[Bug] Alert list constantly resets

[mphbig]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Debian 9
OS version (client)	Windows 10
Virtualized Env.	True
Dedicated RAM	32 GB
vCPU	12
TheHive version / git hash	4.1.4
Package Type	DEB
Database	Cassandra
Index type	Lucene
Attachments storage	Local
Browser type & version	Firefox and Chrome latest

Problem Description

The alert list page has a new refresh mechanism that refreshes the entire list when an alert is updated. While this seems a good idea on paper, when a lot of updates are happening, the alert list becomes unusable because the whole list disapears and reapears constatly when a refresh is ongoing. This also resets the check boxes of the alerts.

Steps to Reproduce

1. Open the alerts list page
2. Wait for alerts to be updated

Possible Solutions

• Re-implement an auto-refresh option like in the dashboards (screenshot) (if I'm not wrong it was the case in TheHive3)
• Do not hide the entire list when a refresh is running
• Add a enable/disable button auto-refresh and add a manual refresh button

[crackytsi]

I think that similar to #1015
Really a big annoying pain :-(

[mphbig]

It is apparently, we also use alerts on a "stronger level" as you wrote.

It feels that the latest release of TheHive 4 made things worse.

[nadouani]

The issue description makes sense, thanks @mphbig

Sorry @crackytsi for making your journey with TheHive a Really a big annoying pain...

Re-implement an auto-refresh option like in the dashboards (screenshot) (if I'm not wrong it was the case in TheHive3)

No this has never been the case except in dashboards, but it sounds a good idea for list pages, with just On/Off options. If you are sending all your time on the alert page, then yes it's an issue.

I'll figure out a solution for this use case.

[nadouani]

BTW, what do you mean by "A lot of alert updates are happening", can you give an idea of number of alerts, and updates let's say per minute?

[crackytsi]

Thanks @nadouani and please, please don't get me wrong, I'm not speaking about TheHive at all, only the topic that new alerts reset your current action completely unexpected. You know, I deeply appreciate your work and TheHive is really, really cool!

To give We have situtations where we have 3/alerts per Minute and situtations where we have no alert for 3 hours.
One thing that will add complexity if you disable the auto-update might be, that an alert could be already closed or merged into a case, so I guess this requires (unfortunately) some kind of extra care.

[nadouani]

This is the reason for the auto refresh, which is required in a collaborative mode, otherwise analysts will work on out-dated data.

[mphbig]

Thank you @nadouani .
To give you an idea of how many alerts we are dealling with, we got something like 6 per minute (100 to 150 alerts, creations and updates). It is not constant as well, sometimes 10 in a minute sometimes 0 for 30 minutes.

On the problems that may be introduced, maybe we could keep refreshing the alerts in the background when the view is "paused". Then the analysts could be aware of new data available with : a button "New alerts available" to refresh, a simple line of text, a notification (like when an action is successfull or failed) ...

I'd like to also precise that I am not talking about TheHive globally in my latest comment, but only the reloading of the alerts page.
We (my colleagues and I) are every thankfull for your work.

[nadouani]

We will fix the fact that the list is made hidden when data is being loaded. This is the old behavior.

In the future we will improve the reloading capability to give the user the possibility to disable auto refresh.