TheHive4py
TheHive4py copied to clipboard
[Bug] weird results with find_cases
weird results with find_cases
Request Type
Bug
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | Ubuntu |
| OS version (client) | Ubuntu, ... |
| TheHive4py version / git hash | 1.8.1 |
Problem Description
Searching for cases with a mix of uppercase and lowercase letters doesn't work. Same goes for some special characters ('.', '-', maybe others)
Steps to Reproduce
-
I create two cases "case1" and "Case2" in the hive manually.
-
I use a simple python script to perform two search, one for "case" and one for "Case" using thapi.find_cases()
query = Or(
ContainsString('title', 'case'),
)
cases = thapi.find_cases(query=query, sort=['createdAt'], range='all').json()
print(query)
print(cases)
query = Or(
ContainsString('title', 'Case'),
)
cases = thapi.find_cases(query=query, sort=['createdAt'], range='all').json()
print(query)
print(cases)
I get as result both case1 and Case2 with the first query, which is fine I guess However with the second query, I get no results at all
Output logs:
{'_or': ({'_wildcard': {'_field': 'title', '_value': '*case*'}},)}
[{'_id': '~409612464', 'id': '~409612464', 'createdBy': 'username', 'updatedBy': None, 'createdAt': 1634289634874, 'updatedAt': None, '_type': 'case', 'caseId': 6, 'title': 'case1', 'description': 'asdfsdaf', 'severity': 2, 'startDate': 1634289600000, 'endDate': None, 'impactStatus': None, 'resolutionStatus': None, 'tags': [], 'flag': False, 'tlp': 2, 'pap': 2, 'status': 'Open', 'summary': None, 'owner': 'username', 'customFields': {}, 'stats': {}, 'permissions': ['manageShare', 'manageAnalyse', 'manageTask', 'manageCaseTemplate', 'manageCase', 'manageUser', 'manageProcedure', 'managePage', 'manageObservable', 'manageTag', 'manageConfig', 'manageAlert', 'accessTheHiveFS', 'manageAction']}, {'_id': '~327696440', 'id': '~327696440', 'createdBy': 'username', 'updatedBy': None, 'createdAt': 1634290499186, 'updatedAt': None, '_type': 'case', 'caseId': 9, 'title': 'Case2', 'description': 'asdasd', 'severity': 2, 'startDate': 1634290440000, 'endDate': None, 'impactStatus': None, 'resolutionStatus': None, 'tags': [], 'flag': False, 'tlp': 2, 'pap': 2, 'status': 'Open', 'summary': None, 'owner': 'username, 'customFields': {}, 'stats': {}, 'permissions': ['manageShare', 'manageAnalyse', 'manageTask', 'manageCaseTemplate', 'manageCase', 'manageUser', 'manageProcedure', 'managePage', 'manageObservable', 'manageTag', 'manageConfig', 'manageAlert', 'accessTheHiveFS', 'manageAction']}]
{'_or': ({'_wildcard': {'_field': 'title', '_value': '*Case*'}},)}
[]