IBM Security i2

Expand all | Collapse all

Orphan Entity Query

  • 1.  Orphan Entity Query

    Posted Thu August 20, 2020 04:48 PM
    Hello,

    How do I write a query that shows me all my entities that do not have any links?

    Thanks!

    ------------------------------
    Shawna Gibson
    ------------------------------


  • 2.  RE: Orphan Entity Query

    Posted Fri August 21, 2020 01:58 AM
      |   view attached
    Hi, Shawna,
    I'm not sure if I understood you correctly, but in case you want to find all single entities (without any connection) on your chart- you could use Visual search: Single entity - select Type "any" and in Attribute Class set "Entity Links" then equal to 0. Please see the picture how it looks like.
    Hope it will help.
    Ruta

    ------------------------------
    Ruta Jasinskiene
    Intelligence Analysis Expert_IBM i2 ANB trainer
    NRD Cyber Security
    Vilnius
    ------------------------------



  • 3.  RE: Orphan Entity Query

    Posted Fri August 21, 2020 04:11 AM
    Hi Shawna

    You don't mention which i2 software that you are using, but if it's iBase then the following will find what you want.



    ------------------------------
    Simon Griffiths
    ------------------------------



  • 4.  RE: Orphan Entity Query

    Posted Fri August 21, 2020 11:18 AM
    Thank you!  This is exactly what I needed.  I have several different data sources so I am also trying to identify orphan entities with specific data sources, however, when I put in those parameters it doesn't seem to work and I return over 100K entities all with connections.  I am not sure what I am doing wrong so any suggestions are welcome.  Thanks for the help!

    ------------------------------
    Shawna Gibson
    ------------------------------



  • 5.  RE: Orphan Entity Query

    Posted Mon August 24, 2020 03:26 AM
    Hi Shawna

    Can you confirm which of the solutions above is not working as expected, the Notebook visual query or the iBase  query?

    ------------------------------
    Simon Griffiths
    ------------------------------



  • 6.  RE: Orphan Entity Query

    Posted Mon August 24, 2020 11:41 AM
    Hi Simon,

    Sorry for not being clear, the iBase query is the one that I can't limit by data source.  It will work so long as I don't have anything in the query.

    ------------------------------
    Shawna Gibson
    ------------------------------



  • 7.  RE: Orphan Entity Query

    Posted Mon August 24, 2020 12:08 PM
    hmmm...it should work.

    How is the data source stored in iBase - is it in a "standard field" ( a single field that is applied to all records in iBase Designer) or is it stored in a common field name (i.e. the same name) that was added individually to each record type.

    ....Kind of hard to explain the difference, if you have authorization for iBase designer, then a standard field will show up in this section for a database.

    Secondly, is this a SQL Server iBase database? (The database path on the bottom bar in iBase will have (SSE) in it if it is SQL Server).

    ------------------------------
    Simon Griffiths
    ------------------------------



  • 8.  RE: Orphan Entity Query

    Posted Mon August 24, 2020 01:39 PM
    Yes, it is a standard field in Ibase and it is a SQL database.  I just retested it and I it looks like I might have put the qualifier on the wrong entity as I just got the return I expected.  Thanks for the assist!

    ------------------------------
    Shawna Gibson
    ------------------------------