OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.45k stars 947 forks source link

[Playbook] Playbooks apply status to entities that shouldn't have them #9071

Open Lhorus6 opened 3 days ago

Lhorus6 commented 3 days ago

Description

When I change statuses on entities with my playbook, it adds the status on all entities in the manipulated bundle, without taking into account which ones should have it.

Environment

OCTI 6.2.12

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Create a playbook:
  2. 1st component: listening on "create" + "Entity type=Note"
  3. 2nd component: Apply predefined rule - Resolve container references
  4. 3rd component: Manipulate knowledge - "Replace > Status > [an Incident status]", with "Manipulate all elements included in the bundle" turn on
  5. 4th component: Send for ingestion

Image

  1. Go on an Indicent
  2. Create a Note

Expected Output

I want the status to be changed on my Incident only

Actual Output

My status is changed on my Incident, but it is also applied to my Note (because it is included in the bundle manipulated by the playbook). However:

  1. The Note has no workflow (i.e. the "processing status" field is normally "disable"), so should not have a status.
  2. The status applied is an Incident status, it should not apply to entity types other than Incident.

Image

Image

romain-filigran commented 3 days ago

I agree. It is not normal to apply a status that is not defined in the entity status workflow.