OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.19k stars 915 forks source link

Unexpected behavior for external references created in the context of Automatic references at file upload #7432

Open JeremyCloarec opened 3 months ago

JeremyCloarec commented 3 months ago

Description

When Automatic references at file upload is activated, an external reference is created when uploading a file in an entity. These external references behave differently, and I'm not sure if it is an expected behavior or not.

1st unexpected behavior is that it is not possible to remove the external reference, only to update or delete it. Is it normal?

2nd unexpected behavior is that these external references can be seen in the list of 'Add external references', but cannot be selected. Is it expected? Are these external references supposed to be listed in 'Add external references' at all?

Environment

  1. OS (where OpenCTI server runs): { e.g. Mac OS 10, Windows 10, Ubuntu 16.4, etc. }
  2. OpenCTI version: { e.g. OpenCTI 1.0.2 }
  3. OpenCTI client: { e.g. frontend or python }
  4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Activate the 'Automatic references at file upload' configuration on your report
  2. Create a report with a file associated
  3. Go to the report, see the external ref that was created

Expected Output

Should this external reference behave the same way as other external references?

Actual Output

Additional information

Screenshots (optional)

image

image

nino-filigran commented 3 months ago

@JeremyCloarec I see a PR: did you already worked on this ?

JeremyCloarec commented 3 months ago

we worked on solving the initial bug, but there was some behaviors that we weren't sure if they were intended or not. We created this issue to keept track of them and discuss them to see if they need to be changed or not

nino-filigran commented 1 month ago

@JeremyCloarec does this ticket still needs to be open?

nino-filigran commented 1 month ago

Fix: filter out not the selection of an external ref when it refers to a file