[Bug] Migration breaks links between alerts and cases thus rendering all alert statuses as ignored

[Kamforka]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Ubuntu 20.04
OS version (client)	Ubuntu 20.04
Virtualized Env.	True
Dedicated RAM	16 GB
vCPU	8
TheHive version / git hash	4.1.11
Package Type	Binary
Database	Cassandra
Index type	Lucene
Attachments storage	Local
Browser type & version	N/A

Problem Description

Migrating TheHive 3.5.1 to TheHive 4.1.11 is successful however pre-existing alerts no longer associated with their cases.

Steps to Reproduce

Command of the migration:

/opt/thehive/bin/migrate --output /etc/thehive/application.conf --main-organisation myorg --es-uri http://elasticsearch:9200 --es-index the_hive

Content of application.conf:

play.http.secret.key=${THEHIVE_SECRET}
play.http.parser.maxDiskBuffer: 500MB
auth.defaultUserDomain: "myorg.com"

play.modules.enabled += org.thp.thehive.connector.cortex.CortexModule
cortex {
  servers = [
    {
      name = cortex
      url = ${THEHIVE_CORTEX_URL}
      auth {
        type = "bearer"
        key = ${THEHIVE_CORTEX_KEY}
      }
      wsConfig {}
    includedTheHiveOrganisations = ["*"]
    excludedTheHiveOrganisations = []
    }
  ]
  refreshDelay = 5 seconds
  maxRetryOnError = 3
  statusCheckInterval = 1 minute
}

db {
  provider: janusgraph
  janusgraph {
    storage {
      backend: cql
      hostname: ["cassandra"]

      cql {
        cluster-name: thp
        keyspace: thehive
        read-consistency-level: ONE
        write-consistency-level: ONE
      }
    }

    index {
      search {
        backend: lucene
        directory: /opt/thp/thehive/index
      }
    }
  }
}

storage {
   provider: localfs
   localfs.location: /opt/thp/thehive/data
}

Possible Solutions

I've tried to drop and rebuild the index from the Platform Status view, however the problem still persists.

Complementary information

Old alerts without cases:

New alerts with cases, as expected:

[nadouani]

Hello @Kamforka well, this is not expected so we need to find a way to reproduce it. When you take a look to the details of one of those cases, can you see "Related Alerts"?

[Kamforka]

@nadouani nothing shows up. Also if I query a specific alert then I can see its case field is null.