You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If you have two indicators with different cases (e.g., indicator1 and InDiCaToR1, and you call the indicator_tag function with the name of the indicator (as opposed to the ID), it fails.
This is because, when it is searching for the indicator to tag, it is using the case insensitive filter parameter _filter_value__iexact, which returns both indicators (they are stored case-sensitive in SOAR), and the custom function exits with an error if there is more than one indicator found. If you change it to _filter_value__exact then it will find just the one indicator and tag it.
IMO the function should either be fully case-insensitive, and tag all indicators that match a case-insensitive search, or be fully case-sensitive, and only tag the indicator that matches a case-sensitive search. Given that SOAR stores indicators in a case-sensitive manner, it makes sense to me to do the latter.
The text was updated successfully, but these errors were encountered:
If you have two indicators with different cases (e.g.,
indicator1
andInDiCaToR1
, and you call the indicator_tag function with the name of the indicator (as opposed to the ID), it fails.This is because, when it is searching for the indicator to tag, it is using the case insensitive filter parameter
_filter_value__iexact
, which returns both indicators (they are stored case-sensitive in SOAR), and the custom function exits with an error if there is more than one indicator found. If you change it to_filter_value__exact
then it will find just the one indicator and tag it.IMO the function should either be fully case-insensitive, and tag all indicators that match a case-insensitive search, or be fully case-sensitive, and only tag the indicator that matches a case-sensitive search. Given that SOAR stores indicators in a case-sensitive manner, it makes sense to me to do the latter.
The text was updated successfully, but these errors were encountered: