Dashboard based on observables not refreshing correctly

[auslaender6]

Dashboard based on Observables not refreshing correctly

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Turnkey Core Server (Debian)
OS version (client)	Win 10 (64Bit)
TheHive version / git hash	3.3.1-1
Package Type	DEB
Browser type & version	Chrome v74 (64Bit)

Problem Description

Hi, we just faced a little problem. From time to time ist happen that an analyst creates an observable (IP) like this 1.1.1[.]1, which of course is bad. (Copy&paste human error). We have a dashboard that shows top 20 IPs, so I saw this and deleted the observable and created a new one like 1.1.1.1 . But in the Dashboard it still shows the 1.1.1[.]1, but if you do a search, nothing is found. Any ideas?

Steps to Reproduce

1. Create a dashboard showing the Top 10 IPs used as observable
2. Create or use some sample cases with some IPs as observable
3. Create an observable, Type "IP" with the content 1.1.1[.]1
4. At the dashboard you got now an IP with the bracktes []
5. Delete the observable IP with the content 1.1.1[.]1
6. Create a new observable, Type "IP" with the content 1.1.1.1
7. At the dashboard you see still the observable with the []

Complementary information

[crackytsi]

Did you try adding a filter for "status=Ok"?

[auslaender6]

I tried, now the are gone. :) But can you explain why? I mean I deleted these observables and created new ones?

[crackytsi]

Because deleted artifacts stay in db and just get the status "Deleted".

@nadouani Shouldn't the standard dashboards include this filter as well?

[nadouani]

@nadouani Shouldn't the standard dashboards include this filter as well?

Certainly, if it's not the case, that's a bug, but fixing the already created dashboards is not possible. We can fix it for the new installations, but not for those who have already the dashboards created :(

[auslaender6]

It`s ok for me, but for anyone else it would be nice to set this as default for future installations.

[nadouani]

Yes, we will fix this in 3.4.0-RC2