[Ransomware live] Create relationships with the wrong sectors #3506
Labels
bug
use for describing something not working as expected
filigran support
[optional] use to identify an issue related to feature developed & maintained by Filigran.
to verify
use to identified for Verified
Milestone
Description
The Ransomware live connector is incorrectly fetching sectors, which makes relationships with the wrong entities. The problem is in this query: https://github.com/OpenCTI-Platform/connectors/blob/881e881c79865291945f8ca1ffc3bdee0dcf1bee/external-import/ransomwarelive/src/lib/ransom_conn.py#L291C7-L292C7
The "search" operator is used instead of "eq". This produces this kind of problem:
If I have the sector "Food and drinks businesses" in my platform and I search with this filter for the sector "Business Services", I can get as a result of my query the sector "Food and drinks businesses" even if I have "Business Services" in my platform.
To make sure to fetch the right sector, the "search" operator should be replaced by "eq".
However, rather than searching for an existing sector, the connector should only create a sector (create the stix object) without worrying about what exists in the platform. This is how the connectors should work.
Environment
OCTI 6.5.3
Reproducible Steps
Steps to create the smallest reproducible scenario:
The text was updated successfully, but these errors were encountered: