opencti
opencti copied to clipboard
inferred incident is not contained into IR case after playbook creation
Description
inferred incident is not contained into IR case after playbook creation
Environment
https://demo.octi.filigran.io/
Reproducible Steps
Steps to create the smallest reproducible scenario:
- Create a playbook to wrap an incident into an IR case
- Enable rule "Infer an incident when a sighting is created for a valid indicator."
- trigger the rule to create an incident
Expected Output
The inferred incident is contained into the IR case
Actual Output
IR case is empty