search

OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.36k stars 939 forks source link

Entities validated in a report's analyst workbench are not included in the report #8178

Open yassine-ouaamou opened 2 months ago

yassine-ouaamou commented 2 months ago

Description

When importing a STIX bundle inside a report and the bundle contains Observed-data or any other container, the content of the analyst workbench is created but not included in the report.

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Generate a STIX bundle containing, an IP address, an indicator on this IP address, a relationship between both, an observed data containing the IP address
  2. Import the bundle inside a report
  3. Validate the analyst workbench

Expected Output

The entities are created and are embedded in the report

Actual Output

The entities are created but are not embedded in the report

Jipegien commented 2 months ago

waiting some additional test

Jipegien commented 1 month ago

To implement: when importing a stix bundle from a Data tab of a ContainerA and the stix bundle describes containers X,Y,Z containing entities, then at the end the ContainerA contains containers X,Y,Z and all their entities. 1 depth level only for now.

JeremyCloarec commented 2 weeks ago

PR has been opened on connector repository: https://github.com/OpenCTI-Platform/connectors/pull/2802