Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Removing custom fields #954

Closed
christophetd opened this issue Apr 12, 2019 · 9 comments

Comments

@christophetd
Copy link

commented Apr 12, 2019

Request Type

Question

Work Environment

Question Answer
OS version (server) Ubuntu
TheHive version / git hash 3.1.2-0.11
Package Type Docker

Problem Description

What's the easiest way currently to remove custom fields? My understanding is that we need to go directly in Elasticsearch to do this, any pointers on how to do it?

Thank you

@nadouani

This comment has been minimized.

Copy link
Contributor

commented Jun 14, 2019

Oops, sounds like an old unanswered question. @christophetd Is this still something you need an answer for?

@nadouani nadouani added the question label Jun 14, 2019
@christophetd

This comment has been minimized.

Copy link
Author

commented Jun 14, 2019

Would love to, thanks

@jmj-uy

This comment has been minimized.

Copy link

commented Jul 13, 2019

Hmm, i'v been looking for this answer for a bit. Any update on this @nadouani ?

@nadouani

This comment has been minimized.

Copy link
Contributor

commented Jul 15, 2019

are the custom fields you want to remove, already used in case templates and cases or not?

@jmj-uy

This comment has been minimized.

Copy link

commented Jul 15, 2019

I would have to double check that, but i think they haven't been used yet.

@christophetd

This comment has been minimized.

Copy link
Author

commented Jul 19, 2019

In my case they have already been used in cases & case templates

@nadouani

This comment has been minimized.

Copy link
Contributor

commented Jul 19, 2019

In my case they have already been used in cases & case templates

In this case, the issue is how to deal with the cases already having those CF.
Well we can suggest a fallback solution where we cannot display the custom field label for example.

@nadouani

This comment has been minimized.

Copy link
Contributor

commented Jul 19, 2019

Anyways, we need to double check the impacts this improvement can introduce for existing TheHive instances

@nadouani nadouani self-assigned this Jul 19, 2019
@nadouani nadouani added enhancement and removed question labels Jul 19, 2019
@nadouani nadouani added this to the 3.4.0-RC3 milestone Jul 19, 2019
@jmj-uy

This comment has been minimized.

Copy link

commented Jul 22, 2019

@nadouani sorry for my late response. I have both cases, used and unused CFs.

How I see it, there are 4 scenarios, since modifying it is all ready available. The main case in which could present an issue, is if its used on existing cases, the other options would only refer to:

  • Used on template, not on existing cases. --> alert user on dependency.

  • Not used on template, not on existing cases. --> shouldn't present an issue for removing (similar to modify).

  • If used on existing cases:

    • used on small number of cases (may be reviewed manually)
    • used on large number of cases. Alert user on dependency on the existing cases and present options for mass action? May present a second issue if dashboards depend on the CF ?
To-om added a commit that referenced this issue Sep 3, 2019
To-om added a commit that referenced this issue Sep 4, 2019
nadouani added a commit that referenced this issue Sep 4, 2019
@To-om To-om closed this Sep 5, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
4 participants
You can’t perform that action at this time.