Internal error while ordering the vulnerability events

[pereyra-m]

Description

During the E2E test, it was found that ordering the alerts using a vulnerability field in the Threat Hunting panel, generated an internal error

unsupported_operation_exception
null
Error: Internal Server Error
    at fetch_Fetch.fetchResponse (https://demo-480-ct-wazuh-db177eddeaa0c3f6.elb.us-west-1.amazonaws.com/48001/bundles/core/core.entry.js:15:177223)
    at async interceptResponse (https://demo-480-ct-wazuh-db177eddeaa0c3f6.elb.us-west-1.amazonaws.com/48001/bundles/core/core.entry.js:15:172641)
    at async https://demo-480-ct-wazuh-db177eddeaa0c3f6.elb.us-west-1.amazonaws.com/48001/bundles/core/core.entry.js:15:175121

Related to this problem, the events panel of the new vulnerability detector section doesn't show any vulnerability alert

DoD

• [ ] Find root cause of the issue and fix it
• [ ] Make sure the problem has been solved

[gdiazlo]

We have reproduced this on the platform Discover as well.

[jbiset]

Research

Only in a demo environment have these problems been reproduced. In the development environment it has not been possible to reproduce these problems. Evidence is added below the tests in the demo environment. We have found that it does not only happen with fields in the vulnerabilities module. The origin of this difference between the development environment and the demo continues to be investigated.

Evidences

Ordering `data.vulnerability.cve` field on Events tab in Vulnerability detection :green_circle:

  

Ordering `data.vulnerability.status` field on Events tab in Vulnerability detection :red_circle:

  

Ordering `data.win.system.message` field on Events tab in MITRE ATT&CK :red_circle:

 

Ordering `data.win.evendata.logonProcessName` field on Discover :red_circle:


[asteriscos]

We have been unable to replicate this issue in other environments. We believe this error comes from the pre-alpha environment it was tested on.