Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Playbooks] "Apply predefined rule" without objects is not working #5177

Closed
Lhorus6 opened this issue Dec 11, 2023 · 3 comments
Closed

[Playbooks] "Apply predefined rule" without objects is not working #5177

Lhorus6 opened this issue Dec 11, 2023 · 3 comments
Assignees
Labels
bug use for describing something not working as expected critical use to identify critical bug to fix ASAP solved use to identify issue that has been solved (must be linked to the solving PR)

Comments

@Lhorus6
Copy link

Lhorus6 commented Dec 11, 2023

Description

The actions performed during a playbook are not performed when an "Apply predefined rule" component is present, despite the fact that the data in the "send for ingestion" logs is correct.

The same playbook without the "Apply predefined rule" component works as expected. I've carried out a number of tests (e.g. location of the component in the playbook sequence, activation/deactivation of the "Manipulate all elements included in the bundle" options for other components, ...) but I haven't detected any particular logic behind this bug.

Environment

5.12.5

Reproducible Steps

Works

  1. Create the following Playbooks:
    Listen on Report modification --> Manipulate data to add the label "test-label" -> Send for ingestion

It works


Doesn't work

Create the following Playbooks:
Listen on Report modification --> Apply predefined rule: Resolve container references (add in bundle) --> Manipulate data to add the label "test-label" -> Send for ingestion

It doesn't work despite the fact that I can see the label on the report in the "send for ingestion" logs (see screenshot).

Screenshots

My playbooks:

Screenshot 2023-12-11 191245

The execution logs:

Screenshot 2023-12-11 191332

Send for ingestion logs:

Screenshot 2023-12-11 184945

My report AFTER playbook execution:

Screenshot 2023-12-11 185004
@Lhorus6 Lhorus6 added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team labels Dec 11, 2023
@Lhorus6 Lhorus6 changed the title [Playbooks] Bug after an "Apply predefined rule" component is present [Playbooks] Bug when an "Apply predefined rule" component is present Dec 11, 2023
@Jipegien
Copy link
Member

@SamuelHassine or @richard-julien can you check this issue please?
@Lhorus6 can you confirm the platform version is 5.12.5?

@Jipegien Jipegien added critical use to identify critical bug to fix ASAP and removed needs triage use to identify issue needing triage from Filigran Product team labels Dec 14, 2023
@SamuelHassine SamuelHassine added this to the Release 5.12.6 milestone Dec 14, 2023
@Lhorus6
Copy link
Author

Lhorus6 commented Dec 14, 2023

Ah oui pardon 5, pas 15 ;)
(sur testing)

@richard-julien richard-julien self-assigned this Dec 14, 2023
@Lhorus6
Copy link
Author

Lhorus6 commented Dec 14, 2023

After retesting, it was impossible to reproduce the bug described in this ticket. However, another error was observed:

Error

{
"message": "Cannot set properties of undefined (setting 'labels')",
"stack": "TypeError: Cannot set properties of undefined (setting 'labels')\n at Object.add (/opt/opencti/build/node_modules/fast-json-patch/commonjs/core.js:14:16)\n at applyOperation (/opt/opencti/build/node_modules/fast-json-patch/commonjs/core.js:235:60)\n at Object.applyPatch (/opt/opencti/build/node_modules/fast-json-patch/commonjs/core.js:280:22)\n at Object.executor (/opt/opencti/build/src/modules/playbook/playbook-components.ts:585:17)\n at playbookExecutor (/opt/opencti/build/src/manager/playbookManager.ts:135:44)\n at playbookExecutor (/opt/opencti/build/src/manager/playbookManager.ts:202:15)\n at processTicksAndRejections (node:internal/process/task_queues:95:5)\n at playbookExecutor (/opt/opencti/build/src/manager/playbookManager.ts:202:9)\n at playbookStreamHandler (/opt/opencti/build/src/manager/playbookManager.ts:268:13)\n at processStreamResult (/opt/opencti/build/src/database/redis.ts:613:3)\n at processStep (/opt/opencti/build/src/database/redis.ts:667:31)\n at processingLoop (/opt/opencti/build/src/database/redis.ts:684:13)",
"name": "TypeError"
}

@richard-julien richard-julien changed the title [Playbooks] Bug when an "Apply predefined rule" component is present [Playbooks] "Apply predefined rule" without objects is not working Dec 14, 2023
richard-julien added a commit that referenced this issue Dec 14, 2023
…is not working (#5177)

- Improve handling of data manipulation component
- Improve component execution error logging
@richard-julien richard-julien added the solved use to identify issue that has been solved (must be linked to the solving PR) label Dec 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected critical use to identify critical bug to fix ASAP solved use to identify issue that has been solved (must be linked to the solving PR)
Projects
None yet
Development

No branches or pull requests

4 participants