grapl-security/grapl

Allow for AND logic across edges

colin-grapl opened this issue · 0 comments

What did you want to do?

As a Grapl user I want to be able to express graphs that may contain multiple distinct nodes over a single edge.

As an example, a Parent Process with two child processes, each matching distinct patterns.

What did you actually end up doing instead?

Currently this sort of logic has to be handled in the on_response method, which is much less efficient and has a number of other caveats.

What can Grapl do differently?

Allow for supporting AND logic across a single edge.

ProcessQuery()
.with_children(
    ProcessQuery().with_process_name(eq="foo"),
    ProcessQuery().with_process_name(eq="bar"),
)