OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.45k stars 947 forks source link

[Playbook] Changing Author does not work and prevents all edits #9065

Open Lhorus6 opened 3 days ago

Lhorus6 commented 3 days ago

Description

When in my playbook I have a "manipulate knowledge" to replace the Author, nothing happens. By this I mean that nothing is created / updated in my platform while in the traces of the playbook everything works correctly (it reaches the "Send for ingestion, and the log is good)

Environment

OCTI 6.3.12

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Create a playbook with listener on "Entity type: RFI" and only on "Create" event
  2. Add a component "manipulate knowlegde" with "Replace > Author > [one organization]"
  3. Add a component "send for ingestion"
  4. Start the playbook
  5. Create manually a RFI
  6. Wait for the playbook to run, and look at the execution traces -> everything seems good, but if you look on the RFI, the author has not been updated

Image

Additional information