TheHive4py icon indicating copy to clipboard operation
TheHive4py copied to clipboard

How to search for observables with empty tags?

Open winklerrr opened this issue 2 years ago • 0 comments

Request Type

Bug

Work Environment

Question Answer
OS version (server) Ubuntu
OS version (client) Windows 10
TheHive4py version / git hash 1.8.1

Problem Description

I want to find all observables which have no tags. Currently that doesn't seem possible, the API is returning 0 elements or is raising an exception due to unexpected types for the query's value. I tried to call the query with [], "" (empty string), None, False

Steps to Reproduce

  1. Call api.find_observables(query=Eq('tags', []))

Possible Solutions

When the query is set to an empty string, include all observables without any tags.

winklerrr avatar Jun 23 '22 13:06 winklerrr