TTPs export from knowledge tab does not work as expected

[Lhorus6]

Description

When we export TTPs from a knowledge tab, we notice that we are exporting relationships. we would expect to export the list of TTPs linked to the intrusion set (so entities, not relations).

Moreover, given the time it takes to export (it never ends), I wonder which list of relations we're actually exporting. All the platform's relationships?

Environment

OCTI 6.0.10

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Go on an Intrusion set (that have TTPs related)
2. Go on knowledge tab then Attack pattern
3. Export

Expected Output

Export list of linked TTPs

Actual Output

I don't know

[nino-filigran]

I can reproduce. To be clear, the bug consists of 2 things:

1. The JSON export takes ages, to the point that we can consider it non-functional.
2. When trying a JSON export of malware, the file is called "date.xxxZ_Marking_(typeOfEpxort)stix_Core_Objects_full " and not date.xxxZ_Marking(typeOfEpxort)_stix_Core_Relationship_full

[nino-filigran]

If I go into a malware view, and click export:

• if you're on a "entity list view", you would export the list of malware (at least it's my assumption since the file is called date.xxxZ_Marking_(typeOfEpxort)stix_Core_Objects_full)
• if you're on a "relation view" you would export the list of malware linked to the intrusion set (at least it's my assumption since the file is called date.xxxZ_Marking(typeOfEpxort)_stix_Core_Relationship_full)

As a result, in the panel Attack Pattern, I would expect that:

• you export the list of attack patterns linked to the intrusion set (entities and not relations).

[Lhorus6]

"you export the list of attack patterns linked to the intrusion set (entities and not relations)." -> This is what I'm expecting yes

[SouadHadjiat]

When trying to reproduce, I have now this error :

is it another issue ?

Detailed error when running locally : export-file-stix.py\", line 138, in _process_message\n list_params[\"orderBy\"],\nKeyError: 'orderBy'"}

[Lhorus6]

Hi @SouadHadjiat, Indeed, I tried on demo and testing, and got the same error. It wasn't there before.