Discussion Forum

Assigning a value on nested attribute

I would like to seek assistance about Assign value on an attribute to another attribute

Data:

	sdo_type = "attack-pattern"
	name = "Phishing"
	kill_chain_phases:
		kill_chain_name = "kill-chain"
		phase_name = "delivery"

Schema

	sdo_type sub attribute, value string;
	name sub attribute, value string;
	kill_chain_phases sub attribute, value string,
		owns kill_chain_name,
		owns phase_name;
	kill_chain_name sub attribute, value string;
	phase_name sub attribute, value string;
	sdo_attack_pattern sub entity,
		owns sdo_type,
		owns name,
		owns kill_chain_phases;

Insert: This is where I lost.

insert

$atk isa sdo_attack_pattern, has name "Spearphishing", has sdo_type "attack-pattern", has kill_chain_phases ???; <- What is this supposed to be?

$atk-attr isa kill_chain_phases, has kill_chain_name "kill-chain", has phase_name "delivery"; <-- This causes an Error

Error: [THW24] Invalid Thing Write: Unable to insert attribute '$atk-attr' of type 'kill_chain_phases' without a value assigned to the variable. Please check server logs for the stack trace.

How am I going to insert the “kill_chain_phases” on the $atk, considering that it will be expecting a string there.

The attribute type kill_chain_phases has value string. In order to successfully insert an attribute, you must specify its value, for instance:

insert $x "kill-chain-phases" isa kill_chain_phases, has kill_chain_name "kill-chain";
1 Like

Thank you for your reply and really appreciated it. After trying that query that you gave, I am able to insert the data. However looking on the result on workbase, the attributes that owned by kill_chain_phases (kill_chain_name and phase_name) does not show.

Below is the data on my data.tql

insert 

	$atk isa sdo_attack_pattern, has name "Spearphishing", has sdo_type "attack-pattern", has kill_chain_phases $atk-attr;

	$atk-attr "kill-chain-phases" isa kill_chain_phases, has kill_chain_name "kill-chain", has phase_name "delivery";

What I am expecting is to see the kill_chain_name (“kill-chain”) and phase_name (“delivery”) as sub attribute of kill_chain_phases. Is there anyway to do that?