rba icon indicating copy to clipboard operation
rba copied to clipboard

[Issue]: Risk Notable Analysis Dashboard always reports the same `threat_object type` for all Threat Objects

Open ccl0utier opened this issue 2 years ago • 2 comments

Description

This was raised by John Norton on the Outpost Security RBA Slack channel. See screenshot.
This comes from using tstats on two related MV fields that have to be joined in order.

ccl0utier avatar Jan 31 '24 14:01 ccl0utier

Issue, illustrated. From the drilldown panel in the dashboard, once you click on a rule to see details...

image

ccl0utier avatar Jan 31 '24 14:01 ccl0utier

I've tested a potential fix and will raise a PR for it.

Would give the following results, as an example: image

ccl0utier avatar Jan 31 '24 14:01 ccl0utier