Removing custom fields

[christophetd]

Request Type

Question

Work Environment

Question	Answer
OS version (server)	Ubuntu
TheHive version / git hash	3.1.2-0.11
Package Type	Docker

Problem Description

What's the easiest way currently to remove custom fields? My understanding is that we need to go directly in Elasticsearch to do this, any pointers on how to do it?

Thank you

[nadouani]

Oops, sounds like an old unanswered question. @christophetd Is this still something you need an answer for?

[christophetd]

Would love to, thanks

[jmj-uy]

Hmm, i'v been looking for this answer for a bit. Any update on this @nadouani ?

[nadouani]

are the custom fields you want to remove, already used in case templates and cases or not?

[jmj-uy]

I would have to double check that, but i think they haven't been used yet.

[christophetd]

In my case they have already been used in cases & case templates

[nadouani]

In my case they have already been used in cases & case templates

In this case, the issue is how to deal with the cases already having those CF.
Well we can suggest a fallback solution where we cannot display the custom field label for example.

[nadouani]

Anyways, we need to double check the impacts this improvement can introduce for existing TheHive instances

[jmj-uy]

@nadouani sorry for my late response. I have both cases, used and unused CFs.

How I see it, there are 4 scenarios, since modifying it is all ready available. The main case in which could present an issue, is if its used on existing cases, the other options would only refer to:

• Used on template, not on existing cases. --> alert user on dependency.

• Not used on template, not on existing cases. --> shouldn't present an issue for removing (similar to modify).

• If used on existing cases:

  • used on small number of cases (may be reviewed manually)
  • used on large number of cases. Alert user on dependency on the existing cases and present options for mass action? May present a second issue if dashboards depend on the CF ?