In an Incident, the Observables count on Knowledge is one below the actual count

[damians-filigran]

Description

On the Knowledge screen of an incident, if there are 2 or more observables included, then the count in brackets will be one lower than the total

Environment

1. OS (where OpenCTI server runs): SaaS
2. OpenCTI version: 6.3.13
3. OpenCTI client: Edge on MacOS
4. Other environment details:

Reproducible Steps

Expected Output

Actual Output

Additional information

Example in demo here

Screenshots (optional)

[romain-filigran]

To be investigated. This isn't the first time we have an inconsistency between the number in the right-hand panel and the count in the table.

[Kedae]

The issue comes from:

• Schema send "StixFile" as an observable type
• Root query of entity send "Stixfile" as key for the computing of nb elements

[marckto-filigran]

Hello, I have a similar problem for intrusion set counts and also attribution.

[nino-filigran]

Hi @damians-filigran & @marckto-filigran we'll fix the issue regarding your problems.
For your information, we also have some work planned to rework the knowledge views:

• Create missing Diamond Model Views & Add a table in Entity/Knowledge/overview that lists all entities linked to the entity #7879: aiming to add missing views from the diamond model & to add a new view called ALL in order to represent all entities & relations linked to the specific entity (& ability to create any relation type compatible with this entity)
• Improve current knowledge views #9221: improve the current views to make them more meaningful (add some relations to some views, add some widgets, add some entities...). Basically, rework existing views.

[Lhorus6]

For the explanation, here's what's happening:

In the specific sections of the Knowledge tab, we only list specific relationship types.

-> For example, if we go to the “Malware” sections of an Intrusion set, we only display the “Intrusion set -> uses -> Malware” relationships.

However, in the counters on each sections, we count all relationships.

-> In the “Malware” section example above, the counter will count all relationships between my Intrusion set and any Malware. This means that if I have “Intrusion set -> uses -> Malware A” and “Intrusion set -> related to -> Malware B”, my counter will show 2, but I'll only have Malware A appearing in my list.