Skip to content

[Bug] Unable to find case by Case Number #2044

Closed
@BlueJokerr

Description

@BlueJokerr

Request Type

Bug

Work Environment

Question Answer
OS version (server) CentOS
OS version (client) 8
Virtualized Env. True
Dedicated RAM 16 GB
vCPU 12
TheHive version / git hash 4.1.4-1
Package Type RPM
Database Cassandra
Index type Lucene
Disk Local
Browser type & version Chrome

Problem Description

We are facing a random error when trying to search for some cases using their case number (#15611 for example) via WebGUI, TheHive fails to find it and returns an "Unable to find case with number...", but the case does exist, we try to do some debug and found that TheHive calls an api method (/api/case/_search) using the field "caseId". We try to simulate that api call and found that it returns an empty array as if the case doesn't exist.
If we search for the case manually in the case menu we can find it and the case number is OK, we also try to do an api call (/api/v1/query) with the real ID (DB ID) and in the result we can see that the case number is also correct.

This issue is really annoying because we use the case number for tracking purposes.

Maybe it could be an index issue?

Steps to Reproduce

Random error

Possible Solutions

N/A

Complementary information

I'm attaching print screens of the error:

  • WebGUI case search:
    1 web gui search case by ID error

  • API Call when WebGUI case search is executed returns null:
    2 api called when searching case ID fails returns null

  • API Call by case number using POSTMAN returns null:
    3 api query by ID returns null

  • Searching manually in cases tab we can find the case with its corresponding case number:
    4 web gui case exists
    4 web gui case exists 2

  • API call usind case ID returns correct case with corresponding case number:
    5 api query by DB ID

Metadata

Metadata

Assignees

Labels

TheHive4TheHive4 related issuesbug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions