opencti icon indicating copy to clipboard operation
opencti copied to clipboard

Filters on data sharing streams are not honoured

Open misje opened this issue 1 year ago • 0 comments

Description

Setting a filter on a shared data stream, like "Entity type != URL", does not seem to have any effect.

Environment

  1. OS (where OpenCTI server runs): docker
  2. OpenCTI version: 6.1.6
  3. OpenCTI client:
  4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Create a shared data stream
  2. Apply a filter, like "entity type != URL"
  3. Import data from the stream in another OpenCTI instance, doing nothing and ingesting nothing
  4. Watch unwanted entities being imported

Expected Output

No URL SCOs in the second OpenCTI instance.

Actual Output

URL SCOs are imported.

misje avatar May 31 '24 06:05 misje