Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[live streams] with deletions does not delete relationships #9700

Open
axelfahy opened this issue Jan 24, 2025 · 0 comments
Open

[live streams] with deletions does not delete relationships #9700

axelfahy opened this issue Jan 24, 2025 · 0 comments
Labels
bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team

Comments

@axelfahy
Copy link
Contributor

Description

When using live streams, with the "Take deletions into account", the relationships are not removed on the destination.

Setup of the synchronizer:

Image

Environment

  1. OS (where OpenCTI server runs): docker
  2. OpenCTI version: 6.4.8
  3. OpenCTI client: frontend
  4. Other environment details: On the screenshots, left is the source and right the destination.

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Create an observable, with labels, external references, etc. and a report containing this observable.

Image

  1. On the source, go to the report and remove the observable from the report. Update the description as well to be sure that both are in sync.

Image

The description has been updated, but the relationships to the observable has not been deleted on the destination.

  1. The same thing happens with labels, external references of the observable. In this example, removing the label1 and the external reference from test.com on the source does not remove it on the destination.

Image

Expected Output

With the "take deletions into account" option, I expected the relationships between the report and the observables to be deleted as well. And I expected a deletion for the link between the observables and the labels, external references as well.

Actual Output

Relationships are still present on the destination.

Additional information

Screenshots (optional)

@axelfahy axelfahy added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team labels Jan 24, 2025
@axelfahy axelfahy changed the title [live streams] with deletions does not remove relationships [live streams] with deletions does not delete relationships Jan 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team
Projects
None yet
Development

No branches or pull requests

1 participant