Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Custom Attributes are not applied to escalated/merged Alert Assets and IOCs #477

Open
StaSys846 opened this issue May 8, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@StaSys846
Copy link

Describe the bug
When an IRIS Alert with asset/IOC information is merged to an existing case or escalated to a new case, Asset and IOCs included for import to the case don't include custom_attribute definitions (e.g. additional GUI elements like tabs/custom fields in the Asset/IOC modal view).

To Reproduce
Steps to reproduce the behavior (prerequisite: custom_attributes are defined for IOCs/Assets):

  1. Go to Alerts view
  2. Click on Merge (into new or existing case)
  3. Select alert assets and/or IOCs to be imported in the the selected case
  4. Assets and IOCs are imported to the case, BUT custom attributes are not applied

Expected behavior
After alert merging/escalation to a case including assets and/or IOCs, the asset/IOC data should include the defined custom_attributes

Desktop (please complete the following information):

  • OS: ubuntu 22.04
  • Browser: Not browser dependent
  • Version 2.4.7

Additional context
In a manual modal view "add asset" the custom attributes are loaded by "get_default_custom_attributes" (e.g. #163 case_asset_routes.py) and provided as additional input to the modal view render template, so that custom attributes are rendered for the "add" modal view and added to the asset data. This default_custom_attribute handling is missing for assets/iocs included in alerts.

@StaSys846 StaSys846 added the bug Something isn't working label May 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant