-
Notifications
You must be signed in to change notification settings - Fork 798
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[PLAYBOOKS] The playbook does not create Observables based on Indicators #5313
Labels
Milestone
Comments
rattat0r
added
bug
use for describing something not working as expected
needs triage
use to identify issue needing triage from Filigran Product team
labels
Dec 28, 2023
nino-filigran
removed
the
needs triage
use to identify issue needing triage from Filigran Product team
label
Dec 28, 2023
I reproduced the issue, here is the bundle we send for creation :
the worker fails with an error because id is not present in the observable :
|
Seems that "creating indicators based on observables" playbook step fails too. I get these errors (reproduced on testing) : For indicator creation :
For relationship creation :
With this bundle :
|
SouadHadjiat
added a commit
that referenced
this issue
Jan 2, 2024
SamuelHassine
pushed a commit
that referenced
this issue
Jan 6, 2024
SamuelHassine
added
the
solved
use to identify issue that has been solved (must be linked to the solving PR)
label
Jan 6, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
I created a playbook for creating Observables based on Indicators. These Indicators are created by the RST Threat Feed external import connector. The playbook shows successful operation in the "Last execution traces" section, but new Observables are not created
Environment
Reproducible Steps
Steps to create the smallest reproducible scenario:
Expected Output
Observable has been created
Actual Output
Observable has not been created
Additional information
Indicators are created by the RST Threat Feed connector
Screenshots
The text was updated successfully, but these errors were encountered: