Open mgabriel-silva opened 5 years ago
Do the IOCs in case and alert have the same data type and value?
Yes. And I did a new test. Actually is more serious than that In addition to not shoing on 'IOCs', it is not counting towards 'Observables' [0% (0/1)] of the similar case (as show in the screenshots)
Hi, I can reproduce this problem on TheHive 3.3.1-1.
Adding any observable type and marking it as IOC, will exclude the observable from the overlap counter. Only observables without IOC mark will be counted.
"IOCs" field is also "N/A" in all cases.
I having the same problem with IOC's and similar cases. I wouldn't be associating them well. Could anyone find a solution?
Could anyone find a solution?
I solved the problem (not showing the IOC overlap on 'Alert Preview and Import') by upgrading to Hive 3.4.0-1
.
Be aware, that the calculated IOC overlap reduces the observable overlap.
Request Type
Bug
Problem Description
Not showing IOCs of 'Similar Cases' on 'AlertPreview' TheHive only shows 'N/A' on the field 'IOCs', even if the case has IOCs
Steps to Reproduce