Support for using asterisks by tag-filtering

[crackytsi]

Request Type

Feature Request

Work Environment

Question	Answer
OS version (server)	Debian
OS version (client)	Seven
TheHive version / git hash	3.3.0-1
Package Type	RPM, DEB, Docker, Binary, From source
Browser type & version	Chrome

Problem Description

The Case #666 adds general support for using the "*" as asterisk.
First of all, thanks for introducing this feature :) :) :)
It works fine e.g. for title or username etc.

Unforunately this does not work with Tags. That means not in the case-list and also not in the dashboard (e.g. using a donut and filter anyof tags "category:*").

As this technically was working with my ES tests, I assume that it is not correctly translated.

Another related issue is that autocompletion suggests you something and it requires 2 times pressing escape not to accept this suggestion.
I would expect if I type something that autocompletion suggests I select the entry from the suggestions or just press enter to accept that what I had typed in. This is currently not the case.

Possible Solutions

-Translate the query also for tags on Cases / Observables.
-Use the typed in entry if no suggested autocompletion value is selected.

Complementary information

How to reproduce:

1. Create a case with a tag, e.g. "category: demo"
2. Add Filter for Tags: "category:*"
3. Expected is only the case that has this tag.

[nadouani]

No the changes made by #666 have been rolled back because it broke other filters. Now wildcard are supported but not by default, we have to enable them on some fields.

[crackytsi]

@nadouani Is there any chance to get this implemented? Would really help a log (also for dashboards)

[crackytsi]

@nadouani : I double checked it with TheHive 4.0.4 (at pre-blog time) but there it is also not working. Do you think you replan this as a TheHive4 feature in the future?
Right now its tagged for TheHive3 and I can't change that.

[nadouani]

Tag filters now uses a like operator to allow the *XXXX* syntax on tag filters

[crackytsi]

@nadouani You made my day ;-)