[Bug] Search Section results missing (Observables)

[nicpenning]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Ubuntu
OS version (client)	Windows 10
Virtualized Env.	True
Dedicated RAM	16 GB
vCPU	8
TheHive version / git hash	4.1.10-1
Package Type	DEB
Database	Cassandra
Index type	Elasticsearch
Attachments storage	Local
Browser type & version	Chrome 64-Bit 95.0.4638.54

Problem Description

When searching for observables the results are missing from the pages displayed.

Steps to Reproduce

1. Go to the Search page and then click on Observables
2. Enter any search such as data type (ip, mail_subject,etc..), ioc, etc.. and click search
3. Select the different pages to see no results, or some results.

What is also strange is if you add multiple data types it will then show some of the missing results, but it is still partial.

mail_subject - no results shown

adding ip to data type with mail_subject, then some data shows. Still incomplete but at least some results.

Possible Solutions

Ensure queries in the search app display all results.

Complementary information

(add anything that can help identifying the problem such as log excerpts, screenshots, configuration dumps etc.)

[To-om]

Can you open the developer console of your browser (F12), go to "console" tab and look for error message ?

Then go to "Network" tab, run the search on observables again. You should see a new request "http://xxx/api/case/artifact/_search?range=0-10&nparent=10". Can you check the response of that request ? Please provide it possible.

[nicpenning]

I will do that as soon as I can but I vividly remember the response was "[ ]" for that query. I can get screenshots at a later time for proof though.

[nicpenning]

Request: {"query":{"_and":[{"_and":[{"_like":{"_field":"dataType","_value":"mail_subject"}},{"_between":{"_field":"createdAt","_from":1635138000843,"_to":1635829199843}}]}]}}

There is nothing in the response.

Does this help?

[To-om]

do you have any logs in /var/log/thehive/application.log when you do the request ?

[nmprokop]

Here are the logs we see @To-om

[warn] o.t.s.u.Retry - An error occurs (java.lang.IllegalArgumentException: The provided traverser does not map to a value: v[40996952]->[JanusGraphVertexStep(IN,[ShareObservable],vertex), JanusGraphVertexStep(OUT,[ShareCase],vertex), NoOpBarrierStep(2500), ProjectStep([82212fa2-6b1b-4018-8398-f381869d8711, 9f55c1e5-ae23-4947-9965-c5505d45d25a, 90621ca3-36f8-49cc-aa84-fcd50ee82ada],[identity, [JanusGraphVertexStep(OUT,[CaseCustomField],edge), ProjectStep([c26b2ef7-d5e1-47e5-b3bd-5590ed42a495, 70f443e3-b972-465e-a3c4-41d59036ecf5],[identity, [EdgeVertexStep(IN)]]), FoldStep], [JanusGraphVertexStep(IN,[ShareCase],vertex), TraversalFilterStep([JanusGraphVertexStep(IN,[OrganisationShare],vertex), HasStep([~id.eq(28800)])]), JanusGraphVertexStep(OUT,[ShareProfile],vertex), NoOpBarrierStep(2500), JanusGraphPropertiesStep([permissions],value), FoldStep]])]), retrying (1)
[warn] o.t.s.u.Retry - An error occurs (java.lang.IllegalArgumentException: The provided traverser does not map to a value: v[41050264]->[JanusGraphVertexStep(IN,[ShareObservable],vertex), JanusGraphVertexStep(OUT,[ShareCase],vertex), NoOpBarrierStep(2500), ProjectStep([82212fa2-6b1b-4018-8398-f381869d8711, 9f55c1e5-ae23-4947-9965-c5505d45d25a, 90621ca3-36f8-49cc-aa84-fcd50ee82ada],[identity, [JanusGraphVertexStep(OUT,[CaseCustomField],edge), ProjectStep([c26b2ef7-d5e1-47e5-b3bd-5590ed42a495, 70f443e3-b972-465e-a3c4-41d59036ecf5],[identity, [EdgeVertexStep(IN)]]), FoldStep], [JanusGraphVertexStep(IN,[ShareCase],vertex), TraversalFilterStep([JanusGraphVertexStep(IN,[OrganisationShare],vertex), HasStep([~id.eq(28800)])]), JanusGraphVertexStep(OUT,[ShareProfile],vertex), NoOpBarrierStep(2500), JanusGraphPropertiesStep([permissions],value), FoldStep]])]), retrying (2)
[warn] o.t.s.u.Retry - An error occurs (java.lang.IllegalArgumentException: The provided traverser does not map to a value: v[81936552]->[JanusGraphVertexStep(IN,[ShareObservable],vertex), JanusGraphVertexStep(OUT,[ShareCase],vertex), NoOpBarrierStep(2500), ProjectStep([82212fa2-6b1b-4018-8398-f381869d8711, 9f55c1e5-ae23-4947-9965-c5505d45d25a, 90621ca3-36f8-49cc-aa84-fcd50ee82ada],[identity, [JanusGraphVertexStep(OUT,[CaseCustomField],edge), ProjectStep([c26b2ef7-d5e1-47e5-b3bd-5590ed42a495, 70f443e3-b972-465e-a3c4-41d59036ecf5],[identity, [EdgeVertexStep(IN)]]), FoldStep], [JanusGraphVertexStep(IN,[ShareCase],vertex), TraversalFilterStep([JanusGraphVertexStep(IN,[OrganisationShare],vertex), HasStep([~id.eq(28800)])]), JanusGraphVertexStep(OUT,[ShareProfile],vertex), NoOpBarrierStep(2500), JanusGraphPropertiesStep([permissions],value), FoldStep]])]), retrying (1)
[warn] o.t.s.u.Retry - An error occurs (java.lang.IllegalArgumentException: The provided traverser does not map to a value: v[81944792]->[JanusGraphVertexStep(IN,[ShareObservable],vertex), JanusGraphVertexStep(OUT,[ShareCase],vertex), NoOpBarrierStep(2500), ProjectStep([82212fa2-6b1b-4018-8398-f381869d8711, 9f55c1e5-ae23-4947-9965-c5505d45d25a, 90621ca3-36f8-49cc-aa84-fcd50ee82ada],[identity, [JanusGraphVertexStep(OUT,[CaseCustomField],edge), ProjectStep([c26b2ef7-d5e1-47e5-b3bd-5590ed42a495, 70f443e3-b972-465e-a3c4-41d59036ecf5],[identity, [EdgeVertexStep(IN)]]), FoldStep], [JanusGraphVertexStep(IN,[ShareCase],vertex), TraversalFilterStep([JanusGraphVertexStep(IN,[OrganisationShare],vertex), HasStep([~id.eq(28800)])]), JanusGraphVertexStep(OUT,[ShareProfile],vertex), NoOpBarrierStep(2500), JanusGraphPropertiesStep([permissions],value), FoldStep]])]), retrying (2)