Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent live stream cyclic resolutions on relation dependencies #4840

Closed
Lhorus6 opened this issue Nov 3, 2023 · 3 comments · Fixed by #4854
Closed

Prevent live stream cyclic resolutions on relation dependencies #4840

Lhorus6 opened this issue Nov 3, 2023 · 3 comments · Fixed by #4854
Assignees
Labels
bug use for describing something not working as expected solved use to identify issue that has been solved (must be linked to the solving PR)

Comments

@Lhorus6
Copy link

Lhorus6 commented Nov 3, 2023

Description

Some filters in the live stream don't work -> the live stream becomes empty. After several tests, here's what I found:

  • Entity type : Report -> feed empty (but Entity type : Indicator works)
  • Label : [Any] -> feed empty (I tested several labels, the live stream was always empty)
  • Marking definition : TLP:AMBER -> feed empty (but Marking definition:TLP:CLEAR works)

nb: I only tested a few filters, there's a good chance that others will produce the same effect

Environment

OpenCTI 5.11.12

Reproducible Steps

  1. Create a Live Stream
  2. Use one of the filter which I noted as not working in the description
  3. Look inside the stream (with the parameter "?from=0-0&recover2023/11/03") -> the stream will be empty
@Lhorus6 Lhorus6 added the bug use for describing something not working as expected label Nov 3, 2023
@labo-flg labo-flg self-assigned this Nov 3, 2023
@labo-flg
Copy link
Member

labo-flg commented Nov 3, 2023

Thanks for your feedback 🙌
Without the parameter ?from=0-0&recover2023/11/03 it seems to work fine (having events in stream when I update a report for instance). Can you confirm on your side please ?

@SamuelHassine SamuelHassine added this to the Release 5.11.13 milestone Nov 4, 2023
@SamuelHassine
Copy link
Member

@Lhorus6 please talk to @richard-julien. Your parameters are definitely not correctly formatted.

@Lhorus6
Copy link
Author

Lhorus6 commented Nov 6, 2023

I made a mistake in my message by forgetting one "=" (a mistake I didn't make in my url). Here is the parameter used : ?from=0-0&recover=2023/11/03 as it can be seen at the end of the documentation page here : https://docs.opencti.io/latest/reference/streaming
I also tried without this parameter, it didn't work either.
Ok Samuel, I will talk with Julien 👍

@richard-julien richard-julien changed the title Live stream filters don't work properly (stream empty) Prevent live stream cyclic resolutions on relation dependencies Nov 6, 2023
@SamuelHassine SamuelHassine added the solved use to identify issue that has been solved (must be linked to the solving PR) label Nov 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected solved use to identify issue that has been solved (must be linked to the solving PR)
Projects
None yet
4 participants