[Bug] Get observables of a case using API not working

[yorkvik]

When trying to get the observables of a case using the api, I get this response :

{"type": "BadRequest", "message": "Property _id for type org.thp.thehive.services.ObservableSteps not found"}

I'm using TheHive4py function : get_case_observables().

Is there another way to get all the observables of a case? Or can you please solve this bug?

Thank you

[nadouani]

@To-om this is because of the _id search operator is missing.

The get_case_observable() method used the following json body to call /api/case/_search:

{
  "_and": [
    {
      "_parent": {
        "_type": "case",
        "_query": {
          "_id": "CASE_ID"
        },
      }
    },
    {
      ...
    }
  ] 
}

The issue here is that TheHive 4 doesn't have support to _id

[nadouani]

@sisecbe we will address the issue, thanks for the catch.

[nadouani]

This is most certainly fixed by #1344