opencti icon indicating copy to clipboard operation
opencti copied to clipboard

Relationship Timeline Widget Showing Discrepancies with Total Number of Events in a Month

Open mattgriffin4281 opened this issue 2 months ago • 6 comments

Description

The Relationship Widget is showing a steep decline to 0 relationships starting in September 2025 although their have been relationship created when drilling into the data. The numbers went from in the millions very low numbers in the thousands causing concern that that widget is not functioning correctly. When looking into Relationships under Data - There were 2.9M created in September. The widget is only showing 1.98K.

Environment

  1. OS (where OpenCTI server runs): { e.g. Mac OS 10, Windows 10, Ubuntu 16.4, etc. }
  2. OpenCTI version: 6.8.6
  3. OpenCTI client:
  4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Check relationship widget graph and identify large drop in events in September
  2. Check relationships and observe if number in widget is reflecting correctly
  3. The numbers between the dashboard widget and what is located under relationship events in platform vary drastically

Expected Output

The Relationship widget should accurately reflect the number of relationships created monthly.

Actual Output

Additional information

Screenshots (optional)

Image Image

mattgriffin4281 avatar Oct 23 '25 15:10 mattgriffin4281

@mattgriffin4281 are these releations, in the list, inferred relations? What is the filter you used to display them?

I do not reproduce this issue.

nino-filigran avatar Oct 24 '25 07:10 nino-filigran

Hi Nino,

I just filtered on the date in the list to reflect the drop of relationships in the widget.

mattgriffin4281 avatar Oct 24 '25 15:10 mattgriffin4281

Are these relations infered relations?

nino-filigran avatar Oct 24 '25 15:10 nino-filigran

In looking at their instance it does seem to be reflecting just inferred entities now. But must have not been before. Why would this change? Is there a way for them to turn the relationships back to non-inferred?

mattgriffin4281 avatar Oct 24 '25 16:10 mattgriffin4281

@nino-filigran, for your awareness, this is the relationships created widget on the default dashboard shown when first logging in.

ericWadeFord avatar Oct 27 '25 13:10 ericWadeFord

Reviewed the Relationships created widget and the data in Data -> Relationships and I can not find a correlation between the number displayed for November 2025 in the widget and what is in the platform. None of the following datasets correlate:

  • Relationships created by platform creation date (November 1 and November 30)
  • Relationships created by original creation date (November 1 and November 30)
  • Relationships created by modification date (November 1 and November 30)
  • Inferred = true vs. Inferred = false for all the above.

ericWadeFord avatar Dec 11 '25 14:12 ericWadeFord