OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.36k stars 939 forks source link

[CSV Mapper] Inconsistency in error raised #8214

Open Lhorus6 opened 2 months ago

Lhorus6 commented 2 months ago

Description

With CSV mapper, depending on where I upload my file and run the ImportCSV connector, I get different results:

image

image

NB: I am using the same file and the same CSV mapper of course

Environment

OCTI 6.2.16

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Create the following mapper

image

image

image

  1. Upload the following file in a "Data" tab of a Report and run the CSV mapper.
  2. Upload the following file in "Data > Import" panel and run the CSV mapper.

-> You will get what I shared in "Description"

ipbelongstoas.csv

Expected Output

Getting the same behavior, and since my Autonomous System seems malformatted, I expect to get the error.

Additional information

While testing, I noticed other inconsistencies:

1

If I use ";" instead of "," as separator (in my CSV mapper and my file) -> I never get the error

2

If I do something simpler: just import the badly formatted Autonomous System. So the following CSV mapper and the following file, I never get the error either:

as.csv

image

romain-filigran commented 1 month ago

I couldn't reproduce the fact that the import works in one case and fails in the other. In any case, the import fails. However, when I test the mapper, I notice that the entities are not correctly identified. Do you have the same observation? Capture d'écran 2024-09-06 090006

Lhorus6 commented 1 month ago

I couldn't tell you, I don't really use this "test" because: