OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
5.2k stars 821 forks source link

[CSV mapper] Missing certain label on import #7426

Open Lhorus6 opened 3 weeks ago

Lhorus6 commented 3 weeks ago

Description

In the context of CSV mapper

When I import entity with labels, if I have several rows with the same entity, but with different labels, they will not all be added.

Environment

OCTI 6.1.11

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Create a CSV mapper with two representation :

Screenshot 2024-06-19 191358

Screenshot 2024-06-19 191408

  1. Import this file using this CSV mapper :

test_import_label.csv

-> Look at the created IP, you won't see all the labels on it.

NB: I haven't tested with entities other than IPv4 but I imagine this happens regardless of the entity type.

nino-filigran commented 3 weeks ago

I've tried with another entity type & the end result is the same. Interestingly enough, this is the result when you click on "test" when building your mapper: it seems that in the test the 3 labels are detected properly though.

[ { "id": "label--2e034b0a-bcb5-5965-b7a5-0525a767d41d", "spec_version": "2.1", "type": "label", "extensions": { "extension-definition--ea279b3e-5c71-4632-ac08-831c66a786ba": { "extension_type": "new-sdo", "type": "Label", "converter_csv": "threatActor1,one-label,green" } }, "value": "one-label", "color": "green" }, { "id": "threat-actor--e102a8e0-c665-5f49-8e1c-2f5a921604a5", "spec_version": "2.1", "type": "threat-actor", "extensions": { "extension-definition--ea279b3e-5c71-4632-ac08-831c66a786ba": { "extension_type": "property-extension", "type": "Threat-Actor-Group", "labels_ids": [ null ], "converter_csv": "threatActor1,one-label,green" } }, "labels": [ "one-label" ], "name": "threatActor1" }, { "id": "label--e317f87f-691e-51fe-8a14-066182e5793f", "spec_version": "2.1", "type": "label", "extensions": { "extension-definition--ea279b3e-5c71-4632-ac08-831c66a786ba": { "extension_type": "new-sdo", "type": "Label", "converter_csv": "threatActor1,two-label,blue" } }, "value": "two-label", "color": "blue" }, { "id": "label--4dd8f5bb-b7a9-5c7b-bd9a-0ee6161dcbee", "spec_version": "2.1", "type": "label", "extensions": { "extension-definition--ea279b3e-5c71-4632-ac08-831c66a786ba": { "extension_type": "new-sdo", "type": "Label", "converter_csv": "threatActor1,three-label,red" } }, "value": "three-label", "color": "red" } ]