[frontend/backend] 'Only equal to' new filter operator (#5220) by Archidoit · Pull Request #14543 · OpenCTI-Platform/opencti

Archidoit · 2026-02-20T15:10:09Z

Proposed changes

Add 2 new filter operators: 'only_eq_to' and 'not_only_eq_to'

Frontend: add the new operators for filters that can have several values
Backend implementation: handling the new operators for stix filtering and dynamic filtering
Backend tests
Documentation

Related issues

#5220

Screenshot

opencti-platform/opencti-graphql/src/database/engine.ts

codecov · 2026-02-20T15:17:20Z

Codecov Report

❌ Patch coverage is 91.66667% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 32.40%. Comparing base (58e8edf) to head (e88b417).
⚠️ Report is 21 commits behind head on master.

Files with missing lines	Patch %	Lines
...m/opencti-front/src/utils/filters/filtersUtils.tsx	0.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #14543      +/-   ##
==========================================
+ Coverage   32.36%   32.40%   +0.04%     
==========================================
  Files        3096     3096              
  Lines      210889   211185     +296     
  Branches    38195    38364     +169     
==========================================
+ Hits        68255    68437     +182     
- Misses     142634   142748     +114

Flag	Coverage Δ
opencti-client-python	`45.50% <ø> (ø)`
opencti-front	`2.83% <0.00%> (+<0.01%)`	⬆️
opencti-graphql	`67.79% <100.00%> (+0.05%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

opencti-platform/opencti-graphql/src/database/engine.ts

esrevi · 2026-02-26T13:09:52Z

opencti-platform/opencti-graphql/tests/02-dataInjection/01-dataCount/elasticSearch-test.js

    expect(entityTypeMap.get('RetentionRule')).toBe(entitiesCounter.RetentionRule);
    expect(data.edges.length).toEqual(entitiesCounterTotal);
-    const filterBaseTypes = R.uniq(R.map((e) => e.node.base_type, data.edges));
+    const filterBaseTypes = R.uniq(data.edges.map((e) => e.node.base_type));


I think this should be equivalent if we want to remove r.uniq

const filterBaseTypes = [...new Set(data.edges.map((e) => e.node.base_type))];

indeed... it's a bit heavy and less clear, that's why I didn't replace uniq, but I can also remove uniq if you think it's better

Readability-wise I think both are similar so I would go with removing the ramda dep here and below . Either way, whatever the choice consider updating the notion page (:, https://www.notion.so/filigran/How-to-remove-Ramda-a0a7ddfbf1b2400c883173b16d2c9fac

opencti-platform/opencti-graphql/tests/02-dataInjection/01-dataCount/elasticSearch-test.js

alice-debra

Toby has pointed out a spelling error; it should be either 'only equals' or 'only equal to'.

Archidoit · 2026-02-26T16:34:48Z

Toby has pointed out a spelling error; it should be either 'only equals' or 'only equal to'.

@alice-debra which one do you prefer ? Maybe 'only equals' is shorter

alice-debra · 2026-02-26T16:45:48Z

Toby has pointed out a spelling error; it should be either 'only equals' or 'only equal to'.

@alice-debra which one do you prefer ? Maybe 'only equals' is shorter

"only equal to" checked with @tobybutler405 :)

fellowseb

Nice !

fellowseb · 2026-02-27T15:05:12Z

opencti-platform/opencti-graphql/tests/02-dataInjection/01-dataCount/elasticSearch-test.js

    expect(entityTypeMap.get('RetentionRule')).toBe(entitiesCounter.RetentionRule);
    expect(data.edges.length).toEqual(entitiesCounterTotal);
-    const filterBaseTypes = R.uniq(R.map((e) => e.node.base_type, data.edges));
+    const filterBaseTypes = R.uniq(data.edges.map((e) => e.node.base_type));


Readability-wise I think both are similar so I would go with removing the ramda dep here and below . Either way, whatever the choice consider updating the notion page (:, https://www.notion.so/filigran/How-to-remove-Ramda-a0a7ddfbf1b2400c883173b16d2c9fac

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Archidoit self-assigned this Feb 20, 2026

Archidoit added the filigran team use to identify PR from the Filigran team label Feb 20, 2026

Archidoit marked this pull request as draft February 20, 2026 15:10

github-advanced-security bot found potential problems Feb 20, 2026

View reviewed changes

opencti-platform/opencti-graphql/src/database/engine.ts Fixed Show fixed Hide fixed

Archidoit force-pushed the issue/5220_onlyEqualsTo branch from 57e1235 to c1d4b6c Compare February 23, 2026 10:15

xfournet changed the base branch from release/current to master February 24, 2026 09:11

Archidoit force-pushed the issue/5220_onlyEqualsTo branch from 5d0cdb6 to 527c3e9 Compare February 24, 2026 12:14

Archidoit marked this pull request as ready for review February 24, 2026 15:35

Archidoit force-pushed the issue/5220_onlyEqualsTo branch from 527c3e9 to 164fc33 Compare February 24, 2026 15:41

Archidoit added 15 commits February 25, 2026 09:54

[backend] only_eq_to in engine.ts

db6a581

[frontend] only_eq_to for multiple attributes filters

5ef53b3

[backend/doc] add only_eq_to

100229e

[frontend] render only_eq_to

9a14d3c

[backend] implementation

d890b3a

[backend] implementation

5f4c213

[backend] add report5 in filterGroup-test.js

7350c6f

[backend] add only_eq_to filter tests

992d9bf

[backend] fix engine.ts

8046073

[backend] fix tests

e4eaf09

[backend] update counters

7128246

[backend] fix counters

218e324

[frontend/backend] not_only_eq_to

051df74

[backend] remove ramda

661ad74

[backend] add stix filtering tests

72d4d20

Archidoit force-pushed the issue/5220_onlyEqualsTo branch from f9384d7 to 72d4d20 Compare February 25, 2026 09:00

Archidoit marked this pull request as draft February 25, 2026 13:56

Archidoit added 3 commits February 25, 2026 17:33

[backend] fix boolean logic engine

0b663c6

[backend] remove label in STIX2V2

5a704b3

[backend] fix stix tests and logic engine

018859c

Archidoit force-pushed the issue/5220_onlyEqualsTo branch from ffe253b to 018859c Compare February 25, 2026 16:52

Archidoit marked this pull request as ready for review February 25, 2026 16:53

esrevi reviewed Feb 26, 2026

View reviewed changes

Archidoit added 2 commits February 26, 2026 17:10

[docs] only_eq_to

1b82977

[docs] only_eq_to

1131740

alice-debra requested changes Feb 26, 2026

View reviewed changes

Archidoit marked this pull request as draft February 26, 2026 16:39

Archidoit changed the title ~~[frontend/backend] 'Only equals to' new filter operator (#5220)~~ [frontend/backend] 'Only equals' new filter operator (#5220) Feb 26, 2026

Archidoit changed the title ~~[frontend/backend] 'Only equals' new filter operator (#5220)~~ [frontend/backend] 'Only equal to' new filter operator (#5220) Feb 27, 2026

[frontend/backend] typo: only equal to

e88b417

Archidoit marked this pull request as ready for review February 27, 2026 10:19

fellowseb approved these changes Feb 27, 2026

View reviewed changes

SamuelHassine requested a review from Copilot February 28, 2026 16:58

Copilot AI reviewed Feb 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[frontend/backend] 'Only equal to' new filter operator (#5220)#14543

[frontend/backend] 'Only equal to' new filter operator (#5220)#14543
Archidoit wants to merge 21 commits intomasterfrom
issue/5220_onlyEqualsTo

Archidoit commented Feb 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

codecov bot commented Feb 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

esrevi Feb 26, 2026

Uh oh!

Archidoit Feb 26, 2026

Uh oh!

fellowseb Feb 27, 2026

Uh oh!

Uh oh!

Uh oh!

alice-debra left a comment

Uh oh!

Archidoit commented Feb 26, 2026 •

edited

Loading

Uh oh!

alice-debra commented Feb 26, 2026

Uh oh!

fellowseb left a comment

Uh oh!

fellowseb Feb 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Archidoit commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Related issues

Screenshot

Uh oh!

Uh oh!

codecov bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

esrevi Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Archidoit Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

fellowseb Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

alice-debra left a comment

Choose a reason for hiding this comment

Uh oh!

Archidoit commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alice-debra commented Feb 26, 2026

Uh oh!

fellowseb left a comment

Choose a reason for hiding this comment

Uh oh!

fellowseb Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Archidoit commented Feb 20, 2026 •

edited

Loading

codecov bot commented Feb 20, 2026 •

edited

Loading

Archidoit commented Feb 26, 2026 •

edited

Loading