[Queries] Everything View

[randomuserid]

The everything view is an optional sort of hello world view where we show all the detections with little or no prioritization. The original query was this:

MATCH (n:ENTITY)-[r]->(m) where n.view = 1 and m.view = 1 return n,r,m

Somewhere around 6k alerts and 100 entities this stops working. It returns in neo4j but not in the web ui.

For now I changed it to to this which works ok;

MATCH (h:ENTITY)-[r]->() WHERE NOT type(r) IN ['AS_SOURCE', 'AS_DEST'] WITH h MATCH p=(h)-[r]->() RETURN p

Questions

1. While this works, it is not making use of the views, and so may not be optimal.
2. For some reason the source / dest relations are still there and I'm not sure if we need them or can prune them..we are precomputing entities prior to ingest now because this is hard in neo and simpler in Python