Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Having Network Traffic observable with a dst ref makes the observable listing crash #6070

Closed
labo-flg opened this issue Feb 21, 2024 · 3 comments · Fixed by #6073
Closed
Assignees
Labels
bug use for describing something not working as expected solved use to identify issue that has been solved (must be linked to the solving PR)
Milestone

Comments

@labo-flg
Copy link
Member

labo-flg commented Feb 21, 2024

Description

Discovered while working on #6056
If a Network Traffic observable has a dst ref set, the pagination request in the observable list crashes.
=> Update : the bug happens is a network traffic has "dst_port" and we try to sort the observable list by "representative".

Environment

latest 5.12

Reproducible Steps

  1. create a network traffic observable
  2. from its knowledge tab, add a dst ref
  3. go to observables list and sort by observable value (dashboard/observations/observables?sortBy=observable_value&orderAsc=true)

Expected Output

no crash :)

Actual Output

crash :(

@labo-flg labo-flg added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team labels Feb 21, 2024
@labo-flg
Copy link
Member Author

cc @SouadHadjiat I think you already made the root cause analysis for this one

@nino-filigran nino-filigran removed the needs triage use to identify issue needing triage from Filigran Product team label Feb 22, 2024
@labo-flg
Copy link
Member Author

labo-flg commented Feb 22, 2024

"failures":[{"index":"opencti_stix_cyber_observables-000001","node":"Ze8cuEaJT9Gd0Z1ilSybPA","reason":{"caused_by":{"reason":"No field found for [dst_port.keyword] in mapping","type":"illegal_argument_exception"}

dst_port is a numeric, so using keyword is an error I guess

@SouadHadjiat
Copy link
Member

Actually the bug happens only when we sort on "representative" and if we have at least one network traffic with "dst_port", it doesn't have any link to dst_ref

@richard-julien richard-julien added the solved use to identify issue that has been solved (must be linked to the solving PR) label Feb 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected solved use to identify issue that has been solved (must be linked to the solving PR)
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants