[Bug] Merge Into Case search by title not working

[mphbig]

Request Type

Bug

Work Environment

Question	Awnser
OS version (server)	Debian 9
OS version (client)	Windows 10
Virtualized Env.	True
Dedicated RAM	16 GB
vCPU	8
TheHive version / git hash	4.1.2
Package Type	DEB
Database	Cassandra
Index type	Lucene
Attachments storage	Local
Browser type & version	Firefox and Chrome latest

Problem Description

When trying to merge an alert into a case using the "Merge Into Case" button, if you search your case by case title, you will find that it shows no case at all. Even after a reindex.

The request "/api/v1/query?name=get-case-for-merge" seems to never return anything.

Steps to Reproduce

1. Open a new alert
2. Try to merge it using the "Merge Into Case" button
3. Search for a case using its title

Complementary information

TheHive logs, shows nothing out of the ordinary, it reponds 200 as if everything went well.

[mphbig]

Workarround identified : using * (wildcard) character allows to find cases

[torsolaso]

You must use lowercase always an between wilcards. For me, * string * is working (no spaces)

[mphbig]

Thanks for your feedback.

This issue becomes a request for the devs to fix this behavior. So we don't have to use such workarounds.

[H2Cyber]

You must use lowercase always an between wilcards. For me, * string * is working (no spaces)

That works for some cases, but when searching for an IP (say for example *10.10.10.10*) it does not work.

[mphbig]

Little heads up on the workarround, I learned the hard way that using wildcards tends to bypass the indexes, so TheHive was behaving like pre-4.1 and was painfully slow.

It prints out this log when using wildcards :

[WARN] from org.janusgraph.graphdb.transaction.StandardJanusGraphTx in application-akka.actor.default-dispatcher-12 [0000012c|08ca3135] Query requires iterating over all vertices [()]. For better performance, use indexes

[nadouani]

Little heads up on the workarround, I learned the hard way that using wildcards tends to bypass the indexes, so TheHive was behaving like pre-4.1 and was painfully slow.

It prints out this log when using wildcards :

[WARN] from org.janusgraph.graphdb.transaction.StandardJanusGraphTx in application-akka.actor.default-dispatcher-12 [0000012c|08ca3135] Query requires iterating over all vertices [()]. For better performance, use indexes

Is this valid in 4.1.4?

[nadouani]

This looks fixed in 4.1.4

[mphbig]

We are on 4.1.4 and still got the issue :(

Could it be because we got very old data (+ 1 year old) and not everything is indexed ?
Or am I mistaking and everything is indexed ?