You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
(1) All string values are trimmed just before indexing, so if you create an entity with a name having trailing whitespaces, creation will succeed and in the database it will end up without these spaces.
(2) When a platform receives an update event to ingest, it checks if it would result in changes, and will not patch the object if there is nothing to change.
Now if you receive an update event with just the same name with the whitespaces, the patch check (2) will detect this is a valid patch as it's indeed different from what's in database (the trimmed version IS different from the raw version).
Update will occur, and an event will be emitted. But the object name is not changed in database because (1).
Now the fun part: if you have bidirectional synchronization of 2 OCTI platform on these events, you enter an infinite loop of update events. The initial emitter sees their own creation event coming back, ingested, and thrown back again, etc.
Environment
6.0.9
Reproducible Steps
A simple repo case can be achieved with Playbook to simulate this bidirectional sync loop
Create a playbook with a Listener on create/update reports + ingester
Start the playbook (in local, do not forget to start a Worker)
Open the live stream
Create a report with name ending with several whitespaces, like aa
checkout the live stream
Expected Output
1 Creation event and that's it
Actual Output
Infinite loop of update events
Additional information
The text was updated successfully, but these errors were encountered:
labo-flg
added
bug
use for describing something not working as expected
needs triage
use to identify issue needing triage from Filigran Product team
labels
Apr 16, 2024
Description
Knowing that:
Now if you receive an update event with just the same name with the whitespaces, the patch check (2) will detect this is a valid patch as it's indeed different from what's in database (the trimmed version IS different from the raw version).
Update will occur, and an event will be emitted. But the object name is not changed in database because (1).
Now the fun part: if you have bidirectional synchronization of 2 OCTI platform on these events, you enter an infinite loop of update events. The initial emitter sees their own creation event coming back, ingested, and thrown back again, etc.
Environment
6.0.9
Reproducible Steps
A simple repo case can be achieved with Playbook to simulate this bidirectional sync loop
aa
Expected Output
1 Creation event and that's it
Actual Output
Infinite loop of update events
Additional information
The text was updated successfully, but these errors were encountered: