-
Notifications
You must be signed in to change notification settings - Fork 915
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Playbook] "Promote observable to indicator" component doesn't work #6266
Comments
@Lhorus6 the main issue (only one indicator created) should be fixed by this PR : #6271 The other issue about the relationship is due to a validation error, because "markings" have been set mandatory for relationships (https://demo.octi.filigran.io/dashboard/settings/customization/entity_types/stix-core-relationship), and since there is no marking on the relationship based on that we are trying to create, it throws an error :
|
Great, thank you |
Description
When I use the component "Promote observable to indicator", it creates only one indicator for one observable, and doesn't even generate the relationship between the two.
For example, if I have a report with 3 observables, my playbook will:
Environment
OCTI 6.0.3
Reproducible Steps
You can find the playbook in the private demo instance. It is called "Issue/6266 DO NOT DELETE"
Steps to create the smallest reproducible scenario:
Create a playbook with
Create a report with several observables that don't have indicator linked to them. Then assign you to the report to trigger the playbook.
-> You will find only one indicator created and it is not even linked to the observable
Expected Output
Generation of one indicator per observable and a relation "based on" between each observable and its indicator.
Screenshots
My playbook
The text was updated successfully, but these errors were encountered: