Infrastructure Breaking Investigations

[explorecti]

Description

When selecting infrastructure(add only) from a created or existing investigation all targets are shown/expanded.

Environment

1. OS: Ubuntu
2. OpenCTI version: 6.0.10
3. OpenCTI client: Frontend

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Create a new investigation
2. Add entities and select TYPE: INFRASTRUCTURE
3. Select and click to expand
4. Under "All types of target" select Infrastructure
5. click EXPAND
6. Results show ALL

Expected Output

Should only return Infrastructure target

Actual Output

Returns all targets

Additional information

None

Screenshots (optional)

None

[Jipegien]

Can't reproduce it. MalwareA targeting multiple entities. MalwareA targeting Infra1. Creating investigation that contains MalwareA. Expand -> Infrastructure. Only Infra1 appears.

Do you have any additional information about your situation?

[explorecti]

@Jipegien Please select Type "Infrastructure" when adding entities then expand just the "All types of targets" and choose "Infrastructure", then it displays all targets. Don't use Malware as the example because that doesn't expose the issue.

[nino-filigran]

@explorecti I confirm, I've been able to reproduce, by first adding the entity type = infra in the graph, then choosing to expand only infra, resulting in having not only infrastructures but all other linked entities added to my graph.

[explorecti]

Is there an update when this will be fixed?

[nino-filigran]

Hi @explorecti as you can see @SarahBocognano assigned herself on the ticket. Before, nobody did work on this. Therefore, this will be fixed soon. The ticket will be updated once done.

[SarahBocognano]

Update: This issue is applicable to all entities, example :

• I add a threat Actor in investigation
• I select this threat actor
• I select "Threat Actor" to expand only Result : Every other relationships of this entity if expanded too