opencti
opencti copied to clipboard
Filters on data sharing streams are not honoured
Description
Setting a filter on a shared data stream, like "Entity type != URL", does not seem to have any effect.
Environment
- OS (where OpenCTI server runs): docker
- OpenCTI version: 6.1.6
- OpenCTI client:
- Other environment details:
Reproducible Steps
Steps to create the smallest reproducible scenario:
- Create a shared data stream
- Apply a filter, like "entity type != URL"
- Import data from the stream in another OpenCTI instance, doing nothing and ingesting nothing
- Watch unwanted entities being imported
Expected Output
No URL SCOs in the second OpenCTI instance.
Actual Output
URL SCOs are imported.