+    uriKey: String!
+    widgetId : String!
+    startDate: DateTime
+    endDate: DateTime
+  ): [Distribution]
   publicStixRelationshipsDistribution(
     uriKey: String!
     widgetId : String!
     startDate: DateTime
     endDate: DateTime
   ): [Distribution]
+  publicStixRelationshipsDistributionBreakdown(
+    uriKey: String!
+    widgetId : String!
+    startDate: DateTime
+    endDate: DateTime
+  ): [Distribution]
   publicBookmarks(
     uriKey: String!
     widgetId : String!