Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[livestream] renaming of observable creates a new one in perfect sync mode #8986

Open
axelfahy opened this issue Nov 13, 2024 · 0 comments
Open
Labels
bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team

Comments

@axelfahy
Copy link
Contributor

axelfahy commented Nov 13, 2024

Description

When using livestream to replicate data between two instances of opencti, with perfect sync activated, renaming an observable creates a new one instead of renaming it. I supposed this happens when modifying information that changes the ID of the entity, possibly for all entities (not tested).

This might be linked to this previous issue: #8512

Environment

  1. OS (where OpenCTI server runs): docker
  2. OpenCTI version: 6.3.11
  3. OpenCTI client: frontend
  4. Other environment details: Two instances of opencti, both deployed with docker

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Setup data sharing between two platforms (public live stream on the source, and "perfect synchronization" on the destination)
  2. Create a report on the source, create a new domain name and add it to the report
  3. Wait for the two instances to be in sync
  4. Rename the observable (the one linked to the report)
  5. At first, nothing happends to the destination
  6. Modify another field of the observable (e.g. the description)
  7. A new observable is created on the destination, and the report is still linked to the old one. Instances are not in perfect sync anymore.

Screenshots below

Expected Output

I expect the two instances to be in perfect sync after the reproducible steps.

Actual Output

In the following screenshots, left is the source and right is the destination.

Creation of the report with the observable:
Image

Renaming of the observable, nothing happens on the destination:
Image

Modification of the description of the observable. This creates a new observable on the destination, as shown by the history.
Image

And the old one is still here:
Image

The report is still linked to the first observable:
Image

Additional information

Screenshots (optional)

@axelfahy axelfahy added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team labels Nov 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team
Projects
None yet
Development

No branches or pull requests

1 participant