Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[backend] Fix observables query for network traffic with dst_port (#6070) #6073

Merged
merged 5 commits into from
Feb 24, 2024

Conversation

SouadHadjiat
Copy link
Member

@SouadHadjiat SouadHadjiat commented Feb 22, 2024

Proposed changes

  • dst_port is an integer, we should not try to query it with ".keyword", it's also the case of other fields like "number", so we have to rewrite completely the script to handle all types of fields.
  • Add an integration test create a network traffic with dst_port and to list observables ordered by "observable_value"

Related issues

Checklist

  • I consider the submitted work as finished
  • I tested the code for its functionality
  • I wrote test cases for the relevant uses case
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

@SouadHadjiat SouadHadjiat added the filigran team use to identify PR from the Filigran team label Feb 22, 2024
Copy link

codecov bot commented Feb 22, 2024

Codecov Report

Attention: Patch coverage is 0% with 40 lines in your changes are missing coverage. Please review.

Project coverage is 66.72%. Comparing base (854fd39) to head (94ca0bb).
Report is 3 commits behind head on master.

Files Patch % Lines
...encti-platform/opencti-graphql/src/utils/format.js 0.00% 40 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #6073      +/-   ##
==========================================
+ Coverage   66.57%   66.72%   +0.15%     
==========================================
  Files         540      540              
  Lines       64270    64184      -86     
  Branches     5223     5242      +19     
==========================================
+ Hits        42788    42828      +40     
+ Misses      21482    21356     -126     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

return doc[key + '.keyword'].value;
}
} else if (doc[key].size()!=0) {
return String.valueOf(doc[key].value);
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we need to return a String value because the type of the runtime field is "keyword". Otherwise we have a cast exception

@SouadHadjiat SouadHadjiat marked this pull request as ready for review February 23, 2024 16:42
@richard-julien richard-julien merged commit 41650b9 into master Feb 24, 2024
8 checks passed
@richard-julien richard-julien deleted the issue/6070 branch February 24, 2024 13:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
filigran team use to identify PR from the Filigran team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Having Network Traffic observable with a dst ref makes the observable listing crash
2 participants