Closed
Description
When merging multiple alerts into a case the additional fields for everything but the first alert are discarded.
Request Type
Bug
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | Debian 10 |
| OS version (client) | Debian 10 |
| TheHive version | 4 |
| Package Type | DEB |
| Browser type & version | Firefox 68 |
Problem Description
When having multiple alerts which show one "case", for example multiple occurences of a seen ioc at one day, and you merge them, the additional fields for alerts 2...n are discarded.
In contrary the observables und the description for all alerts can be found in the merged case.
Steps to Reproduce
- Have more than one alert.
- Create a case from alert 1.
- Select alert 2 and merge it into the case created before.
- The observables have merged as expected. Same observables are just shown once (merged). Different observables are shown side by side. Also both descriptions are shown. But, the additional fields (custom fields) are that of alert 1. None of the (differing) fields from alert 2 show up. Also you cannot look them up, because the click on alert 2 now links to the merged case instead of the data from this alert.
Complementary information
Is this behavior expected? I do not want to put everything in the observable section as a workaround, because it is a lot of information sometimes that feel a lot more like additional information than an obervable.
Thanks for your attention and great work!