You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Lhorus6 opened this issue
Feb 15, 2024
· 1 comment
Assignees
Labels
buguse for describing something not working as expectedplaybookLinked to automation enginesolveduse to identify issue that has been solved (must be linked to the solving PR)
When I want to retrieve the entities contained in a report using the component "Apply predefined rule : resolve container references", objects contained following the application of an inference rule (e.g. Indicators propagation in reports) are not retrieved.
My guess is that "Apply predefined rule : resolve container references" (and maybe "Apply predefined rule : resolve neighbors relation") doesn't take inferred relationships into account when solving linked objects.
Environment
OCTI 5.12.31
filigran prod instance
Reproducible Steps
The playbooks to create:
Listener on modification event, with filters "entity:report + label:test"
(nb: you can use the playbook "Bug retrieve inferred entities" on the filigran prod instance)
Steps to create the smallest reproducible scenario:
Create the above playbook
Find a report with entities contained thanks to inference rule (nb: you can use the report "Debug retrieve inferred entities" on the filigran prod instance) and add the label "test"
Look inside the log of the playbook. You will not find the infered entities
The text was updated successfully, but these errors were encountered:
Lhorus6
added
bug
use for describing something not working as expected
needs triage
use to identify issue needing triage from Filigran Product team
labels
Feb 15, 2024
buguse for describing something not working as expectedplaybookLinked to automation enginesolveduse to identify issue that has been solved (must be linked to the solving PR)
Description
When I want to retrieve the entities contained in a report using the component "Apply predefined rule : resolve container references", objects contained following the application of an inference rule (e.g. Indicators propagation in reports) are not retrieved.
My guess is that "Apply predefined rule : resolve container references" (and maybe "Apply predefined rule : resolve neighbors relation") doesn't take inferred relationships into account when solving linked objects.
Environment
OCTI 5.12.31
filigran prod instance
Reproducible Steps
The playbooks to create:
(nb: you can use the playbook "Bug retrieve inferred entities" on the filigran prod instance)
Steps to create the smallest reproducible scenario:
The text was updated successfully, but these errors were encountered: