TheHive-Project / TheHive

TheHive: a Scalable, Open Source and Free Security Incident Response Platform
https://thehive-project.org
GNU Affero General Public License v3.0
3.28k stars 606 forks source link

[Bug] Observables disappear from UI #2345

Closed chberti closed 2 years ago

chberti commented 2 years ago

Request Type

Bug

Work Environment

Question Answer
OS version (server) CentOS
OS version (client) 7.X
Virtualized Env. True
Dedicated RAM 32 GB
vCPU 4
TheHive version / git hash 4.1.16
Package Type RPM
Database Cassandra
Index type Elasticsearch
Attachments storage Local
Browser type & version Chrome

Problem Description

Hi there. Since recent updates TheHive began to hide observables on UI (the value is not visible, but tags, description, reports etc seem fine). When we search for their value, we get the right output (value is still empty in the UI though). It seems like TheHive fails to get values of observables and display them on the interface.

Using Browser Devtools, I found that the

that should contain the observable value simply does not exist at all on a case where observables are missing.

This problem also affects alerts randomly.

Which component would be responsible of this bug ? Would a migration of cassandra + elasticsearch data to a fresh TheHive installation fix the problem ?

Steps to Reproduce

  1. Create a Case with fewx observables
  2. Wait for a few days
  3. The existing Case will have observables missing

Possible Solutions

Fresh install of TheHive component only ?

Complementary information

thehivebug_observables

chberti commented 2 years ago

This was solved by Issue #2333 (same problem)