Imported sightings' confidence level is always "5 - Improbable"

[misje]

Description

Imported sightings' confidence level is always "5 - Improbable"

Environment

1. OS (where OpenCTI server runs): docker: opencti/platform:6.0.9
2. OpenCTI version: 6.0.9
3. OpenCTI client: 6.0.9
4. Other environment details:

Reproducible Steps

The code in question is an enrichment connector producing a sighting between an observable and a identity (system), using a dummy indicator as sighting_of_ref. The code is not public yet. The connector runs as a user with max confidence set to 100, and confidence is set correctly on other entities and relationships.

I was hoping to provide a minimal STIX JSON example, but OpenCTI fails to import my sighting. There are no errors in the worker logs. The wokbench lists the sighting, but only the observable and entity are available in the database. The JSON is attached. It was produced from an investigation with a simple File observable, System identity and a sighting between them. It was attempted imported using the workbench and ImportFileStix.

sighting.json

Expected Output

The sighting imported from STIX should have the confidence from the user/group running the import/connector.

Actual Output

The confidence is "5 - Improbable", regardless of the user's max confidence level, or the confidence set in STIX. The confidence is correct for entities and relationships.

Additional information