Skip to content

[Bug] Additional Fields are discarded during merge #1553

Closed
@s-knauer

Description

@s-knauer

When merging multiple alerts into a case the additional fields for everything but the first alert are discarded.

Request Type

Bug

Work Environment

Question Answer
OS version (server) Debian 10
OS version (client) Debian 10
TheHive version 4
Package Type DEB
Browser type & version Firefox 68

Problem Description

When having multiple alerts which show one "case", for example multiple occurences of a seen ioc at one day, and you merge them, the additional fields for alerts 2...n are discarded.
In contrary the observables und the description for all alerts can be found in the merged case.

Steps to Reproduce

  1. Have more than one alert.
  2. Create a case from alert 1.
  3. Select alert 2 and merge it into the case created before.
  4. The observables have merged as expected. Same observables are just shown once (merged). Different observables are shown side by side. Also both descriptions are shown. But, the additional fields (custom fields) are that of alert 1. None of the (differing) fields from alert 2 show up. Also you cannot look them up, because the click on alert 2 now links to the merged case instead of the data from this alert.

Complementary information

Is this behavior expected? I do not want to put everything in the observable section as a workaround, because it is a lot of information sometimes that feel a lot more like additional information than an obervable.

Thanks for your attention and great work!

Metadata

Metadata

Assignees

Labels

TheHive4TheHive4 related issuesbug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions