opencti icon indicating copy to clipboard operation
opencti copied to clipboard

"is not empty" operator does not work on CPE attribute

Open Jipegien opened this issue 1 year ago • 1 comments

Description

Filtering Softwares with "cpe is not empty" list Software with empty CPE.

Jipegien avatar Mar 29 '24 13:03 Jipegien

The filter 'is not empty' is working. The problem is that the 'cpe' attribute is equal to "" (empty string) when it is undefined, instead of being really equal to null/undefined. Same problem for other fields (like swid, vendor, version, etc for Softwares).

We can either:

  • make the 'is not empty' operator take empty string into account
  • migrate empty string to null value + setting null value to those fields at software creation/edition instead of empty string

Chosen solution (validated with @Jipegien ) : make the 'is not empty' operator take empty string into account

Archidoit avatar Mar 29 '24 14:03 Archidoit