Skip to content

[Bug] V4 Merge observable tags with existing observables during importing alerts into case #1499

Closed
@andrewthad

Description

@andrewthad

Work Environment

Question Answer
OS version (server) Ubuntu
OS version (client) Ubuntu
TheHive version 4.0.0
Package Type Docker

Problem Description

Copying the problem description from #1014:

If you import an alert to case that has observables, these observables are merged into the case.
If the observables already exist they are not created. But if the alert observables have tags set
that are not present at the case-observables they are not added.

This was fixed in the 3.X series, but in 4.0 this has regressed.

Possible Solutions

I believe that a565f83 can just be ported to the 4.0 branch.

Metadata

Metadata

Assignees

Labels

TheHive4TheHive4 related issuesbug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions