Sorting by "Feed type" only affects displayed rows

[regulartim]

In the front end, when I click on "Feed type", only the currently displayed rows are sorted. Is this the intended behaviour? Because I assumed that all resulting IOCs would be sorted, as this is the behaviour of sorting by every other column.

The reason for this is, that sorting by "feed_type" is not done on a database level but just before the HTTP response is returned. But because of pagination, at this point the list of IOCs does only contain the IOCs for the requested page.

[drosetti]

Hi can you specify what part of the frontend ? A screenshot will be appreciated.

[regulartim]

Here:

I realised that when I changed some backend code today for #419 .

[drosetti]

No I think it's a bug, I assign the issue to you.

Edit: Obviously if you only wanted to report the bug and not work on it let me know 😄

[regulartim]

No, I'm happy to have a look. :) But I would like to prioritise other things first. To be honest, I'm not sure if we should fix this at all or if it makes more sense to remove the functionality (sorting by feed type) altogether.

[drosetti]

Ok don't worry, I'll ping next weeks and you will tell me if you need more time or what do you prefer. Talking about the feature we can think about a solution together, so write what do you think about it and what you suggest

[regulartim]

I have thought about this a few times. We are working with a paginated query set here. If we sort at this point, we are only sorting the contents of the current page, which is clearly not what we want. What we should be doing is sorting at the database level (as we do for all the other properties, e.g. Last Seen). But the database, as it is now, has no concept of "feed type". I see two options:

1. Remove the option to sort by feed type altogether
2. Change our IOC model in some way to allow the database to do the sorting. This is not trivial as a single IOC can have one of many feed types depending on the request. For example, if an IOC has been seen by both Cowrie and Adbhoney, it will appear in the Cowrie feed with feed type "Cowrie", in the Adbhoney feed with feed type "Adbhoney" and in the All feed with one of the two feed types (currently it would be "Cowrie").

I would prefer option 1. Option 2 would be a lot of work for little benefit.

[drosetti]

I agree with you that changing the IOC model is too much effort. What do you thin about ordering by multiple fields, Django allows to do it

[regulartim]

Could you please explain how ordering by multiple fields would solve the problem? I'm sorry, I don't understand.