Domain name Field in Organisation Identity about opencti

[sudesh0sudesh]

[nino-filigran]

@sudesh0sudesh As you may know since we already have the observable domain, we would rather encourage you to use a relation mechanism between your org and the domain name. Isn't this sufficient for you?

[sudesh0sudesh]

Hello @nino-filigran

If someone wants to run dnstwist against a specific domain, it creates a relationship but to distinguish from the main domain we have to apply labels and in future, if someone wants to run dnstwist against the domain then they have to go to that specific domain and execute it. Not only that. If someone wants to create a connector that checks specific things against the organisation domain. Rather than running against the domain. They can run on the connector against the organisation object.

[sudesh0sudesh]

Maybe a niche case

[nino-filigran]

Yeah I understand your issue.
And in this context, what do you think about having a different type of relation (custom, not stix), like "offcially owns" (to be able to have a relation that represents the fact that your organisation owns some domains, while using the related to link the malicious ones)?

The reason why I'm trying to use relations is to try to remain coherent with the platform and void having duplication of data/difficulty of maintenance.

[sudesh0sudesh]

yeah may be new relation should work, It would also tackles if organisation has multiple domains they can all be linked