opencti icon indicating copy to clipboard operation
opencti copied to clipboard

Unexpected behavior for external references created in the context of Automatic references at file upload

Open JeremyCloarec opened this issue 1 year ago • 4 comments

Description

When Automatic references at file upload is activated, an external reference is created when uploading a file in an entity. These external references behave differently, and I'm not sure if it is an expected behavior or not.

1st unexpected behavior is that it is not possible to remove the external reference, only to update or delete it. Is it normal?

2nd unexpected behavior is that these external references can be seen in the list of 'Add external references', but cannot be selected. Is it expected? Are these external references supposed to be listed in 'Add external references' at all?

Environment

  1. OS (where OpenCTI server runs): { e.g. Mac OS 10, Windows 10, Ubuntu 16.4, etc. }
  2. OpenCTI version: { e.g. OpenCTI 1.0.2 }
  3. OpenCTI client: { e.g. frontend or python }
  4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Activate the 'Automatic references at file upload' configuration on your report
  2. Create a report with a file associated
  3. Go to the report, see the external ref that was created

Expected Output

Should this external reference behave the same way as other external references?

Actual Output

Additional information

Screenshots (optional)

image

image

JeremyCloarec avatar Jun 20 '24 09:06 JeremyCloarec

@JeremyCloarec I see a PR: did you already worked on this ?

nino-filigran avatar Jun 26 '24 07:06 nino-filigran

we worked on solving the initial bug, but there was some behaviors that we weren't sure if they were intended or not. We created this issue to keept track of them and discuss them to see if they need to be changed or not

JeremyCloarec avatar Jun 26 '24 07:06 JeremyCloarec

@JeremyCloarec does this ticket still needs to be open?

nino-filigran avatar Aug 19 '24 07:08 nino-filigran

Fix: filter out not the selection of an external ref when it refers to a file

nino-filigran avatar Aug 19 '24 08:08 nino-filigran