I am unable to retrieve identity objects when passing visible_to filter.

[olarid7852]

Eg
This returns 404
'https://management.stixify.staging.signalscorps.com/stixify_api/admin/api/v1/objects/identity--d673f8cb-c168-42da-8ed4-0cb26725f86c/?visible_to=identity--b1ae1a15-6f4b-431e-b990-1b9678f35e15' \But
'https://management.stixify.staging.signalscorps.com/stixify_api/admin/api/v1/objects/identity--d673f8cb-c168-42da-8ed4-0cb26725f86c/' \returns

Response body
{
  "created": "2022-08-02T19:34:35.143Z",
  "created_by_ref": "identity--d673f8cb-c168-42da-8ed4-0cb26725f86c",
  "id": "identity--d673f8cb-c168-42da-8ed4-0cb26725f86c",
  "identity_class": "organization",
  "modified": "2022-08-02T19:34:35.143Z",
  "name": "MITRE Center for Threat-Informed Defense",
  "spec_version": "2.1",
  "type": "identity"
}

[himynamesdave]

@fqrious is this same as

muchdogesec/siemrules#351

If so, why 404?

[fqrious]

visible_to tests created_by_ref == <value> OR tlp_marking IN GREEN | WHITE

not fixable unless we manually exclude the identity (or all identities) from this check

[himynamesdave]

@fqrious could we not create all team identities (not extracted identities) with TLP clear?

[fqrious]

that's not a team identity

[himynamesdave]

@fqrious what about if we assume anything without a TLP = clear.

We could implement this across apps.

Isn't this the way we do it for SCOs?