Deleted Observables, Show up on the statistics tab under Observables by Type

[Wyv3rnSec]

Deleted Observables, Show up on the statistics tab under Observables by Type

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Ubuntu 16.x
OS version (client)	Ubuntu 16.x
TheHive version	TheHive2.13.1
Package Type	DEB

Problem Description

On the statistics tab/portion of theHive. If you scroll down to "Observables By Type" it will show the stats of observables even after they have been deleted.

Steps to Reproduce

1. Bulk Upload Observables IPs, Hashes, Etc. into a case
2. Delete the Observables (or a portion of them)
3. Navigate to the Statistics Page & View Observables by type.
   a. if you uploaded 1000 IPs, then delete 900 in the case, when you view the statistics page it will say there are 1000 IPs not 100.

Possible Solutions

Since data is stored within the elasticsearch database when you query the DB it will still show your deleted observable as deleted Docs. I will do some testing to validate if the deleted docs are whats causing the issue and re-update.

[Wyv3rnSec]

It seems it is related to how the Dashboard is reading the ES instance. When uploading another set of 1k Observables it can take some time to ingest (You see TheHive loading the data on the top right). If you were to delete all of those same observables and then re-add them again. They are almost instantly ingested again as if they are being cached.

I believe this is where the problem is. If the Statistics Dashboard is reading the ES versioning within the index docs or the Cache then it is getting the incorrect data thus not showing the correct graph.

Anyone else have any theories on this or solutions?

[nadouani]

Hi @RyanDress

In fact the charts related to observable stats on Statistics page, don't ignore deleted observables.

Note that the statistics page will be replaced by a new Dashboard sections where users will be able to compose their own dashboards.