opencti icon indicating copy to clipboard operation
opencti copied to clipboard

Reports and Indicators not showing when attributing a intrusion set to a threat actor

Open rabbipigeon opened this issue 4 years ago • 1 comments

Description

I have connectors that import intrusion sets and i would like to make a threat actor that connects these intrusion sets, If you go to the individual intrusion set you will see reports indicators and relations showing up correctly, The issue is if i go to the the threat actor that i attributed this intrusion set to, i dont see that same information there. I have enabled most of the rules in the rule engine but i still dont see the information.

Intrusion Set image

Threat Actor: image

Environment

  1. OS: Docker
  2. OpenCTI version: 5.2.4

Additional information

My goal is to be able to centralize information about any groups that i would like to and be able to track them through a single source.

rabbipigeon avatar Apr 08 '22 04:04 rabbipigeon

I'm facing the same issue. I assume it is bug in calculating the statistics. Similarly, if I attribute certain intrusion set to threat actor, you will not see the actual count of report in threat actor page.

AAA10CR7 avatar Jun 03 '22 20:06 AAA10CR7