TheHive-Project / TheHive

TheHive: a Scalable, Open Source and Free Security Incident Response Platform
https://thehive-project.org
GNU Affero General Public License v3.0
3.37k stars 615 forks source link

[Bug] deduplication of Webhook call #2220

Open azgaviperr opened 2 years ago

azgaviperr commented 2 years ago

Request Type

Bug

Work Environment

Docker Swarm stack on

Problem Description

I have set up two webhook, one filtered, one for all event, both got their own endpoint.

{
    "path": "notification",
    "defaultValue": [],
    "value": [
        {
            "delegate": false,
            "trigger": {
                "name": "FilteredEvent",
                "filter": {
                    "_and": [
                        {
                            "_is": {
                                "objectType": "Case"
                            }
                        }
                    ]
                }
            },
            "notifier": {
                "name": "webhook",
                "endpoint": "case_webhook"
            }
        },
        {
            "delegate": false,
            "trigger": {
                "name": "AnyEvent"
            },
            "notifier": {
                "name": "webhook",
                "endpoint": "shuffle"
            }
        }
    ]
}

When webhook is triggered it's requesting twice.

On thehive logs: [info] o.t.t.s.n.NotificationActor [|7ac24e51] Execution of notifier webhook for user None

On ShuffleFrontEnd image

There is 2 organisations that are linked together.

Everyt time the payload is exactly the same, not like one update and the other one create for case.

Steps to Reproduce

  1. Create at least 2 webhooks endpoint
  2. Trigger the webhook
  3. Enjoy
ch-ckmate commented 2 years ago

Hi, have you ever solved this issue? I have the same problem on the webhook.

EDIT: Solved by excluding all the other organizations when the webhook is called.

ialonsobase4 commented 2 years ago

Can you give more details on how did you resolve this issue? I've tried everything !!!

When you mention "when the webhook is called", are you referring to the HTTP PUT request to activate what is configured in the application.conf file??

Thnks in advance