Closed
Description
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | Ubuntu |
| OS version (client) | Ubuntu |
| TheHive version | 4.0.0 |
| Package Type | Docker |
Problem Description
Copying the problem description from #1014:
If you import an alert to case that has observables, these observables are merged into the case.
If the observables already exist they are not created. But if the alert observables have tags set
that are not present at the case-observables they are not added.
This was fixed in the 3.X series, but in 4.0 this has regressed.
Possible Solutions
I believe that a565f83 can just be ported to the 4.0 branch.