[Bug] Click on short report resolves outdated long report

[m-delai]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Ubuntu Server 16.04
OS version (client)	Windows 10
TheHive version	TheHive 3.4.0-1
Package Type	Docker
Browser type & version	Firefox 68.8.0

Problem Description

Expected behavior:
In case a Cortex Analyzer is run multiple time, the different reports versions are saved. The latest short report is displayed under the observable. When you click on it the corresponding long report shall be opened.

Actual behavior:
When you click on the short report, an older long report is opened (not the latest).

Cause:
The following API is not always returning the most recent case_artifact_job "id".

Endpoint: /api/connector/cortex/job/_search

Post:
{"sort":"-startDate","range":"0-1","query":{"_and":[{"_parent":{"_type":"case_artifact","_query":{"_id":"e05e45f5842f5aeae1b4d3401456ca1d"}}},{"_or":[{"analyzerId":"AaaA_ppppp_1_1"},{"_like":{"_field":"analyzerDefinition","_value":"AaaA_ppppp_1_1"}}]}]}}

[nadouani]

Hello, I wasn't able to reproduce this issue. The job listing API is correctly called:

POST /api/connector/cortex/job/_search

with the following body asking for the latest job (sorting by desc date and getting the top 1)

{
    "sort": "-startDate",
    "range": "0-1",
    "query": {
        "_and": [
            {
                "_parent": {
                    "_type": "case_artifact",
                    "_query": {
                        "_id": "2f3628ee12a16cb3303838ffae4b86a3"
                    }
                }
            },
            {
                "_or": [
                    {
                        "analyzerId": "Abuse_Finder_3_0"
                    },
                    {
                        "_like": {
                            "_field": "analyzerDefinition",
                            "_value": "Abuse_Finder_3_0"
                        }
                    }
                ]
            }
        ]
    }
}

[nadouani]

I'll close this issue as invalid, but please if you have more details to reproduce this, happy to reopen.