Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Case sensitivity issue with indicator_tag function #176

Open
jacobappleton-orbis opened this issue Jan 3, 2024 · 0 comments
Open

Case sensitivity issue with indicator_tag function #176

jacobappleton-orbis opened this issue Jan 3, 2024 · 0 comments

Comments

@jacobappleton-orbis
Copy link

If you have two indicators with different cases (e.g., indicator1 and InDiCaToR1, and you call the indicator_tag function with the name of the indicator (as opposed to the ID), it fails.

This is because, when it is searching for the indicator to tag, it is using the case insensitive filter parameter _filter_value__iexact, which returns both indicators (they are stored case-sensitive in SOAR), and the custom function exits with an error if there is more than one indicator found. If you change it to _filter_value__exact then it will find just the one indicator and tag it.

IMO the function should either be fully case-insensitive, and tag all indicators that match a case-insensitive search, or be fully case-sensitive, and only tag the indicator that matches a case-sensitive search. Given that SOAR stores indicators in a case-sensitive manner, it makes sense to me to do the latter.

jacobappleton-orbis added a commit to jacobappleton-orbis/playbooks that referenced this issue Jan 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant