[Bug] Additional Fields are discarded during merge

[s-knauer]

When merging multiple alerts into a case the additional fields for everything but the first alert are discarded.

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Debian 10
OS version (client)	Debian 10
TheHive version	4
Package Type	DEB
Browser type & version	Firefox 68

Problem Description

When having multiple alerts which show one "case", for example multiple occurences of a seen ioc at one day, and you merge them, the additional fields for alerts 2...n are discarded.
In contrary the observables und the description for all alerts can be found in the merged case.

Steps to Reproduce

1. Have more than one alert.
2. Create a case from alert 1.
3. Select alert 2 and merge it into the case created before.
4. The observables have merged as expected. Same observables are just shown once (merged). Different observables are shown side by side. Also both descriptions are shown. But, the additional fields (custom fields) are that of alert 1. None of the (differing) fields from alert 2 show up. Also you cannot look them up, because the click on alert 2 now links to the merged case instead of the data from this alert.

Complementary information

Is this behavior expected? I do not want to put everything in the observable section as a workaround, because it is a lot of information sometimes that feel a lot more like additional information than an obervable.

Thanks for your attention and great work!