You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fsnormand opened this issue
Feb 4, 2021
· 0 comments
Assignees
Labels
buguse for describing something not working as expectedfeatureuse for describing a new feature to developsolveduse to identify issue that has been solved (must be linked to the solving PR)
The Stixv2.1 bundle with 2 indicators with derived-from relation , we have this error : "The relationship type derived-from is not allowed between Indicator and Indicator". More details in the additional information.
Environment
OS : Ubuntu 20.04
OpenCTI version: 4.0.7
OpenCTI client: 4.0.7
Other environment details:
Reproducible Steps
When we pushed with the lastinfosec connector a stixv2.1 bundle containing 2 indicators with "derived-from" relation with have an error.
Expected Output
The relation will be created between 2 indicators.
Actual Output
The relation will not be created between 2 indicators.
Additional information
Error Log : {"user":{"ip":"::ffff:10.0.11.4","user_id":"88ec0c6a-13ce-5e39-b486-354fe4a7084f","applicant_id":"88ec0c6a-13ce-5e39-b486-354fe4a7084f","call_retry_number":""},"type":"WRITE_ERROR","operation_query":"mutation StixCoreRelationshipAdd($input:StixCoreRelationshipAddInput!){stixCoreRelationshipAdd(input:$input){id standard_id entity_type parent_types}}","inner_relation_creation":0,"operation":"StixCoreRelationshipAdd","time":39,"variables":{"input":{"fromId":"indicator--7409b221-4ec4-488c-b9db-861d08a93d5e","toId":"indicator--51b912ef-b6b5-493a-bbf1-3d9a6103169c","stix_id":"relationship--04d15ff7-a6d8-4629-8ba5-639687c346aa","relationship_type":"derived-from","description":"","start_time":null,"stop_time":null,"revoked":null,"confidence":0,"lang":null,"created":"2021-01-29T18:24:17.000Z","modified":"2021-01-29T18:24:17.000Z","createdBy":null,"objectMarking":[],"objectLabel":[],"externalReferences":[],"killChainPhases":[],"update":false}},"size":507,"error":{"data":{"reason":"The relationship type derived-from is not allowed between Indicator and Indicator","category":"business"},"stacktrace":["FunctionalError: Business validation","at t (/opt/opencti/build/index.js:1:55860)","at p (/opt/opencti/build/index.js:1:56653)","at /opt/opencti/build/index.js:1:23302","at Fe (/opt/opencti/build/index.js:1:23495)","at runMicrotasks ()","at processTicksAndRejections (internal/process/task_queues.js:93:5)","at async /opt/opencti/build/index.js:1:184906"]},"level":"error","message":"API Call","timestamp":"2021-01-30T12:21:22.257Z"}
The text was updated successfully, but these errors were encountered:
buguse for describing something not working as expectedfeatureuse for describing a new feature to developsolveduse to identify issue that has been solved (must be linked to the solving PR)
Description
The Stixv2.1 bundle with 2 indicators with derived-from relation , we have this error : "The relationship type derived-from is not allowed between Indicator and Indicator". More details in the additional information.
Environment
Reproducible Steps
When we pushed with the lastinfosec connector a stixv2.1 bundle containing 2 indicators with "derived-from" relation with have an error.
Expected Output
The relation will be created between 2 indicators.
Actual Output
The relation will not be created between 2 indicators.
Additional information
Error Log : {"user":{"ip":"::ffff:10.0.11.4","user_id":"88ec0c6a-13ce-5e39-b486-354fe4a7084f","applicant_id":"88ec0c6a-13ce-5e39-b486-354fe4a7084f","call_retry_number":""},"type":"WRITE_ERROR","operation_query":"mutation StixCoreRelationshipAdd($input:StixCoreRelationshipAddInput!){stixCoreRelationshipAdd(input:$input){id standard_id entity_type parent_types}}","inner_relation_creation":0,"operation":"StixCoreRelationshipAdd","time":39,"variables":{"input":{"fromId":"indicator--7409b221-4ec4-488c-b9db-861d08a93d5e","toId":"indicator--51b912ef-b6b5-493a-bbf1-3d9a6103169c","stix_id":"relationship--04d15ff7-a6d8-4629-8ba5-639687c346aa","relationship_type":"derived-from","description":"","start_time":null,"stop_time":null,"revoked":null,"confidence":0,"lang":null,"created":"2021-01-29T18:24:17.000Z","modified":"2021-01-29T18:24:17.000Z","createdBy":null,"objectMarking":[],"objectLabel":[],"externalReferences":[],"killChainPhases":[],"update":false}},"size":507,"error":{"data":{"reason":"The relationship type derived-from is not allowed between Indicator and Indicator","category":"business"},"stacktrace":["FunctionalError: Business validation","at t (/opt/opencti/build/index.js:1:55860)","at p (/opt/opencti/build/index.js:1:56653)","at /opt/opencti/build/index.js:1:23302","at Fe (/opt/opencti/build/index.js:1:23495)","at runMicrotasks ()","at processTicksAndRejections (internal/process/task_queues.js:93:5)","at async /opt/opencti/build/index.js:1:184906"]},"level":"error","message":"API Call","timestamp":"2021-01-30T12:21:22.257Z"}
The text was updated successfully, but these errors were encountered: