Add danger zone option to entity types in the entity customization

[ups1decyber]

Use case

We have imported stuff like MITRE Attack TTPs, Sectors, Geographic locations, etc. and we don't want regular users to mess with them (e.g. accidentally delete them, edit them, or create new ones). We would like to use the danger zone mechanism to elevate certain entity types to the danger zone and only allow admins to edit/create/delete such entities.

Current Workaround

None

Proposed Solution

In the entity customization, add an option to elevate an entity type to the danger zone. Entity types that are in the danger zone, should not be modifiable in any way by regular users, but only by users with the danger zone permission.

Additional Information

If the feature request is approved, would you be willing to submit a PR?

No

[nino-filigran]

@ups1decyber you should already be able to do this by:

• adding all the users that should not do this in a specific group
• assign to this group some low confidence levels on the specific entities that you have mentioned (even better a 0 confidence level): this way, they will not be able to delete/edit these entities!

Does that answer your need?

[ups1decyber]

Hi @nino-filigran

That approach would technically work, but it's not quite what I want for multiple reasons:

Firstly, users can still create new entities. For example, a user with a max confidence of 99 can still create a new Attack Pattern (though its max confidence would be 99 and not 100).

Secondly, there are some users who are also in an Admin group with max confidence. Such users are still prone to (for example) accidentally deleting entities while working in a report's knowledge graph. Having the option to protect certain entity types using the danger zone mechanism would actually prevent this (or at least show an additional warning dialog that clearly indicates that some dangerous operation is about to be executed).

And lastly, I am wondering why the confidence/credbility is used for access control. Wouldn't it make much more sense to use the reliability instead? I feel like less reliable sources should not be allowed to modify highly reliable information regardless of the confidence level, because an unreliable source is unreliable for a reason and could, for example, falsely assess high confidence.