opencti icon indicating copy to clipboard operation
opencti copied to clipboard

Reports don't manage correctly big numbers of entities

Open jborozco opened this issue 9 months ago • 1 comments

Created from https://github.com/OpenCTI-Platform/opencti/issues/6499

Description

When there are too many entities in a report:

  • Visualization in knowledge is empty
  • The list of entites is empty (https://github.com/OpenCTI-Platform/opencti/issues/6499#issuecomment-2079175889)

Environment

  1. OS (where OpenCTI server runs): { e.g. Mac OS 10, Windows 10, Ubuntu 16.4, etc. }
  2. OpenCTI version: { e.g. OpenCTI 1.0.2 }
  3. OpenCTI client: { e.g. frontend or python }
  4. Other environment details:

Reproducible Steps

Have a report with I couldn't reproduce it but the are a lot of info and screenshot here https://github.com/OpenCTI-Platform/opencti/issues/6499

In theory, open a report with 3k entities

Expected Output

All entities are visualised

Actual Output

The pages are blank

Additional information

Screenshots (optional)

jborozco avatar Apr 29 '24 14:04 jborozco

Can you provide a repro case on testing @jborozco? thanks

richard-julien avatar May 18 '24 10:05 richard-julien

Reproducible here https://testing.octi.staging.filigran.io/dashboard/analyses/reports/3ba859df-b1fd-4bd1-bcf8-8307a31a8dc1/entities

Entity list image

Knowledge graph image

In theory there should be around 8k entities in this graph image

jborozco avatar Jun 11 '24 16:06 jborozco

Sorry to intrude... is there any prevision for this? It makes analyzing large sets of data a pain :-)

Thanks for your effort!!

AlexSanchezN avatar Jul 15 '24 19:07 AlexSanchezN

Not sure if related, but on some reports that have correlated reports, a report shows nothing on the correlation view of the Knowledge tab, attached screenshots. The correlated reports though do show this view:

image image image

dominictory avatar Aug 12 '24 08:08 dominictory