Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue : The platform does not accept derived from relation between 2 indicators #1059

Closed
fsnormand opened this issue Feb 4, 2021 · 0 comments
Assignees
Labels
bug use for describing something not working as expected feature use for describing a new feature to develop solved use to identify issue that has been solved (must be linked to the solving PR)
Milestone

Comments

@fsnormand
Copy link

Description

The Stixv2.1 bundle with 2 indicators with derived-from relation , we have this error : "The relationship type derived-from is not allowed between Indicator and Indicator". More details in the additional information.

Environment

  1. OS : Ubuntu 20.04
  2. OpenCTI version: 4.0.7
  3. OpenCTI client: 4.0.7
  4. Other environment details:

Reproducible Steps

When we pushed with the lastinfosec connector a stixv2.1 bundle containing 2 indicators with "derived-from" relation with have an error.

Expected Output

The relation will be created between 2 indicators.

Actual Output

The relation will not be created between 2 indicators.

Additional information

Error Log : {"user":{"ip":"::ffff:10.0.11.4","user_id":"88ec0c6a-13ce-5e39-b486-354fe4a7084f","applicant_id":"88ec0c6a-13ce-5e39-b486-354fe4a7084f","call_retry_number":""},"type":"WRITE_ERROR","operation_query":"mutation StixCoreRelationshipAdd($input:StixCoreRelationshipAddInput!){stixCoreRelationshipAdd(input:$input){id standard_id entity_type parent_types}}","inner_relation_creation":0,"operation":"StixCoreRelationshipAdd","time":39,"variables":{"input":{"fromId":"indicator--7409b221-4ec4-488c-b9db-861d08a93d5e","toId":"indicator--51b912ef-b6b5-493a-bbf1-3d9a6103169c","stix_id":"relationship--04d15ff7-a6d8-4629-8ba5-639687c346aa","relationship_type":"derived-from","description":"","start_time":null,"stop_time":null,"revoked":null,"confidence":0,"lang":null,"created":"2021-01-29T18:24:17.000Z","modified":"2021-01-29T18:24:17.000Z","createdBy":null,"objectMarking":[],"objectLabel":[],"externalReferences":[],"killChainPhases":[],"update":false}},"size":507,"error":{"data":{"reason":"The relationship type derived-from is not allowed between Indicator and Indicator","category":"business"},"stacktrace":["FunctionalError: Business validation","at t (/opt/opencti/build/index.js:1:55860)","at p (/opt/opencti/build/index.js:1:56653)","at /opt/opencti/build/index.js:1:23302","at Fe (/opt/opencti/build/index.js:1:23495)","at runMicrotasks ()","at processTicksAndRejections (internal/process/task_queues.js:93:5)","at async /opt/opencti/build/index.js:1:184906"]},"level":"error","message":"API Call","timestamp":"2021-01-30T12:21:22.257Z"}

@SamuelHassine SamuelHassine added bug use for describing something not working as expected feature use for describing a new feature to develop labels Feb 4, 2021
@SamuelHassine SamuelHassine added this to the Release 4.2.0 milestone Feb 4, 2021
@SamuelHassine SamuelHassine self-assigned this Feb 4, 2021
@SamuelHassine SamuelHassine added the solved use to identify issue that has been solved (must be linked to the solving PR) label Feb 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected feature use for describing a new feature to develop solved use to identify issue that has been solved (must be linked to the solving PR)
Projects
None yet
Development

No branches or pull requests

2 participants