Export full indicator via SSE upon deletion

[0snap]

Problem to Solve

When a user deletes an indicator (e.g., in the web UI), OpenCTI only exports the opencti_id alongside some other metadata to connectors via SSE. Once deleted, one cannot query that indicator anymore via the API. Connectors/tools that want to work with the deleted indicator are left dangling because it is impossible to find out details about the deleted indicator (i.e., the pattern).

It would be great if OpenCTI could export the entire indicator via SSE and flag it as deleted.

Current Workaround

There is none to my knowledge

Proposed Solution

OpenCTI pushes the full indicator into the SSE stream upon deletion instead of just some metadata.

Additional Information

This slack question and the following 4 comments.

[richard-julien]

Handled in 0a1b923
Will be available in the next release.