Closed
Description
Request Type
Bug
Work Environment
Question | Answer |
---|---|
OS version (server) | All OS |
OS version (client) | All client |
TheHive version / git hash | 3.0.9 but most likely apply to all version which supports the alert feature |
Package Type | Binary |
Browser type & version | N/A |
Problem Description
I created an alert with thehive4py 1.5 where sourceRef='foo'
.
The alert was created with an artifact which has tags=['bar']
.
Then I imported the alert as a case through the web UI.
Now, looking at the observable, tags are only: foo
.
I suspect that TheHive overwrite the observable tags with the alert's sourceRef
at import.
Steps to Reproduce
- Create alert with a tagged artifact through thehive4py
- Import the alert as a case through web UI
- Check the observable tags