Add filter "pattern" for Indicator in Stored Filters (Data sharing, etc.) with the operator starts with

[sheetlaand]

Description

It's currently not possible to retrieve only a specific type of hash, i.e. SHA-256, using the Data Sharing > TAXII collections section. However, it is possible to obtain a consistent result, in the Observations > Indicators section, by using the "indicator pattern" filter, the "starts with" comparison field and the value "[file:hashes.'SHA-256'"

Environment

1. OS: SaaS
2. OpenCTI version: 5.12.29
3. OpenCTI client: frontend

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Click Observations
2. Click Indicators
3. Click on drop-down "Add filter" menu
4. Click on "Indicator pattern"
5. Select "starts with" in the drop-down menu
6. Write "[file:hashes.'SHA-256'" (without double quotes) in the field

Additional information

To easily resolve this constraint, simply add the "Indicator pattern" filter to the list of filters taken into account in the "Data Sharing" section.

[Jipegien]

The addition of this filters will not entirely solve the root problem, as an indicator pattern can be composed of multiple elements, with the requested hash type not in the first part.