The merge does not take into account the max confidence level in some cases.

[Lhorus6]

Description

When I merge several entities, I can modify entities that have a higher confidence than mine:

• The merge only seems to check the confidence level of the main entity, i.e. the entity I choose as the one I'm going to keep for name, description, etc.
• If any of the secondary entities have a higher confidence level than mine, that's no problem. The merge is carried out all the same

Environment

OCTI 6.0.8

Reproducible Steps

Steps to create the smallest reproducible scenario:
With an admin user:

1. Create an Intrusion set "ThreatA" with the conf level at 100
2. Create an Intrusion set "ThreatB" with the conf level at 40
3. Create a user with confidence level at 50 and the capabilities to update knowledge

Log in with the new user with conf level at 50

1. Go to Data > Entities
2. Select ThreatA and ThreatB
3. Merge them by selecting ThreatB as the main entity
   -> The merge is done

[jborozco]

Duplicate of 6502

[Lhorus6]

Hi @jborozco,

No, that's not the same. The other issue is that when you can't merge two entities, a background task is created in any case, but it has no effect, and no error is raised.

Here I'm saying that merge is done in certain cases, when it shouldn't be.