Closed
Description
Request Type
Bug
Work Environment
Question | Answer |
---|---|
OS version (server) | Ubuntu |
TheHive version / git hash | 3.1.0-RC3 |
Package Type | From source |
Problem Description
When a responder has multiple operations, it seems only the first one is being executed by TheHive.
Steps to Reproduce
- Have an analyzer with two AddTagToCase operations
- Execute it on a case
- See the first tag appears but never the second one
Complementary information
My responder has the following operations:
def operations(self, raw):
ops = []
ops.append(self.build_operation('AddTagToCase', tag="ticket:{}#{}".format(self.instance_name, raw['issue']['issue']['id'])))
ops.append(self.build_operation('AddTagToCase', tag="ticket created"))
return ops
When I execute the responder, only the first tag (ticket:name#num
) appears. The two operations are present in the Cortex output If I comment the first operation build, I have the second tag appearing (ticket created
)