OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.51k stars 959 forks source link

[Workbench] Entities that added manually don't show #8975

Open EinatAR opened 2 weeks ago

EinatAR commented 2 weeks ago

Description

When importing a document in Data > Import In the case that some entities don't come up and I want to add it manually, after validating the workbench the entities don't show up.

If I validate the workbench the way it is, then go to the report > analyst workbench > add the missing entities and validate -> it does show up.

Environment

OpenCTI version: 6.3.11

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Go to Data > Import and import a document (example attached) Russisk cyberbande NoName stadig yderst aktiv_ Nu overbelastes Sydkoreas myndigheder - Computerworld.pdf

In the workbench South Korea (country) and Noname057(16)(Intrusion set) do not come up

  1. While still in Data > Import > Analyst Workbench (and before validating the workbench for the first time) add South Korea (country) and Noname057(16)(Intrusion set).
  2. No go ahead and validate the Workbench.
  3. Navigate to the report > Entities

Expected Output

I would expect to see the added entities listed under Entities tab and see them in the Knowledge tab in both scenarios:

  1. Add entities and validate workbench in Data > Import
  2. Add entities in Report > Analyst workbench

Actual Output

When adding the entities in Data > Import > Analyst workbench : The two entities are nowhere to be found

Screenshots (optional)

Image

nino-filigran commented 2 weeks ago

@EinatAR I've marked this as a bug even if it's not a "real" one, rather a whole in the code I would say. Currently, what's happening is that your entities are created but not linked to the report since you did not select the option to add them in the container. Therefore, the fix should be to automatically add any manually added entity in the given container.

Now let me explain how you can manually overcome this issue for now:

That is why I mentionned to you we will still consider this as a bug, because if you don't know the trick, it's quite difficult for you to understand the issue.