OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
5.12k stars 813 forks source link

Inconsistency in numbers between dashboard and list #7454

Open Lhorus6 opened 4 days ago

Lhorus6 commented 4 days ago

Description

When we make dashboards, or look at the numbers displayed in the dashboards of entity "Knowledge" tabs, the values may differ from the lists.

Environment

OCTI 6.1.12

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Create a widget "horizontal bar" and "knowledge graph" perspective, with this filter (cf https://testing.octi.staging.filigran.io/dashboard/workspaces/dashboards/d89c9638-fd7c-42a7-a3b0-97c452f36307)

Screenshot 2024-06-24 160318

Screenshot 2024-06-24 160311

  1. Compare the value with what you can find in the list view "Data > relationships".

Screenshot 2024-06-24 160331

Expected Output

Obtain the same values.

Additional information

There are also inconsistencies in the "knowledge" tab. (see this entity for example : https://testing.octi.staging.filigran.io/dashboard/locations/countries/871f5e14-488a-4f21-adb6-733a70565b8b/knowledge/overview)

Screenshot 2024-06-24 161041

Screenshot 2024-06-24 161029

Kedae commented 4 days ago

I will check but I think this is the difference between the number of entities and the number of relationships. @nino-filigran a thought ?

Lhorus6 commented 3 days ago

For the Knowledge tab (what's in the "Additional information" section) I don't know. But for the rest, both (my widget and the list view) are based on relationships, so it shouldn't be different I think.

nino-filigran commented 3 days ago

Maybe the inferred relations are not well counted? I guess you're in bypass with all markings right @Lhorus6 ? Could it be relations that are using the relation as source (ex: (entity A targets USA) Targets entity B)?

SamuelHassine commented 3 days ago

Taking care of this.