opencti icon indicating copy to clipboard operation
opencti copied to clipboard

Last created relationship with a relationship displayed as Unknown

Open Archidoit opened this issue 1 year ago • 3 comments

  • Go to an entity that has a relation with a relationship
  • In the entity overview, in the 'last created relationship', the relationship target is displayed as Unknown : image
  • In the Knowledge tab, nothing is displayed in the 'name' column : image

When we click on the relationship line : image

Archidoit avatar May 02 '24 12:05 Archidoit

@Archidoit I'm not able to reproduce either on Demo or Testing. I tried with several entities (Malware, Intrusion Sets, IOCs), going into the entity knowledge tab, creating a relation from there. Going back to the entity overview (went to both each time) and everything was displayed well. Can you let me know where/which case did create this issue for you?

nino-filigran avatar May 03 '24 07:05 nino-filigran

Exemple of steps to reproduce: @nino-filigran

  • On the relationships tab, click on a relationship of type 'uses'
  • Add a 'linked entity' of type 'indicator'
  • Go to the indicator overview

Archidoit avatar May 03 '24 07:05 Archidoit

To be clear, about the repro case, please use the "linked entities" as shwon in the screenshot, not the one in the list: image

I've been able to reproduce. I think there are couple of things going wrong in here:

  • when selecting the + on linked entities, the look and feel is still the "old one": this is not to be fixed here, since it's a feature not a bug
  • when selecting an indicator, the original entity that you want to create appears in an odd way (it looks like we're using a representative), while we should the From Entity exactly like the Target entity image
  • when going to the indicator's page, it looks like a relation has been created, but the "to entity" is a relationship type uses instead of an entity (I my case it was supposed to be an intrusion set) image
  • when going to the indicator's knowledge tab, the relation does not appear (is it because the relation is not vzalid, since we're creating a relation that points to a relation? image
  • when clicking on the relation, same as the begining, it's odd: image

nino-filigran avatar May 03 '24 08:05 nino-filigran