Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Search feature in content mapping view does not search for highlighted text #9520

Open
ups1decyber opened this issue Jan 7, 2025 · 3 comments
Labels
bug use for describing something not working as expected
Milestone

Comments

@ups1decyber
Copy link

Description

In a report's content mapping view, you can highlight text which opens a search dialog for the respective highlighted text. However, sometimes, the search query does not correspond to the highlighted text, but some previous search term instead.

Environment

  1. OpenCTI version: 6.4.2
  2. OpenCTI client: frontend

Reproducible Steps

This one is a bit hard to reproduce, unfortunately. From my latest experiences, the best chances to reproduce are by following these steps:

  1. Create a report with some text content (no files needed). For testing purposes, add some keyword such as telecom or South-East Asia (note that these keywords do not correspond to exact entity names).
  2. Go to the report's content mapping view.
  3. Highlight text to open the respective search dialog and map some fields. This should work as intended.
  4. Once you try to map telecom or South-East Asia, you may notice that the respective entities have slightly different names in OpenCTI (Telecommunications and South-Eastern Asia). Sometimes, I won't find the correct entity using the keyword from the report, so I search for the correct name instead. -> Change the search term from South-East Asia to South-Eastern Asia and select the correct result.
  5. Any further mappings won't search for the highlighted terms.

This behaviour does not change with a page refresh and appears, but it seems to be bound to the report entity. In the same OpenCTI session, the content mapping will work again for other reports.

Expected Output

Search dialog in the content mapping view should search for the highlighted text.

Actual Output

Sometimes, it does not.

Additional information

none

Screenshots (optional)

none

@ups1decyber ups1decyber added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team labels Jan 7, 2025
@nino-filigran
Copy link

I've struggled a bit to understand the issue. But I think I've been able to reproduce. Can you confirm that you did take the following steps? And that the final problem is the correct one?

  1. Create a report with some text content (no files needed). For testing purposes, add some keyword such as telecom or South-East Asia (note that these keywords do not correspond to exact entity names).
  2. Go to the report's content mapping view.
  3. Highlight text to open the respective search dialog
  4. Change the searched text in the search dialog in the drawer
  5. Close the drawer
  6. Highlight again some text

Result: the search does not search for the highligted search but your previous search.

Example:
https://github.com/user-attachments/assets/0598888d-c416-4e22-97e5-b67faf0679fd

@nino-filigran nino-filigran added needs more info Intel needed about the use case and removed needs triage use to identify issue needing triage from Filigran Product team labels Jan 8, 2025
@ups1decyber
Copy link
Author

Hi @nino-filigran

sorry if my description was confusing. What you experience in the video is the behavior that I mean.

@nino-filigran
Copy link

It was not, I just wanted to make sure we are aligned on the problem you're experimenting.

@nino-filigran nino-filigran removed the needs more info Intel needed about the use case label Jan 9, 2025
@nino-filigran nino-filigran added this to the Bugs backlog milestone Jan 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected
Projects
None yet
Development

No branches or pull requests

2 participants