Skip to content

Artifact tags are overwritten by alert sourceRef during import to case #734

Closed
@ninSmith

Description

@ninSmith

Request Type

Bug

Work Environment

Question Answer
OS version (server) All OS
OS version (client) All client
TheHive version / git hash 3.0.9 but most likely apply to all version which supports the alert feature
Package Type Binary
Browser type & version N/A

Problem Description

I created an alert with thehive4py 1.5 where sourceRef='foo'.
The alert was created with an artifact which has tags=['bar'].
Then I imported the alert as a case through the web UI.
Now, looking at the observable, tags are only: foo.

I suspect that TheHive overwrite the observable tags with the alert's sourceRef at import.

Steps to Reproduce

  1. Create alert with a tagged artifact through thehive4py
  2. Import the alert as a case through web UI
  3. Check the observable tags

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions